DataDog · cmetz100 · Aug 14, 2026
@@ -0,0 +1,7 @@
+---
+description: Syslog regression experiments.
+---
+
+# Logs — syslog
+
+Label-gated suite: runs only when its `smp/logs/syslog` label is applied to a PR.
@@ -0,0 +1,6 @@
+logs:
+  - type: tcp
+    port: 10000
+    format: syslog
+    service: "my-service"
+    source: "my-client-app"
@@ -0,0 +1,19 @@
+auth_token_file_path: /tmp/agent-auth-token
+
+# Disable cloud detection. This stops the Agent from poking around the
+# execution environment & network. This is particularly important if the target
+# has network access.
+cloud_provider_metadata: []
+
+dd_url: http://127.0.0.1:9091
+
+logs_enabled: true
+logs_config:
+  logs_dd_url: 127.0.0.1:9092
+  logs_no_ssl: true
+  force_use_http: true
+
+process_config.process_dd_url: http://localhost:9093
+
+telemetry.enabled: true
+telemetry.checks: '*'
@@ -0,0 +1,44 @@
+optimization_goal: memory
+erratic: false
+
+target:
+  name: datadog-agent
+  cpu_allotment: 4
+  # Set to 20% higher than the memory_usage check value
+  memory_allotment: 264 MiB
+
+  environment:
+    DD_API_KEY: a0000001
+    DD_HOSTNAME: smp-regression
+
+  profiling_environment:
+    DD_INTERNAL_PROFILING_BLOCK_PROFILE_RATE: 10000
+    DD_INTERNAL_PROFILING_CPU_DURATION: 1m
+    DD_INTERNAL_PROFILING_DELTA_PROFILES: true
+    DD_INTERNAL_PROFILING_ENABLED: true
+    DD_INTERNAL_PROFILING_ENABLE_GOROUTINE_STACKTRACES: true
+    DD_INTERNAL_PROFILING_MUTEX_PROFILE_FRACTION: 10
+    DD_INTERNAL_PROFILING_PERIOD: 1m
+    DD_INTERNAL_PROFILING_UNIX_SOCKET: /smp-host/apm.socket
+    DD_PROFILING_EXECUTION_TRACE_ENABLED: true
+    DD_PROFILING_EXECUTION_TRACE_PERIOD: 1m
+    DD_PROFILING_WAIT_PROFILE: true
+    DD_APM_INTERNAL_PROFILING_ENABLED: true
+
+checks:
+  - name: memory_usage
+    description: "Memory usage for syslog structured parsing pipeline"
+    bounds:
+      series: total_pss_bytes
+      # When updating this, update the memory_allotment in the target section to 20% higher
+      upper_bound: "220 MiB"
+
+  - name: intake_connections
+    description: "Connections established to intake APIs. This puts a bound on total connections per Agent instance."
+    bounds:
+      series: "connection.current"
+      upper_bound: 6
+
+report_links:
+  - text: "bounds checks dashboard"
+    link: "https://app.datadoghq.com/dashboard/vz3-jd5-bdi?fromUser=true&refresh_mode=paused&tpl_var_experiment%5B0%5D={{ experiment }}&tpl_var_job_id%5B0%5D={{ job_id }}&view=spans&from_ts={{ start_time_ms }}&to_ts={{ end_time_ms }}&live=false"
@@ -0,0 +1,23 @@
+generator:
+  - tcp:
+      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
+             59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      addr: "127.0.0.1:10000"
+      variant: "syslog5424"
+      bytes_per_second: "500 KiB"
+      maximum_prebuild_cache_size_bytes: "64 MiB"
+
+blackhole:
+  - http:
+      binding_addr: "127.0.0.1:9091"
+  - http:
+      binding_addr: "127.0.0.1:9092"
+      response_delay_millis: 75
+  - http:
+      binding_addr: "127.0.0.1:9093"
+
+target_metrics:
+  - prometheus:
+      uri: "http://127.0.0.1:5000/telemetry"
+      tags:
+        sub_agent: "core"
@@ -0,0 +1,28 @@
+logs:
+  - type: tcp
+    port: 10000
+    format: syslog
+    service: "my-service"
+    source: "my-client-app"
+    log_processing_rules:
+      - type: remap_source
+        name: siem_source_remap
+        matching:
+          - attribute: "siem.device_vendor"
+            value: "ArcSight"
+            new_source: "arcsight"
+          - attribute: "siem.device_product"
+            value: "Firewall"
+            new_source: "pan_firewall"
+          - attribute: "siem.format"
+            value: "LEEF"
+            new_source: "leef_generic"
+          - attribute: "siem.event_id"
+            value: "IDS-42"
+            new_source: "ids_alerts"
+          - attribute: "syslog.appname"
+            value: "nginx"
+            new_source: "nginx_access"
+          - attribute: "syslog.hostname"
+            value: "db-primary"
+            new_source: "database"
@@ -0,0 +1,20 @@
+auth_token_file_path: /tmp/agent-auth-token
+
+dd_url: http://localhost:9091
+process_config.process_dd_url: http://localhost:9093
+
+telemetry.enabled: true
+telemetry.checks: '*'
+
+# Disable cloud detection. This stops the Agent from poking around the
+# execution environment & network. This is particularly important if the target
+# has network access.
+cloud_provider_metadata: []
+
+logs_enabled: true
+logs_config:
+  logs_dd_url: 127.0.0.1:9092
+  logs_no_ssl: true
+  pipelines: 4
+  pipeline_failover:
+    enabled: true
@@ -0,0 +1,27 @@
+optimization_goal: memory
+erratic: false
+
+target:
+  name: datadog-agent
+  cpu_allotment: 4
+  memory_allotment: 2GiB
+
+  environment:
+    DD_API_KEY: a0000001
+    DD_HOSTNAME: smp-regression
+
+  profiling_environment:
+    DD_INTERNAL_PROFILING_BLOCK_PROFILE_RATE: 10000
+    DD_INTERNAL_PROFILING_CPU_DURATION: 1m
+    DD_INTERNAL_PROFILING_DELTA_PROFILES: true
+    DD_INTERNAL_PROFILING_ENABLED: true
+    DD_INTERNAL_PROFILING_ENABLE_GOROUTINE_STACKTRACES: true
+    DD_INTERNAL_PROFILING_MUTEX_PROFILE_FRACTION: 10
+    DD_INTERNAL_PROFILING_PERIOD: 1m
+    DD_INTERNAL_PROFILING_UNIX_SOCKET: /smp-host/apm.socket
+    DD_PROFILING_EXECUTION_TRACE_ENABLED: true
+    DD_PROFILING_EXECUTION_TRACE_PERIOD: 1m
+    DD_PROFILING_WAIT_PROFILE: true
+    DD_APM_INTERNAL_PROFILING_ENABLED: true
+
+    DD_INTERNAL_PROFILING_EXTRA_TAGS: experiment:tcp_syslog_scaling_10conn_structured
@@ -0,0 +1,23 @@
+generator:
+  - tcp:
+      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
+             59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      addr: "127.0.0.1:10000"
+      variant: "syslog5424"
+      bytes_per_second: "50 MiB"
+      parallel_connections: 10
+      maximum_prebuild_cache_size_bytes: "256 MiB"
+
+blackhole:
+  - http:
+      binding_addr: "127.0.0.1:9091"
+  - http:
+      binding_addr: "127.0.0.1:9092"
+  - http:
+      binding_addr: "127.0.0.1:9093"
+
+target_metrics:
+  - prometheus:
+      uri: "http://127.0.0.1:5000/telemetry"
+      tags:
+        sub_agent: "core"