DBM: `ignore_databases` does not exclude databases from `collect_schemas`

[colinbjohnson]

Agent: 7.81.0
Integration: postgres 23.9.1
Postgres: 14 (Docker)

Summary

With dbm: true, the postgres integration's top-level ignore_databases option is documented to mean "No metrics or statement samples will be collected for these databases." In practice, collect_schemas (one of the four DBM sub-collectors) ignores it entirely and connects to every database on the instance every ~10 minutes (its default collection_interval), regardless of what's listed in ignore_databases.

Repro

Minimal docker-compose repro attached (docker-compose.yml + postgres/init/01_create_databases.sql in this same directory).

01_create_databases.sql
docker-compose.yml

• One Postgres 14 server, three databases: app_db, secret_db, other_db.
• Instance config: dbm: true, ignore_databases: [secret_db, other_db].
• log_connections/log_disconnections enabled on Postgres to observe
  every connection the Agent makes.

Result: Postgres logs show connection authorized for secret_db and other_db from application_name=datadog-agent, recurring every ~10 minutes for as long as the Agent runs — not a one-time startup event.

Isolation

Config	Connects to secret_db / other_db?
dbm: true, default config	Yes
dbm: true, database_autodiscovery.enabled: false	Yes (no change — ruled out as the cause)
dbm: false	No
dbm: true, collect_schemas.enabled: false	No
dbm: true, collect_schemas.exclude_databases: [secret_db, other_db]	No

This isolates the behavior to collect_schemas specifically. It has its own separate include_databases/exclude_databases filter, distinct from the top-level ignore_databases, and the top-level setting never populates it.

Expected vs. actual

• Expected: ignore_databases excludes listed databases from all DBM collection, per its documented description.
• Actual: ignore_databases has no effect on collect_schemas. Schema metadata (table/column names) from databases explicitly listed in ignore_databases is still collected. The only working exclusion path is the separate collect_schemas.exclude_databases option, which isn't referenced anywhere in ignore_databases's own documentation.

Ask

Either make collect_schemas respect ignore_databases, or update ignore_databases's documentation to state plainly that it does not apply to schema collection and that collect_schemas.exclude_databases must be set separately.