Top-level Datadog configuration: API keys, service identity, Agent connection, intake site, hostname, global tags, and proxy settings.

DD_AGENT_HOST

Type: string
Default: localhost
Aliases:DD_TRACE_AGENT_HOSTNAME
The host name to use to connect the Datadog agent for traces. The host name can be IPv4, IPv6, or a domain name. If DD_TRACE_AGENT_URL is specified, the value of DD_AGENT_HOST is ignored.

DD_APM_TRACING_ENABLED

Type: boolean
Default: true
Aliases:DD_TRACING_ENABLED
Enables or disables sending APM trace data. When disabled, tracing still runs to support other products, but only periodic heartbeat traces and manually kept traces are sent.

DD_AUTOLOAD_NO_COMPILE

Type: boolean
Default: false
When this option is off, the tracer includes a single pre-compiled file (bridge/_generated_*.php) for efficiency, rather than including source files manually. To have changes to non-compiled tracer source files take effect, enable this option.

DD_ENV

Type: string
Sets the global env tag applied to all telemetry emitted by the tracer (traces, metrics, logs, profiles). Use it to separate environments such as prod, staging, or dev.

DD_SERVICE

Type: string
Sets the service name for your application.

DD_SERVICE_MAPPING

Type: map
Provide service names for each plugin. Accepts comma separated plugin:service-name pairs, with or without spaces.

DD_TAGS

Type: map
Custom tags applied to traces, profiles, and metrics, provided as comma-separated key:value pairs (for example, layer:api,team:intake).

DD_VERSION

Type: string

Sets the application’s version, used as the version tag in traces and logs (for example: 1.2.3, 6c44da20, 2020.02.13).

Language-specific notes:

• PHP: starting with version 0.90.0, changes made at runtime through ini_set('datadog.version', ...) are also applied to the current root span.

Core distributed tracing engine: Agent connection, trace and span ID generation, span lifecycle management, peer service mapping, resource normalization, query string obfuscation, and DB client configuration.

DD_AUTOFINISH_SPANS

Type: boolean
Default: false
Whether spans are automatically finished when the tracer is flushed.

DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED

Type: boolean
Default: true
Controls whether the tracer generates 128-bit W3C trace IDs (32-character hex) or 64-bit Datadog trace IDs (16-character hex). 128-bit IDs are required for full W3C traceparent interoperability.

DD_TRACE_128_BIT_TRACEID_LOGGING_ENABLED

Type: boolean
Default: true
Controls whether 128-bit trace IDs are logged in their full 32-character format or truncated to 16 characters. Set to false for compatibility with systems that expect the shorter format.

DD_TRACE_AGENT_CONNECT_TIMEOUT

Type: int
Default: 100
The Agent connection timeout (in milliseconds).

DD_TRACE_AGENT_PORT

Type: int
Default: 8126
The port of the Trace Agent that the tracer submits to. If the Agent configuration sets receiver_port or DD_APM_RECEIVER_PORT to something other than the default 8126, then DD_TRACE_AGENT_PORT or DD_TRACE_AGENT_URL must match it.

DD_TRACE_AGENT_TIMEOUT

Type: int
Default: 500
Timeout in seconds for network interactions with the Datadog Agent.

DD_TRACE_AGENT_URL

Type: string
Aliases:DD_TRACE_URL
Sets the URL endpoint where traces are sent. Overrides DD_AGENT_HOST and DD_TRACE_AGENT_PORT if set. Defaults to http://<DD_AGENT_HOST>:<DD_TRACE_AGENT_PORT> .

DD_TRACE_ANALYTICS_ENABLED

Type: boolean
Default: false
Enables the legacy Trace Analytics feature for all integrations by setting the analytics.sample_rate metric on spans using each integration’s configured analytics sample rate. Superseded by App Analytics in newer Datadog deployments.

DD_TRACE_CLIENT_IP_ENABLED

Type: boolean
Default: false
Enables or disables the automatic collection of client IP addresses from HTTP request headers. When enabled, the IP address is stored in the http.client_ip span tag.

DD_TRACE_CLIENT_IP_HEADER

Type: string
Configures a custom header name from which to source the http.client_ip tag value. If this variable is set, all other IP-related headers are ignored (for example, setting DD_TRACE_CLIENT_IP_HEADER=custom-ip-header and including the header custom-ip-header: 5.6.7.9 in a request results in a span tagged with “http.client_ip”: “5.6.7.9”). If an empty string or null value is passed, IP headers are queried in this order: - x-forwarded-for - x-real-ip - true-client-ip - x-client-ip - x-forwarded - forwarded-for - x-cluster-client-ip - fastly-client-ip - cf-connecting-ip - cf-connecting-ipv6

DD_TRACE_DB_CLIENT_SPLIT_BY_INSTANCE

Type: boolean
Default: false
Set the service name of HTTP requests to pdo- . For example, a PDO->query() call to a database host datadoghq.com has the service name pdo-datadoghq.com instead of the default service name of pdo.

DD_TRACE_ENABLED

Type: boolean
Default: true
Aliases:DD_TRACING_ENABLED
Enable framework and library instrumentation. When false, the application code doesn’t generate any traces. See also DD_APM_TRACING_ENABLED.

DD_TRACE_FORKED_PROCESS

Type: boolean
Default: true
If the application invokes pcntl_unshare(CLONE_NEWUSER); and the tracer is installed, the application fatally crashes. This happens because unshare with CLONE_NEWUSER requires the process not to be threaded, while the PHP tracer uses a separate thread to send traces to the Datadog Agent without blocking the main process.

DD_TRACE_GENERATE_ROOT_SPAN

Type: boolean
Default: true
Automatically generates a top-level span on request entry. Set to 0 together with DD_TRACE_AUTO_FLUSH_ENABLED=1 to instrument long-running processes.

DD_TRACE_HEALTH_METRICS_ENABLED

Type: boolean
Default: false
When set to true sends tracer health metrics

DD_TRACE_MEASURE_COMPILE_TIME

Type: boolean
Default: true
Record the compile time of the request (in milliseconds) onto the top-level span.

DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP

Type: string
Default: (?i)(?:(?:"|%22)?)(?:(?:old[-_]?|new[-_]?)?p(?:ass)?w(?:or)?d(?:1|2)?|pass(?:[-_]?phrase)?|secret|(?:api[-_]?|private[-_]?|public[-_]?|access[-_]?|secret[-_]?|app(?:lication)?[-_]?)key(?:[-_]?id)?|token|consumer[-_]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\s|%20)*(?:=|%3D)[^&]+|(?:"|%22)(?:\s|%20)*(?::|%3A)(?:\s|%20)*(?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22))|(?:bearer(?:\s|%20)+[a-z0-9._\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\w=-]|%3D)+\.ey[I-L](?:[\w=-]|%3D)+(?:\.(?:[\w.+/=-]|%3D|%2F|%2B)+)?|-{5}BEGIN(?:[a-z\s]|%20)+PRIVATE(?:\s|%20)KEY-{5}[^\-]+-{5}END(?:[a-z\s]|%20)+PRIVATE(?:\s|%20)KEY(?:-{5})?(?:\n|%0A)?|(?:ssh-(?:rsa|dss)|ecdsa-[a-z0-9]+-[a-z0-9]+)(?:\s|%20|%09)+(?:[a-z0-9/.+]|%2F|%5C|%2B){100,}(?:=|%3D)*(?:(?:\s|%20|%09)+[a-z0-9._-]+)?)
Applies a regex to redact sensitive data from query strings on incoming HTTP requests. The default regex matches various sensitive data patterns, including passwords, tokens, API keys, private keys, and authorization terms. Matches are replaced with . If an empty string is passed, no obfuscation occurs. The resulting value is reported in the http.url tag.

DD_TRACE_PEER_SERVICE_DEFAULTS_ENABLED

Type: boolean
Default: false
When enabled, the tracer computes default peer.service values for eligible spans using the v1 peer-service default algorithm under Naming Schema v0. When disabled, Naming Schema v0 leaves peer.service unset.

DD_TRACE_PEER_SERVICE_MAPPING

Type: map
Maps detected peer service names to normalized values before they are attached to spans.

DD_TRACE_REMOVE_AUTOINSTRUMENTATION_ORPHANS

Type: boolean
Default: false
Automatically remove orphaned spans generated by auto-instrumentation. Currently, this only applies to some Redis and Laravel calls used in the context of Laravel Horizon. Added in version 0.88.0. Note: These orphaned spans are flushed but not recorded in the trace. Moreover, the specific single-span traces that are removed with this configuration option are: - laravel.event.handle

DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED

Type: boolean
Default: false
When enabled, integrations under Naming Schema v0 stop using inferred service names and fall back to the application service name. Use this to make all spans report under DD_SERVICE regardless of integration.

DD_TRACE_REMOVE_ROOT_SPAN_LARAVEL_QUEUE

Type: boolean
Default: true
When enabled, automatically disables root span generation and enables auto-flushing for Laravel Queue and Horizon commands.

DD_TRACE_REMOVE_ROOT_SPAN_SYMFONY_MESSENGER

Type: boolean
Default: true
When enabled, automatically disables root span generation and enables auto-flushing for Symfony Messenger commands.

DD_TRACE_REPORT_HOSTNAME

Type: boolean
Default: false
Whether to report the system’s hostname for each trace. When disabled, the hostname of the Agent is used instead.

DD_TRACE_RESOURCE_RENAMING_ALWAYS_SIMPLIFIED_ENDPOINT

Type: boolean
Default: false
When enabled, always sets the http.endpoint tag to the result of the Resource Renaming simplification algorithm, even when an explicit endpoint is available.

DD_TRACE_RESOURCE_RENAMING_ENABLED

Type: boolean
Default: false
Controls whether the http.endpoint tag is computed and added for incoming HTTP requests. This is disabled by default unless application security is enabled at startup, and can be explicitly enabled or disabled with this setting.

DD_TRACE_RESOURCE_URI_FRAGMENT_REGEX

Type: array
CSV of regexes that identifies path fragments corresponding to IDs (see Map resource names to normalized URI).

DD_TRACE_RESOURCE_URI_MAPPING_INCOMING

Type: array
CSV of URI mappings to normalize resource naming for incoming requests (see Map resource names to normalized URI).

DD_TRACE_RESOURCE_URI_MAPPING_OUTGOING

Type: array
CSV of URI mappings to normalize resource naming for outgoing requests (see Map resource names to normalized URI).

DD_TRACE_RESOURCE_URI_QUERY_PARAM_ALLOWED

Type: array
A comma-separated list of query parameters to be collected as part of the resource URI. Set to empty to prevent collecting any parameters, or * to collect all parameters. Added in version 0.74.0.

DD_TRACE_RETAIN_THREAD_CAPABILITIES

Type: boolean
Default: false
Works for Linux. Set to true to retain capabilities on Datadog background threads when you change the effective user ID. This option does not affect most setups, but some modules - to date Datadog is only aware of Apache’s mod-ruid2 - may invoke setuid() or similar syscalls, leading to crashes or loss of functionality as it loses capabilities. Note: Enabling this option may compromise security. This option, standalone, does not pose a security risk. However, an attacker being able to exploit a vulnerability in PHP or web server may be able to escalate privileges with relative ease, if the web server or PHP were started with full capabilities, as the background threads will retain their original capabilities. Datadog recommends restricting the capabilities of the web server with the setcap utility.

DD_TRACE_SECURE_RANDOM

Type: boolean
Default: false
Since: v1.20.0
Secure random ID generation: when enabled, forces the tracer to use the SECURE_RANDOM ID generation strategy (based on SecureRandom) for trace/span IDs. This is also forced on AWS Lambda SnapStart (AWS_LAMBDA_INITIALIZATION_TYPE=snap-start). Default: false.

DD_TRACE_SIDECAR_BACKPRESSURE_BYTES

Type: int
Default: 4194304
Maximum buffered bytes before the data on the sidecar channel starts being dropped.

DD_TRACE_SIDECAR_BACKPRESSURE_QUEUE

Type: int
Default: 100
Maximum amount of unprocessed messages the sidecar may receive before messages are being dropped.

DD_TRACE_SIDECAR_CONNECTION_MODE

Type: string
Default: auto

Determines the sidecar connection mode:

• subprocess: Creates a subprocess accessible by many other processes running under the same user.
• thread: Runs the sidecar in threaded mode, only accessible from forks.

DD_TRACE_SIDECAR_TRACE_SENDER

Type: boolean
Default: false
Decides whether to send traces via background sender or sidecar. Force-enabled on Windows. This configuration will be deprecated in future and the background sender removed.

DD_TRACE_SPANS_LIMIT

Type: int
Default: 1000
The maximum number of spans that are generated within one trace. If the maximum number of spans is reached, then spans are no longer generated. If the limit is increased, then the amount of memory that is used by a pending trace will increase and might reach the PHP maximum amount of allowed memory. The maximum amount of allowed memory can be increased with the PHP INI system setting memory_limit.

DD_TRACE_STATS_COMPUTATION_ENABLED

Type: boolean
Default: false
Since: v1.19.0
Enables trace-stats computation in the tracer for stats payload generation and ingestion-side metrics.

DD_TRACE_X_DATADOG_TAGS_MAX_LENGTH

Type: int
Default: 512
Maximum length of the x-datadog-tags header for trace tag propagation. Set to 0 to disable.

Sampling rules and rates that determine which traces and spans are kept or dropped, including per-service rules, rate limiting, and priority sampling.

DD_SPAN_SAMPLING_RULES

Type: array
Default: []
Span sampling rules to keep individual spans when the rest of the trace would otherwise be dropped. A JSON array of objects. Rules are applied in configured order to determine the span’s sample rate. The sample_rate value must be between 0.0 and 1.0 (inclusive). For more information, see Ingestion Mechanisms. Example: - Set the span sample rate to 50% for the service my-service and operation name http.request, up to 50 traces per second: [{"service": "my-service", "name": "http.request", "sample_rate":0.5, "max_per_second": 50}].

DD_SPAN_SAMPLING_RULES_FILE

Type: string
Points to a JSON file that contains the span sampling rules. DD_SPAN_SAMPLING_RULES takes precedence over this variable. See DD_SPAN_SAMPLING_RULES for the rule format.

DD_TRACE_RATE_LIMIT

Type: int
Default: 100
Sets the maximum number of traces to sample per second; applies only when either DD_TRACE_SAMPLING_RULES or DD_TRACE_SAMPLE_RATE is set.

DD_TRACE_SAMPLE_RATE

Type: decimal
Default: -1
Controls the ingestion sample rate (between 0.0 and 1.0) between the Agent and the backend.

DD_TRACE_SAMPLING_RULES

Type: array
Default: []
Configures custom sampling rules for traces. Rules are evaluated in order, and the first matching rule determines the sampling rate. If no rules match, the default sampling rate is used. For more information about how these configurations affect trace ingestion, see Ingestion Mechanisms.

DD_TRACE_SAMPLING_RULES_FORMAT

Type: string
Default: glob
Sets the format of custom sampling rules. Valid values are regex or glob. If the value is not recognized, trace sampling rules are disabled.

DD_TRACE_WEBSOCKET_MESSAGES_INHERIT_SAMPLING

Type: boolean
Default: true
By default, websocket messages preserve the same sampling as the span captured during the handshake. This ensures that, if a handshake span has been sampled, all the messages in its session will also be sampled. To disable that behavior and sample each websocket message independently, set this configuration to false.

Distributed trace context propagation, extraction and injection behavior, baggage handling, header tagging, HTTP client and server configuration, and SQL comment injection for Database Monitoring.

DD_DBM_ALWAYS_APPEND_SQL_COMMENT

Type: boolean
Default: false
Since: v1.21.0
When the DD_DBM_PROPAGATION_MODE is set, a comment is injected in SQL queries. Most of the time it is prepended. This config forces the comment to be appended at all times.

DD_DISTRIBUTED_TRACING

Type: boolean
Default: true
Whether to enable distributed tracing.

DD_EXPERIMENTAL_PROPAGATE_PROCESS_TAGS_ENABLED

Type: boolean
Default: true
Controls whether process-level tags (such as entrypoint metadata) are collected and attached to tracing payloads.

DD_HTTP_SERVER_ROUTE_BASED_NAMING

Type: boolean
Default: true
When set to false http framework routes are not used for resource names. This can change resource names and derived metrics if changed.

DD_TRACE_BAGGAGE_MAX_BYTES

Type: int
Default: 8192
Configuration key to set the maximum number of bytes that can be injected into the baggage header when propagating to a downstream service. Default value is 8192 bytes.

DD_TRACE_BAGGAGE_MAX_ITEMS

Type: int
Default: 64
Configuration key to set the maximum number of items that can be injected into the baggage header when propagating to a downstream service. Default value is 64 items.

DD_TRACE_BAGGAGE_TAG_KEYS

Type: array
Default: user.id, session.id, account.id
Comma-separated list of baggage keys to copy into span tags. Set to * to tag all baggage items; if unset, a default allowlist is used.

DD_TRACE_HEADER_TAGS

Type: map
Automatically apply specified HTTP headers as span tags. If a custom tag name is not specified, the tag key defaults to http.request.headers. for request headers and http.response.headers. for response headers.

DD_TRACE_HTTP_CLIENT_SPLIT_BY_DOMAIN

Type: boolean
Default: false
Set the service name of HTTP requests to host- , for example a curl_exec() call to https://datadoghq.com has the service name host-datadoghq.com instead of the default service name of curl.

DD_TRACE_HTTP_POST_DATA_PARAM_ALLOWED

Type: array
A comma-separated list of HTTP POST data fields to collect as span tags. Use * to collect all fields; values matching DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP are redacted. Leave empty to collect nothing.

DD_TRACE_HTTP_SERVER_ERROR_STATUSES

Type: array
Default: 500-599
null

DD_TRACE_HTTP_URL_QUERY_PARAM_ALLOWED

Type: array
Default: *
A comma-separated list of query parameters to be collected as part of the URL. Set to empty to prevent collecting any parameters, or * to collect all parameters. Added in version 0.74.0.

DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED

Type: boolean
Default: false
Aliases:DD_TRACE_INFERRED_SPANS_ENABLED
When enabled, the tracer registers the inferred-proxy propagator, which reads x-dd-proxy* headers (currently x-dd-proxy=aws-apigateway) and starts an inferred proxy span as the parent of the server span, using header values for service, resource, and tags.

DD_TRACE_PROPAGATION_STYLE

Type: array
Default: datadog,tracecontext,baggage
Aliases:OTEL_PROPAGATORS
A comma-separated list of header formats from which to attempt to inject and extract distributed tracing propagation data. The first format found with complete and valid headers is used to define the trace to continue. The more specific DD_TRACE_PROPAGATION_STYLE_INJECT and DD_TRACE_PROPAGATION_STYLE_EXTRACT configurations take priority when present.

DD_TRACE_PROPAGATION_STYLE_EXTRACT

Type: array
Default: datadog,tracecontext,B3,B3 single header,baggage
A comma-separated list of header formats from which to attempt to extract distributed tracing propagation data. The first format found with complete and valid headers is used to define the trace to continue.

DD_TRACE_PROPAGATION_STYLE_INJECT

Type: array
Default: datadog,tracecontext,baggage
Aliases:DD_PROPAGATION_STYLE_INJECT, DD_TRACE_PROPAGATION_STYLE
A comma-separated list of header formats to include to propagate distributed traces between services. The first format found with complete and valid headers is used to define the trace to continue.

Per-integration tracing configuration: enable/disable, analytics, service name, peer service overrides for library integrations and controls for disabling specific instrumentations.

General Integration Settings

DD_TRACE_LARAVEL_QUEUE_DISTRIBUTED_TRACING

Type: boolean
Default: true
Disables the creation of an additional laravel.queue.process span and relies solely on span links. Added in version 0.93.0.

DD_TRACE_SYMFONY_MESSENGER_DISTRIBUTED_TRACING

Type: boolean
Default: true
When disabled, causal produce/consume relationships will be associated using span links. Added in version 1.3.0.

DD_TRACE_SYMFONY_MESSENGER_MIDDLEWARES

Type: boolean
Default: false
Enables the tracing of Symfony Messenger middlewares. Added in version 1.3.0.

Configuration Kinds

Each integration can support one or more of these configuration patterns. Replace <INTEGRATION> with the integration name (for example, GRPC, AWS, REDIS).

Per-Integration Settings (14 integrations)

Each section lists all configuration keys available for a specific integration.

Database Monitoring (DBM): SQL comment propagation modes and query identifier hashing for correlating database performance with application traces.

DD_DBM_INJECT_SQL_BASEHASH

Type: boolean
Default: false
Enables the injection of a “base hash” in SQL queries when DBM propagation is also enabled. This base hash is used to find matching spans, and enrich the queries with related values.

DD_DBM_PROPAGATION_MODE

Type: string
Default: disabled
Enables linking between data sent from APM and the Database Monitoring product when set to service or full. The service option enables the connection between DBM and APM services. The full option enables connection between database spans with database query events. Available for Postgres and MySQL.

Tracer log output settings: log levels, log file paths, log rotation, and startup diagnostics.

DD_TRACE_DEBUG

Type: boolean
Default: false
Aliases:OTEL_LOG_LEVEL

Enables debug mode for the SDK. When set, the SDK emits verbose log messages for troubleshooting. Takes precedence over DD_TRACE_LOG_LEVEL when active. Use OTEL_LOG_LEVEL as an alias.

Language-specific notes:

• PHP: log messages are written to the device or file set in the PHP error_log INI setting. The actual value may differ from php -i output because it can be overridden in PHP-FPM/Apache configuration files.

DD_TRACE_LOG_FILE

Type: string
Specifies a log file. If none is specified, logs go to the default PHP error location. To debug datadog-ipc-helper issues (for example, submission of telemetry), you must specify the log file.

DD_TRACE_LOG_LEVEL

Type: string
Default: error
A string for the minimum log level for the tracer to use when debug logging is enabled, for example, error, debug.

DD_TRACE_STARTUP_LOGS

Type: boolean
Default: true
Enables emission of startup configuration and diagnostic log lines when the tracer initializes.

Continuous Profiler configuration: enable/disable, upload settings, profiling types, engine options, code hotspots, endpoint profiling, and experimental features.

DD_PROFILING_ALLOCATION_ENABLED

Type: boolean
Default: true
Aliases:DD_PROFILING_DDPROF_ALLOC_ENABLED
If set to true, enables Allocation profiling (in Preview).

DD_PROFILING_ALLOCATION_SAMPLING_DISTANCE

Type: int
Default: 4194304
Average number of allocated bytes between allocation samples. Lower values improve allocation hotspot precision but increase profiler overhead.

DD_PROFILING_ENABLED

Type: boolean
Default: true
Whether to enable profiling.

DD_PROFILING_ENDPOINT_COLLECTION_ENABLED

Type: boolean
Default: true
Aliases:DD_PROFILING_EXPERIMENTAL_ENDPOINT_COLLECTION_ENABLED
Controls whether spans add a pprof label with the top-level request endpoint so profiles can be grouped by endpoint in the Datadog UI.

DD_PROFILING_EXCEPTION_ENABLED

Type: boolean
Default: true
Enables exception-event profiling so exception-heavy code paths appear in profiles. Useful when diagnosing error storms or control-flow via exceptions.

DD_PROFILING_EXCEPTION_MESSAGE_ENABLED

Type: boolean
Default: false
Includes exception message text in collected exception samples. Enable only when message content is needed for debugging and acceptable under your data-sensitivity policy.

DD_PROFILING_EXCEPTION_SAMPLING_DISTANCE

Type: int
Default: 100
Sampling interval for exception profiling events. Lower values capture more exception detail; higher values reduce overhead.

DD_PROFILING_EXPERIMENTAL_CPU_TIME_ENABLED

Type: boolean
Default: true
Aliases:DD_PROFILING_EXPERIMENTAL_CPU_ENABLED
Collects CPU-time sample dimension in addition to wall-time. Use when you need to separate true CPU saturation from waiting/blocking behavior.

DD_PROFILING_EXPERIMENTAL_FEATURES_ENABLED

Type: boolean
Default: false
Umbrella switch that enables experimental profiling capabilities. Intended for evaluation/early adoption; validate overhead and correctness before broad rollout.

DD_PROFILING_EXPERIMENTAL_IO_ENABLED

Type: boolean
Default: false
Instruments low-level file/socket I/O operations so profiles can attribute time to read/write activity (not just CPU). Use when investigating latency dominated by disk/network waits or unknown blocking in external calls.

DD_PROFILING_LOG_LEVEL

Type: string
Default: off
Sets the profiler’s log level. Accepted values: off, error, warn, info, debug, trace. The profiler’s logs are written to the standard error stream of the process.

DD_PROFILING_TIMELINE_ENABLED

Type: boolean
Default: true
Aliases:DD_PROFILING_EXPERIMENTAL_TIMELINE_ENABLED

Enable the timeline profile type

Note: This supersedes the DD_PROFILING_EXPERIMENTAL_TIMELINE_ENABLED environment variable. (datadog.profiling.experimental_timeline_enabled INI setting), If both are set, this one takes precedence.

Language-specific notes:

• PHP: This supersedes the datadog.profiling.experimental_timeline_enabled INI setting, which was available since 0.89

Application Security configuration: ASM threat detection and blocking, user event tracking, IAST vulnerability detection, API Security schema discovery, and error tracking.

DD_API_SECURITY_ENABLED

Type: boolean
Default: true
Aliases:DD_EXPERIMENTAL_API_SECURITY_ENABLED
Controls whether API Security features are enabled. If unset, API Security is enabled by default.

DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE

Type: string
Default: ident
Aliases:DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING
Specifies which collection mode to use for automated user events.

DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED

Type: boolean
Default: true
Enables automatic emission of AppSec user lifecycle signals (login success/failure, signup, authenticated user) into span metadata. Use when you want account-abuse and auth-related detections without manually emitting SDK events.

DD_APPSEC_CLI_START_ON_RINIT

Type: boolean
Default: false

Forces AppSec request lifecycle startup during PHP RINIT for the CLI and FrankenPHP SAPIs.

AppSec tracks the beginning and end of HTTP requests. The PHP “request” initialization of CLI and FrankenPHP does not typically correspond to the start of a request. However, if you’re running FrankenPHP in classic mode (not worker mode), this assumption will not hold, and you need set DD_APPSEC_CLI_START_ON_RINIT to true.

DD_APPSEC_ENABLED

Type: boolean
Default: false
Enables or disables the AppSec product inside the tracer. When enabled, the tracer initializes the AppSec module (in-app WAF, header/body collection, and AppSec telemetry).

DD_APPSEC_EXTRA_HEADERS

Type: array
Adds additional HTTP header names to be collected and analyzed by AppSec beyond the built-in relevant header set. Use when your environment carries security-relevant context in custom headers (gateway IDs, tenant IDs, forwarded auth context, etc.).

DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML

Type: string
Path to a local HTML template file that will be returned when a request is blocked and the response should be HTML. If unset or invalid, the tracer uses the default blocking HTML template defined by the product RFC. The tracer decides HTML or JSON according to Accept header or the block action’s parameters.

DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON

Type: string
Path to a local JSON template file returned when a request is blocked and the response should be JSON. If unset or invalid, the tracer uses the default blocking JSON template defined by the product RFC. The tracer chooses HTML or JSON based on the Accept header or the block action’s parameters.

DD_APPSEC_LOG_FILE

Type: string
Default: php_error_reporting
Selects destination for AppSec extension logs (php_error_reporting, syslog, stdout, stderr, or file path).

DD_APPSEC_LOG_LEVEL

Type: string
Default: warn
Controls AppSec extension log verbosity (off, fatal, error, warning/warn, info, debug, trace).

DD_APPSEC_MAX_BODY_BUFF_SIZE

Type: int
Default: 524288
Limits how many bytes of request/response body are buffered for AppSec inspection. Increase when detections require larger payload visibility; decrease to reduce memory/copy overhead.

DD_APPSEC_MAX_STACK_TRACE_DEPTH

Type: int
Default: 32
Aliases:DD_APPSEC_MAX_STACKTRACE_DEPTH
Maximum number of stack frames retained for any stack trace attached to an AppSec event. When the limit is reached, deeper frames are truncated and the top-of-stack frames are preserved. Lower the value to reduce event payload size.

DD_APPSEC_MAX_STACK_TRACES

Type: int
Default: 2
Aliases:DD_APPSEC_MAX_STACKTRACES
Limits how many separate stacktraces are captured and attached to an AppSec/IAST event to keep payload sizes reasonable. Evidence stacktraces are useful for triage, but unbounded capture can leak sensitive data and consume excessive bandwidth; this limit balances evidence value and safety. Set to 0 to collect all.

DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP

Type: string
Default: (?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt
Regular expression used by the AppSec obfuscator to identify parameter keys whose entire value must be redacted. When a key path matches, the parameter is replaced with <redacted by datadog>. The default matches common credential names (password, token, authorization, jwt, etc.). Set to an empty string to disable key-based redaction.

DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP

Type: string
Default: (?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\.net(?:[_-]|-)sessionid|sid|jwt)(?:\s*=([^;&]+)|"\s*:\s*("[^"]+"|\d+))|bearer\s+([a-z0-9\._\-]+)|token\s*:\s*([a-z0-9]{13})|gh[opsu]_([0-9a-zA-Z]{36})|ey[I-L][\w=-]+\.(ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?)|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}([^\-]+)[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*([a-z0-9\/\.+]{100,})
A regex string to redact sensitive data by its value in attack reports.

DD_APPSEC_RASP_ENABLED

Type: boolean
Default: true
Turns on the tracer’s RASP / Exploit Prevention capabilities. When enabled the tracer runs synchronous, pre-execution checks and may generate block actions or exploit signals. RASP may have separate activation and implementation details per language; enabling it usually activates extra synchronous instrumentation and additional evidence capture for detections

DD_APPSEC_RULES

Type: string
Path to a JSON rules file that overrides the default AppSec rules shipped with the tracer.

DD_APPSEC_SCA_ENABLED

Type: boolean
Default: false
Enables the tracer’s runtime Software Composition Analysis (SCA), which reports runtime dependency/SBOM data and powers runtime vulnerability detection. SCA may have billing implications and language-compatibility constraints described in the SCA documentation.

DD_APPSEC_STACK_TRACE_ENABLED

Type: boolean
Default: true
Aliases:DD_APPSEC_STACK_TRACE_ENABLE
Enables generation of stack traces attached to AppSec security events. Disable to omit stack traces from event payloads.

DD_APPSEC_TRACE_RATE_LIMIT

Type: int
Default: 100
Controls the maximum amount of AppSec traces, per second.

DD_APPSEC_WAF_TIMEOUT

Type: int
Default: 10000
Limits the WAF synchronous execution time (in microseconds).

Remote debugging capabilities: Dynamic Instrumentation for live probes, Exception Replay for automatic variable capture, Symbol Database for source-level debugging, and Code Origin for Spans for linking spans back to source code.

DD_CODE_ORIGIN_FOR_SPANS_ENABLED

Type: boolean
Default: true
Enables code origin for spans behavior in the tracer. When disabled, related data collection and processing are skipped.

DD_CODE_ORIGIN_MAX_USER_FRAMES

Type: int
Default: 8
Code Origin for spans (Dynamic Instrumentation): sets the maximum number of user stack frames to capture/consider when recording code origin (default: 8). Note: the current code-origin recorder reads this value but does not use it, so it may have no effect in this version.

DD_DYNAMIC_INSTRUMENTATION_ENABLED

Type: boolean
Default: false
Enables Dynamic Instrumentation, allowing log probes and metric probes to be added to running services from the Datadog UI without redeploying.

DD_DYNAMIC_INSTRUMENTATION_REDACTED_IDENTIFIERS

Type: array
Comma-separated list of additional identifier keywords to redact in captured snapshot data

DD_DYNAMIC_INSTRUMENTATION_REDACTED_TYPES

Type: array
Comma-separated list of object types to redact from dynamic logs and snapshots. Supports * wildcards (e.g. Secret* matches SecretKey).

DD_DYNAMIC_INSTRUMENTATION_REDACTION_EXCLUDED_IDENTIFIERS

Type: array
Since: v1.19.0
Environment variable to exclude identifiers from redaction

DD_EXCEPTION_REPLAY_CAPTURE_INTERVAL_SECONDS

Type: int
Default: 3600
Exception Replay: minimum interval in seconds between capturing the same exception fingerprint again. Used to rate-limit repeated captures of identical exceptions. Default: 3600 seconds.

DD_EXCEPTION_REPLAY_ENABLED

Type: boolean
Default: false
Exception Replay (Live Debugging): enables the Exception Replay product. When enabled (for example via Remote Config), the tracer starts/stops the Exception Replay subsystem. This key is also accepted as a backward-compatible alias for DD_EXCEPTION_DEBUGGING_ENABLED.

CI Visibility and Test Optimization: test reporting, code coverage collection, git metadata, flaky test management, test skipping, and CI provider integration.

DD_TRACE_GIT_METADATA_ENABLED

Type: boolean
Default: true
When enabled, the tracer attaches Git repository URL and commit SHA tags to root spans, allowing traces to be linked back to the corresponding source code in the Datadog UI.

Crash tracking for capturing and reporting application crashes, and heap snapshot configuration.

DD_CRASHTRACKING_ENABLED

Type: boolean
Default: true
Enables Crash Tracking. When enabled, the tracer initializes crash tracking and configures JVM crash/OOM hooks (for example, -XX:OnError and -XX:OnOutOfMemoryError) to run Datadog-provided scripts that upload hs_err_pid*.log crash logs and OOME notifications. Default: true.

Direct log submission to Datadog, agentless log forwarding, log injection for trace-log correlation, and OpenTelemetry log export.

DD_LOGS_OTEL_ENABLED

Type: boolean
Default: false
Since: v1.20.0
Enables collection and export of logs produced via the OpenTelemetry Logs API.

Runtime metrics collection and DogStatsD connection configuration for metric submission.

DD_DOGSTATSD_HOST

Type: string
Default: localhost
Aliases:DD_DOGSTATSD_HOSTNAME
Override the address of the trace Agent host that the default tracer attempts to submit DogStatsD metrics to. Use DD_AGENT_HOST to override DD_DOGSTATSD_HOST.

DD_DOGSTATSD_PORT

Type: int
Default: 8125
The port of the DogStatsD Agent that metrics are submitted to. If the Agent configuration sets dogstatsd_port or DD_DOGSTATSD_PORT to something other than the default 8125, then this tracing library DD_DOGSTATSD_PORT must match it.

DD_DOGSTATSD_URL

Type: string
Default: http://localhost:8125
The URL used to connect to the DogStatsD endpoint. Takes precedence over DD_AGENT_HOST and DD_DOGSTATSD_PORT. Supports udp:// or unix:// schemes only.

Tracer self-reporting telemetry: heartbeat intervals, dependency and log collection, and telemetry forwarder configuration.

DD_INSTRUMENTATION_TELEMETRY_ENABLED

Type: boolean
Default: true
Allows Datadog to collect environmental and diagnostic information about your application and runtime to improve the product. Set to false to opt out of instrumentation telemetry.

DD_TELEMETRY_LOG_COLLECTION_ENABLED

Type: boolean
Default: true
Controls whether internal tracer logs are forwarded as part of instrumentation telemetry.

Remote Configuration for receiving live configuration updates from Datadog.

DD_REMOTE_CONFIG_ENABLED

Type: boolean
Default: true
Enables Remote Config polling in the tracer (fetches configuration updates from the remote config endpoint and applies them to subscribed products). Default: true.

Standard OpenTelemetry environment variables supported by Datadog SDKs: resource attributes, propagators, trace sampler, OTLP exporter configuration, and batch span processor settings.

DD_METRICS_OTEL_ENABLED

Type: boolean
Default: false
Enables OpenTelemetry metrics export. Metrics are disabled by default and are only enabled when this is set to a truthy value.

DD_TRACE_OTEL_ENABLED

Type: boolean
Default: false
Enables the Datadog SDK’s OpenTelemetry interoperability for traces.

OTEL_EXPORTER_OTLP_ENDPOINT

Type: string
Since: v1.21.0
Sets the OTLP exporter endpoint used by OpenTelemetry metrics export. When set, it overrides the default endpoint derived from agent configuration.

OTEL_EXPORTER_OTLP_METRICS_ENDPOINT

Type: string
Since: v1.21.0
URL for sending OTLP metrics. Takes precedence over OTEL_EXPORTER_OTLP_ENDPOINT. Defaults to http://localhost:4317 for gRPC and http://localhost:4318/v1/metrics for HTTP. For HTTP protocols, the SDK automatically appends /v1/metrics when the general OTEL_EXPORTER_OTLP_ENDPOINT is used as a fallback.

OTEL_PROPAGATORS

Type: string
Specifies trace context propagation formats for both extraction and injection (comma-separated list). Lowest precedence; ignored if any other Datadog trace context propagation environment variable is set.

OTEL_RESOURCE_ATTRIBUTES

Type: string
Sets OpenTelemetry resource attributes that are mapped to tracer tags when the corresponding tracer tag setting is not set. Reserved attributes for service, environment, and version are mapped to standard tags, and only the first 10 attributes are applied.

Instrumentation setup and platform-specific configuration: auto-injection, third-party library detection, and platform adapters.

DD_INJECT_FORCE

Type: boolean
Default: false
Single Step Instrumentation (SSI): forces the tracer javaagent to load even when multiple JVM agents are detected. This bypasses SSI guardrails that would otherwise abort startup to avoid running multiple agents. Can be set via DD_INJECT_FORCE or system property dd.inject.force. Default: false.

Configuration keys that don't fit into the other categories yet. Treat this list as a backlog: each key here should eventually find a real home.

DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED

Type: boolean
Default: false
Since: v1.21.0
Enables the experimental feature-flag provider that evaluates flags from remote configuration. If not enabled, the provider is a no-op and returns default values.