Operations | Monitoring | ITSM | DevOps | Cloud

Datadog runs thousands of internal services and has been increasing global footprint year after year. For most of that growth, we treated services uniformly when making deployment and reliability decisions. At our current scale, that approach became expensive. A change destined for production rolls out to data centers sequentially, so deployment time grows with every data center we add.

SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol, and Trivial File Transfer Protocol (TFTP) have similar acronyms but have two different jobs. Choose SFTP for sensitive files, routed or untrusted networks, authenticated automation, partner exchange and remote file management. Reserve TFTP for constrained bootstrapping or device-transfer workflows on a tightly controlled network when the endpoint requires a minimal design.

For years, engineering teams have faced the same challenge during incidents: the systems generating alerts are becoming more complex, but the investigation that follows is still largely manual. Monitors are good at telling us that something is wrong. The harder question is why. When an alert fires, an engineer still has to work out where to look, which signals matter, what hypothesis to test, and how the evidence across logs and metrics fits together.

AI agents are quickly becoming the first responders on the most sophisticated SecOps and DevOps teams, pulling threads on a threat or making sense of a flood of telemetry before a human even logs in. But most AI pricing hasn’t caught up. Token-based models leave you burning through usage with no visibility into what’s driving the cost, while per-seat caps ration access like AI is still a nice-to-have instead of core to how your team operates.

Long time no post! Here are some updates of what’s been going on.

Why do tickets about a slow application keep arriving while every server, link and service check reports normal? That mismatch is the problem end user experience monitoring exists to solve. A healthy server is one thing, but the business notices something else: whether people can finish their work or complete a purchase without delays or errors. Monitoring in most IT operations groups was built to watch the systems from the inside, so it reports CPU load, memory and uptime.

Why do users at a branch complain about choppy calls and stalled apps when every WAN circuit on the dashboard still shows up? A link can be reachable without being healthy. Delay and packet loss can rise for hours on a live circuit, and a simple up-or-down check will report nothing unusual the whole time. WAN link monitoring checks the quality of each site-to-site connection by having routers send their own test packets and time the replies.

✓ operational truth Operational risk is no longer limited by the ability to find vulnerabilities. It is limited by the ability to prioritize them by business exposure and to act on the large share that cannot be patched at all. Autonomous IT changes this by mapping findings to applications and owners, automating the work around the patch, and proposing evidenced mitigations where no patch exists.

Why does a page that scores well in testing still draw complaints from customers about slowness? A lab test runs on one fast machine over a stable connection. Customers use older phones, congested mobile networks and browsers loaded with extensions, so their experience can only be measured on their own devices. Real user monitoring captures that experience, and it produces a long list of measurements.

How many pages did your on-call engineer get during the last planned firmware upgrade on a core switch? The device stops responding and every dependent check fails. Soon the on-call phone is buzzing with alerts for a change that was approved last week. Alert suppression is a time-limited pause on alerts for a condition you already know about, such as planned work or an issue under investigation. And what is alert suppression from the engineer's side of the console?