Blocklist for mongodb

[lancedikson]

Hi, I get quite many requests from mongodb that I don't really want to be analyzed as they happen very often and can easily make it up to 1M of spans/month. I tried to find a way to block (filter out) particularly this kind of command but didn't find anything.

Is there a way to have something similar to http.blacklist configuration option, but for commands to mongodb?

[EricZaporzan]

We had success setting this environment variable:

DD_APM_IGNORE_RESOURCES="ismaster admin\.\$cmd"

That's on the Docker agent, but I suspect it'd work with other iterations as well.

[lancedikson]

Wow, thanks @EricZaporzan! It seems working for me, even though we're using DD on Heroku (without Docker) and there are no official docs about this env variable for Heroku agent.

If somebody from the DD team reads this, it would be nice to have this env variable mentioned here: https://docs.datadoghq.com/agent/basic_agent_usage/heroku/. Thanks.

[EricZaporzan]

Yes, documentation in this area could be a lot clearer. It seems like any of the variables enumerated in this file should be fair game for any of the iterations of the agent. https://github.com/DataDog/datadog-agent/blob/master/pkg/trace/config/env.go

Glad it worked!

[rochdev]

Glad you were able to get it to work! I'll leave the issue open since there would also be value to have this configuration directly in the tracer as well.

For the documentation, in general all environment variables are the same regardless of the how it's deployed. We should probably move the list to a single place instead of duplicating subsets.

[lancedikson]

Thanks, @rochdev 🙏 It would definitely help developers to find a way to filter out something redundant like those ismaster admin.cmd queries in my case.

[MartinLoeper]

These answers are money guys! Thanks so much! I think that many people like us using the MEAN stack are annoyed of these irrelevant spans showing up in APM.

[AndrejGajdos]

I tried this, but doesn't for me :/

[tedder]

in my case, it wasn't working because I was putting DD_APM_IGNORE_RESOURCES on the application container. It needed to be on the collecting datadog agent container. I use helm (yaml), so the escaping is important:

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: datadog
  namespace: monitoring
spec:
  chart:
    spec:
      chart: datadog
      version: "3.33.1"
      sourceRef:
        kind: HelmRepository
        name: datadog
        namespace: monitoring
..
  values:
    agents:
      containers:
        traceAgent:
          env:
          - name: DD_APM_IGNORE_RESOURCES
            value: ismaster admin..cmd       # works, imprecise match
            value: ismaster admin.$cmd       # does NOT work
            value: "ismaster admin\.\$cmd"   # invalid YAML
            value: "ismaster admin\\.\\$cmd" # works
            value: 'ismaster admin\.\$cmd'   # works
..

Obviously, only use one of the value lines.

[hoangnd25]

Does anyone have this working with lambda + datadog extension?

I tried to set DD_APM_IGNORE_RESOURCES & DD_APM_FILTER_TAGS_REJECT via lambda environment but neither work.

I turned on debug, the extension seems to acknowledge the env var

2023-07-26 03:15:50 UTC | DD_EXTENSION | DEBUG | Datadog extension version : 41|Datadog environment variables: DD_API_KEY_SECRET_ARN=***|DD_APM_IGNORE_RESOURCES="admin\.\$cmd$"|DD_CAPTURE_LAMBDA_PAYLOAD=false|DD_ENV=pr-77|DD_FLUSH_TO_LOG=false|DD_LAMBDA_HANDLER=src/lambdas/api.handler|DD_LOGS_CONFIG_PROCESSING_RULES=[{"type":"exclude_at_match","name":"exclude_start_and_end_logs","pattern":"(START|END) RequestId"}]|DD_LOGS_INJECTION=true|DD_LOG_LEVEL=debug|DD_MERGE_XRAY_TRACES=false|DD_SERVERLESS_LOGS_ENABLED=true|DD_SERVICE=locations|DD_SITE=datadoghq.com|DD_TAGS=git.commit.sha:"***********************************aa5ea"|DD_TRACE_DISABLED_PLUGINS=net,dns,fs|DD_TRACE_ENABLED=true|DD_VERSION=1.0.0|