datadog 2.41.0 → 2.42.0

data/ext/libdatadog_api/otel_thread_context.c

@@ -0,0 +1,232 @@
+#include <ruby.h>
+#include <ruby/thread.h>
+
+#include "datadog_ruby_common.h"
+#include "otel_thread_context.h"
+
+#ifdef __linux__
+  #include <datadog/otel-thread-ctx.h>
+  extern __thread const uint8_t *otel_thread_ctx_v1;
+
+  static void otel_ctx_handle_free(void *handle) {
+    ddog_otel_thread_ctx_free((ddog_ThreadContextHandle *) handle);
+  }
+
+  static const rb_data_type_t otel_ctx_handle_t = {
+    .wrap_struct_name = "Datadog::Tracing::OTelThreadContext handle",
+    .function = {.dfree = otel_ctx_handle_free},
+    .flags = RUBY_TYPED_FREE_IMMEDIATELY,
+  };
+#endif
+
+static ID fiber_context_slot;
+
+DDTRACE_UNUSED static bool otel_context_enabled = false;
+
+static VALUE native_set(VALUE _self, VALUE trace_id, VALUE span_id, VALUE local_root_span_id);
+static VALUE native_supported_p(VALUE _self);
+static VALUE native_enable(VALUE _self);
+static VALUE native_read(VALUE _self);
+
+void otel_thread_context_init(VALUE tracing_module) {
+  fiber_context_slot = rb_intern("__dd_otel_fiber_context");
+
+  VALUE otel_thread_context_module = rb_define_module_under(tracing_module, "OTelThreadContext");
+
+  rb_define_singleton_method(otel_thread_context_module, "_native_enable", native_enable, 0);
+  rb_define_singleton_method(otel_thread_context_module, "_native_set", native_set, 3);
+  rb_define_singleton_method(otel_thread_context_module, "_native_supported?", native_supported_p, 0);
+
+  VALUE testing_module = rb_define_module_under(otel_thread_context_module, "Testing");
+  rb_define_singleton_method(testing_module, "_native_read", native_read, 0);
+}
+
+#ifdef __linux__
+  static ddog_ThreadContextHandle *get_fiber_handle_for(VALUE thread) {
+    VALUE obj = rb_thread_local_aref(thread, fiber_context_slot);
+
+    if (!rb_typeddata_is_kind_of(obj, &otel_ctx_handle_t)) return NULL;
+
+    return RTYPEDDATA_DATA(obj);
+  }
+
+  static ddog_ThreadContextHandle *get_current_fiber_handle(void) {
+    return get_fiber_handle_for(rb_thread_current());
+  }
+
+  static void store_current_fiber_handle(ddog_ThreadContextHandle *handle) {
+    VALUE obj = TypedData_Wrap_Struct(rb_cObject, &otel_ctx_handle_t, handle);
+    rb_thread_local_aset(rb_thread_current(), fiber_context_slot, obj);
+  }
+
+  #ifdef RUBY_INTERNAL_THREAD_EVENT_EXITED
+    static void on_thread_exited(
+      DDTRACE_UNUSED rb_event_flag_t event,
+      DDTRACE_UNUSED const rb_internal_thread_event_data_t *event_data,
+      DDTRACE_UNUSED void *user_data
+    ) {
+      ddog_otel_thread_ctx_detach();
+    }
+  #else
+    static void on_thread_end(
+      DDTRACE_UNUSED rb_event_flag_t evflag,
+      DDTRACE_UNUSED VALUE data,
+      DDTRACE_UNUSED VALUE self,
+      DDTRACE_UNUSED ID mid,
+      DDTRACE_UNUSED VALUE klass
+    ) {
+      ddog_otel_thread_ctx_detach();
+    }
+  #endif
+
+  #ifdef HAVE_RUBY_THREAD_STORAGE_API
+    // This function is declared in internal/thread.h.
+    // It returns 0 when the current thread sits in a blocking region.
+    int ruby_thread_has_gvl_p(void);
+
+    static bool in_blocking_region(void) {
+      #ifdef HAVE_RUBY_THREAD_HAS_GVL_P
+        return ruby_thread_has_gvl_p() == 0;
+      #else
+        return false;
+      #endif
+    }
+
+    // Under M:N a Ruby thread can migrate between native threads,
+    // so we need to detach the context when the Ruby thread gets suspended.
+    static void on_thread_suspended(
+      DDTRACE_UNUSED rb_event_flag_t event,
+      DDTRACE_UNUSED const rb_internal_thread_event_data_t *event_data,
+      DDTRACE_UNUSED void *user_data
+    ) {
+      // Ruby pins threads that release GVL to call into a native extension,
+      // so we know the thread will not migrate.
+      if (in_blocking_region()) return;
+
+      ddog_otel_thread_ctx_detach();
+    }
+
+    static void on_thread_resumed(
+      DDTRACE_UNUSED rb_event_flag_t event,
+      const rb_internal_thread_event_data_t *event_data,
+      DDTRACE_UNUSED void *user_data
+    ) {
+      ddog_ThreadContextHandle *handle = get_fiber_handle_for(event_data->thread);
+
+      if (handle != NULL) ddog_otel_thread_ctx_attach(handle);
+    }
+  #endif
+
+  static void on_fiber_switch(
+    DDTRACE_UNUSED rb_event_flag_t evflag,
+    DDTRACE_UNUSED VALUE data,
+    DDTRACE_UNUSED VALUE self,
+    DDTRACE_UNUSED ID mid,
+    DDTRACE_UNUSED VALUE klass
+  ) {
+    ddog_ThreadContextHandle *handle = get_current_fiber_handle();
+
+    if (handle != NULL) {
+      ddog_otel_thread_ctx_attach(handle);
+    } else {
+      ddog_otel_thread_ctx_detach();
+    }
+  }
+#endif
+
+static VALUE native_enable(DDTRACE_UNUSED VALUE _self) {
+  #ifdef __linux__
+    if (otel_context_enabled) return Qtrue;
+    otel_context_enabled = true;
+
+    #ifdef RUBY_INTERNAL_THREAD_EVENT_EXITED
+      rb_internal_thread_add_event_hook(on_thread_exited, RUBY_INTERNAL_THREAD_EVENT_EXITED, NULL);
+    #else
+      rb_add_event_hook(on_thread_end, RUBY_EVENT_THREAD_END, Qnil);
+    #endif
+
+    // These hooks only matter under the M:N thread scheduler (Ruby 3.3+),
+    // where a Ruby thread can migrate between native threads.
+    #ifdef HAVE_RUBY_THREAD_STORAGE_API
+      rb_internal_thread_add_event_hook(on_thread_suspended, RUBY_INTERNAL_THREAD_EVENT_SUSPENDED, NULL);
+      rb_internal_thread_add_event_hook(on_thread_resumed, RUBY_INTERNAL_THREAD_EVENT_RESUMED, NULL);
+    #endif
+
+    rb_add_event_hook(on_fiber_switch, RUBY_EVENT_FIBER_SWITCH, Qnil);
+
+    return Qtrue;
+  #else
+    return Qfalse;
+  #endif
+}
+
+static VALUE native_supported_p(DDTRACE_UNUSED VALUE _self) {
+  #ifdef __linux__
+    return Qtrue;
+  #else
+    return Qfalse;
+  #endif
+}
+
+static VALUE native_set(
+    DDTRACE_UNUSED VALUE _self,
+    DDTRACE_UNUSED VALUE trace_id,
+    DDTRACE_UNUSED VALUE span_id,
+    DDTRACE_UNUSED VALUE local_root_span_id
+  ) {
+  #ifdef __linux__
+    if (!otel_context_enabled) return Qfalse;
+
+    uint8_t trace_id_bytes[16];
+    uint8_t span_id_bytes[8];
+    uint8_t local_root_span_id_bytes[8];
+
+    const int BIG_ENDIAN_PACK_FLAGS = INTEGER_PACK_MSWORD_FIRST | INTEGER_PACK_BIG_ENDIAN;
+    rb_integer_pack(trace_id, trace_id_bytes, sizeof(trace_id_bytes), 1, 0, BIG_ENDIAN_PACK_FLAGS);
+    rb_integer_pack(span_id, span_id_bytes, sizeof(span_id_bytes), 1, 0, BIG_ENDIAN_PACK_FLAGS);
+    rb_integer_pack(local_root_span_id, local_root_span_id_bytes, sizeof(local_root_span_id_bytes), 1, 0, BIG_ENDIAN_PACK_FLAGS);
+
+    ddog_ThreadContextHandle *handle = get_current_fiber_handle();
+
+    if (handle == NULL) {
+      handle = ddog_otel_thread_ctx_new(&trace_id_bytes, &span_id_bytes, 0, &local_root_span_id_bytes);
+      store_current_fiber_handle(handle);
+      ddog_otel_thread_ctx_attach(handle);
+    } else {
+      // FIXME: add a method to libdatadog to update the context record before attaching it
+      ddog_otel_thread_ctx_attach(handle);
+      ddog_otel_thread_ctx_update(&trace_id_bytes, &span_id_bytes, 0, &local_root_span_id_bytes);
+    }
+
+    return Qtrue;
+  #else
+    return Qfalse;
+  #endif
+}
+
+static VALUE native_read(DDTRACE_UNUSED VALUE _self) {
+  #ifdef __linux__
+    const uint8_t *raw = otel_thread_ctx_v1;
+    if (!raw) return Qnil;
+
+    uint16_t attrs_data_size = (uint16_t) raw[26] | ((uint16_t) raw[27] << 8);
+
+    if (attrs_data_size > ddog_MAX_ATTRS_DATA_SIZE) {
+      raise_error(
+        rb_eRuntimeError,
+        "Invalid OTel thread context record: attrs_data_size (%d) exceeds maximum (%d)",
+        attrs_data_size, ddog_MAX_ATTRS_DATA_SIZE
+      );
+    }
+
+    VALUE result = rb_hash_new();
+    rb_hash_aset(result, ID2SYM(rb_intern("trace_id")), rb_str_new((const char *) raw, 16));
+    rb_hash_aset(result, ID2SYM(rb_intern("span_id")), rb_str_new((const char *) (raw + 16), 8));
+    rb_hash_aset(result, ID2SYM(rb_intern("valid")), rb_str_new((const char *) (raw + 24), 1));
+    rb_hash_aset(result, ID2SYM(rb_intern("attrs")), rb_str_new((const char *) (raw + 28), attrs_data_size));
+
+    return result;
+  #else
+    return Qnil;
+  #endif
+}

data/ext/libdatadog_api/otel_thread_context.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#include <ruby.h>
+
+void otel_thread_context_init(VALUE tracing_module);

data/ext/libdatadog_extconf_helpers.rb

@@ -10,7 +10,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = "~> 40.0.0.1.0"
+    LIBDATADOG_VERSION = "~> 40.0.0.2.0"
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.

data/lib/datadog/appsec/assets/blocked.html

@@ -1,108 +1 @@
-<!-- Sorry, you've been blocked -->
-<!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width,initial-scale=1">
-    <title>You've been blocked</title>
-    <style>
-        a,
-        body,
-        div,
-        html,
-        span {
-            margin: 0;
-            padding: 0;
-            border: 0;
-            font-size: 100%;
-            font: inherit;
-            vertical-align: baseline
-        }
-
-        body {
-            background: -webkit-radial-gradient(26% 19%, circle, #fff, #f4f7f9);
-            background: radial-gradient(circle at 26% 19%, #fff, #f4f7f9);
-            display: -webkit-box;
-            display: -ms-flexbox;
-            display: flex;
-            -webkit-box-pack: center;
-            -ms-flex-pack: center;
-            justify-content: center;
-            -webkit-box-align: center;
-            -ms-flex-align: center;
-            align-items: center;
-            -ms-flex-line-pack: center;
-            align-content: center;
-            width: 100%;
-            min-height: 100vh;
-            line-height: 1;
-            flex-direction: column
-        }
-
-        p {
-            display: block
-        }
-
-
-        main {
-            text-align: center;
-            flex: 1;
-            display: -webkit-box;
-            display: -ms-flexbox;
-            display: flex;
-            -webkit-box-pack: center;
-            -ms-flex-pack: center;
-            justify-content: center;
-            -webkit-box-align: center;
-            -ms-flex-align: center;
-            align-items: center;
-            -ms-flex-line-pack: center;
-            align-content: center;
-            flex-direction: column
-        }
-
-        p {
-            font-size: 18px;
-            line-height: normal;
-            color: #646464;
-            font-family: sans-serif;
-            font-weight: 400
-        }
-
-        a {
-            color: #4842b7
-        }
-
-        footer {
-            width: 100%;
-            text-align: center
-        }
-
-        footer p {
-            font-size: 16px
-        }
-
-        .security-response-id {
-            font-size:14px;
-            color:#999;
-            margin-top:20px;
-            font-family:monospace
-        }
-    </style>
-</head>
-
-<body>
-    <main>
-        <p>Sorry, you cannot access this page. Please contact the customer service team.</p>
-        <p class="security-response-id">Security Response ID: [security_response_id]</p>
-    </main>
-    <footer>
-        <p>Security provided by <a
-                href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/"
-                target="_blank"
-                rel="noopener noreferrer">Datadog</a></p>
-    </footer>
-</body>
-
-</html>
+<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>You've been blocked</title><style>a,body,div,html,span{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1;flex-direction:column}p{display:block}main{text-align:center;flex:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;flex-direction:column}p{font-size:18px;line-height:normal;color:#646464;font-family:sans-serif;font-weight:400}a{color:#4842b7}footer{width:100%;text-align:center}footer p{font-size:16px}.security-response-id{font-size:14px;color:#999;margin-top:20px;font-family:monospace}</style></head><body><main><p>Sorry, you cannot access this page. Please contact the customer service team.</p><p class="security-response-id">Security Response ID: [security_response_id]</p></main><footer><p>Security provided by <a href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/" target="_blank" rel="noopener noreferrer">Datadog</a></p></footer></body></html>

data/lib/datadog/core/configuration/components.rb

@@ -248,6 +248,7 @@ module Datadog
           crashtracker&.update_on_fork
           ProcessDiscovery.after_fork
           symbol_database&.after_fork!
+          data_streams&.restart_flush_thread
         end
 
         # Hot-swaps with a new sampler.

data/lib/datadog/core/crashtracking/component.rb

@@ -44,7 +44,11 @@ module Datadog
         # Reports unhandled exceptions to the crash tracker if available and appropriate.
         # This is called from the at_exit hook to report unhandled exceptions.
         def self.report_unhandled_exception(exception)
-          return unless exception && !exception.is_a?(SystemExit) && !exception.is_a?(NoMemoryError)
+          return unless exception &&
+            !exception.is_a?(SystemExit) &&
+            !exception.is_a?(SignalException) &&
+            !exception.is_a?(NoMemoryError) &&
+            !exception.is_a?(SystemStackError)
 
           begin
             crashtracker = Datadog.send(:components, allow_initialization: false)&.crashtracker

data/lib/datadog/data_streams/pathway_context.rb

@@ -98,40 +98,38 @@ module Datadog
       end
       private_class_method :decode
 
-      # Encode an unsigned 64-bit integer using LEB128 variable-length encoding.
+      # Encode a signed 64-bit integer using ZigZag + LEB128 variable-length encoding.
       #
-      # This implements unsigned LEB128 (Little Endian Base 128) encoding as specified
-      # in DWARF5 standard section 7.6:
-      # https://dwarfstd.org/doc/DWARF5.pdf#page=301
+      # dd-trace-go's DSM pathway encoder (internal/datastreams/propagator.go, via
+      # sketches-go's ddsketch/encoding package) ZigZag-maps the signed value before
+      # applying plain unsigned LEB128 (DWARF5 section 7.6:
+      # https://dwarfstd.org/doc/DWARF5.pdf#page=301). This implementation previously
+      # skipped the ZigZag step, which silently decoded to the wrong timestamp on any
+      # dd-trace-go consumer -- see https://github.com/DataDog/dd-trace-go/issues/5163.
       #
-      # Each byte uses 7 bits for data and 1 bit to indicate continuation.
-      # The high bit is set if more bytes follow, clear for the final byte.
+      # ZigZag maps signed values to unsigned ones so small-magnitude negative numbers
+      # still encode to few bytes: 0, -1, 1, -2, 2, ... -> 0, 1, 2, 3, 4, ...
       #
-      # @param value [Integer] Unsigned integer value to encode
+      # @param value [Integer] Signed integer value to encode
       # @return [String] Binary string of encoded bytes
       def encode_var_int_64(value)
+        zigzag = (value << 1) ^ (value >> 63)
         bytes = []
-        while value >= 0x80
-          bytes << ((value & 0x7F) | 0x80)
-          value >>= 7
+        while zigzag >= 0x80
+          bytes << ((zigzag & 0x7F) | 0x80)
+          zigzag >>= 7
         end
-        bytes << value
+        bytes << zigzag
         bytes.pack("C*")
       end
 
-      # Decode an unsigned LEB128 variable-length integer from IO stream.
+      # Decode a signed 64-bit integer encoded with ZigZag + LEB128 from an IO stream.
       #
-      # This implements unsigned LEB128 (Little Endian Base 128) decoding as specified
-      # in DWARF5 standard section 7.6:
-      # https://dwarfstd.org/doc/DWARF5.pdf#page=301
-      #
-      # VarInt format: Each byte uses 7 bits for data, 1 bit for continuation
-      # - High bit set = more bytes follow
-      # - High bit clear = final byte
-      # - Data bits accumulated in little-endian order
+      # See #encode_var_int_64 for why the ZigZag un-map is required to match
+      # dd-trace-go's wire format.
       #
       # @param io [StringIO] IO stream to read from
-      # @return [Integer, nil] Decoded unsigned integer, or nil if malformed
+      # @return [Integer, nil] Decoded signed integer, or nil if malformed
       def self.decode_varint(io)
         value = 0
         shift = 0
@@ -143,7 +141,7 @@ module Datadog
           value |= (byte & 0x7F) << shift
 
           # If high bit is clear, we're done
-          return value unless (byte & 0x80).nonzero?
+          return (value >> 1) ^ -(value & 1) unless (byte & 0x80).nonzero?
 
           shift += 7
 

data/lib/datadog/data_streams/processor.rb

@@ -62,10 +62,27 @@ module Datadog
 
         super()
         self.loop_base_interval = interval
+        # Without this, a preload-then-fork deployment model (e.g. Puma cluster mode with
+        # preload_app!, or Sidekiq Enterprise's sidekiqswarm with SIDEKIQ_PRELOAD_APP) leaves
+        # every forked child with a dead flush thread: Ruby threads don't survive fork, and the
+        # default FORK_POLICY_STOP means #perform would otherwise just mark the worker stopped
+        # instead of restarting it. See #restart_flush_thread.
+        self.fork_policy = Core::Workers::Async::Thread::FORK_POLICY_RESTART
 
         perform
       end
 
+      # Restarts the flush thread if a fork has been detected since this processor was created.
+      # Called by Components#after_fork. Safe to call even when no fork occurred: #perform (via
+      # Workers::Async::Thread) only restarts the worker when +forked?+ is true. Deliberately not
+      # named +after_fork+: Workers::Async::Thread already defines a protected +after_fork+
+      # template method that #perform's internal restart path (+restart_after_fork+) calls on
+      # every restart -- overriding it here would recurse.
+      def restart_flush_thread
+        discard_inherited_state_after_fork! if forked?
+        perform
+      end
+
       # Track Kafka produce offset for lag monitoring
       # @param topic [String] The Kafka topic name
       # @param partition [Integer] The partition number
@@ -302,6 +319,20 @@ module Datadog
         PathwayContext.decode_b64(encoded_ctx)
       end
 
+      # A fork copies whatever was buffered in the parent (unflushed events, aggregated
+      # buckets, consumer stats) into the child. If the parent process is still alive and
+      # flushing (e.g. a supervisor process that stays up after forking workers), letting
+      # the child flush that same inherited data as well would double-report it to the
+      # agent. Discard it instead: losing a few seconds of pre-fork stats is preferable to
+      # corrupting pipeline throughput/lag numbers with duplicates.
+      def discard_inherited_state_after_fork!
+        @event_buffer.pop
+        @stats_mutex.synchronize do
+          @buckets.clear
+          @consumer_stats.clear
+        end
+      end
+
       def flush_stats
         stats_buckets = @stats_mutex.synchronize do
           return if @buckets.empty? && @consumer_stats.empty?

data/lib/datadog/di/instrumenter.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "../core/rate_limiter"
 require_relative "../core/utils/time"
 require_relative "../ruby_version"
 require_relative "fatal_exceptions"
@@ -69,12 +70,22 @@ module Datadog
     #
     # @api private
     class Instrumenter
+      # Maximum number of capturing-probe snapshots admitted per second across the
+      # whole process.
+      GLOBAL_SNAPSHOT_RATE_LIMIT = 20
+
+      # Maximum number of non-capturing probe emissions admitted per second across
+      # the whole process.
+      GLOBAL_LOG_RATE_LIMIT = 5000
+
       def initialize(settings, serializer, logger, code_tracker: nil, telemetry: nil)
         @settings = settings
         @serializer = serializer
         @logger = logger
         @telemetry = telemetry
         @code_tracker = code_tracker
+        @global_snapshot_rate_limiter = Datadog::Core::TokenBucket.new(GLOBAL_SNAPSHOT_RATE_LIMIT)
+        @global_log_rate_limiter = Datadog::Core::TokenBucket.new(GLOBAL_LOG_RATE_LIMIT)
 
         @lock = Mutex.new
       end
@@ -91,12 +102,31 @@ module Datadog
       # Component#start! assigns the now-current tracker here.
       attr_writer :code_tracker
 
+      # Process-wide snapshot rate limiter.
+      # @return [Datadog::Core::TokenBucket]
+      attr_reader :global_snapshot_rate_limiter
+      # Process-wide log rate limiter.
+      # @return [Datadog::Core::TokenBucket]
+      attr_reader :global_log_rate_limiter
+
       def capture_expression_evaluator
         @capture_expression_evaluator ||= CaptureExpressionEvaluator.new(
           settings: settings, serializer: serializer, logger: logger, telemetry: telemetry,
         )
       end
 
+      # Returns the process-wide rate limiter for the probe.
+      #
+      # @param probe [Probe] the probe whose invocation is being rate limited
+      # @return [Datadog::Core::TokenBucket] the shared limiter for the probe's category
+      def probe_global_rate_limiter(probe)
+        if probe.capturing?
+          global_snapshot_rate_limiter
+        else
+          global_log_rate_limiter
+        end
+      end
+
       # This is a substitute for Thread::Backtrace::Location
       # which does not have a public constructor.
       # Used for the fabricated stack frame for the method itself
@@ -529,7 +559,12 @@ module Datadog
           end
 
           rate_limiter = probe.rate_limiter
-          if continue and rate_limiter.nil? || rate_limiter.allow?
+          admitted = continue && (rate_limiter.nil? || rate_limiter.allow?)
+          if admitted && !probe_global_rate_limiter(probe).allow?
+            admitted = false
+            logger.trace { "di: #{probe.type} probe #{probe.id}: skipping due to global rate limit" }
+          end
+          if admitted
             # Arguments may be mutated by the method, therefore
             # they need to be serialized prior to method invocation.
             serialized_entry_args = if probe.capture_snapshot?
@@ -794,6 +829,11 @@ module Datadog
         # and check that it is in fact set.
         return if probe.rate_limiter && !probe.rate_limiter.allow?
 
+        unless probe_global_rate_limiter(probe).allow?
+          logger.trace { "di: #{probe.type} probe #{probe.id}: skipping due to global rate limit" }
+          return
+        end
+
         # The context creation is relatively expensive and we don't
         # want to run it if the callback won't be executed due to the
         # rate limit.

data/lib/datadog/di/logger.rb

@@ -20,9 +20,9 @@ module Datadog
 
       def_delegators :target, :debug
 
-      def trace(&block)
+      def trace
         if settings.dynamic_instrumentation.internal.trace_logging
-          debug(&block)
+          debug { yield }
         end
       end
     end

data/lib/datadog/di/probe.rb

@@ -97,7 +97,7 @@ module Datadog
         @evaluate_at = evaluate_at
         @condition = condition
 
-        @rate_limit = rate_limit || ((@capture_snapshot || !@capture_expressions.empty?) ? 1 : 5000)
+        @rate_limit = rate_limit || (capturing? ? 1 : 5000)
         @rate_limiter = Datadog::Core::TokenBucket.new(@rate_limit)
 
         # At most one report per second.
@@ -166,6 +166,14 @@ module Datadog
         !@capture_expressions.empty?
       end
 
+      # Whether this probe captures user data, either as a full snapshot
+      # or via capture expressions.
+      #
+      # @return [Boolean]
+      def capturing?
+        capture_snapshot? || capture_expressions?
+      end
+
       def evaluate_at_entry?
         evaluate_at == :entry
       end

data/lib/datadog/di/probe_notification_builder.rb

@@ -379,6 +379,7 @@ module Datadog
             thread_id: nil,
             version: 2,
           },
+          runtime_id: Core::Environment::Identity.id,
           # TODO add tests that the trace/span id is correctly propagated
           "dd.trace_id": active_trace&.id&.to_s,
           "dd.span_id": active_span&.id&.to_s,

data/lib/datadog/di/remote.rb

@@ -22,7 +22,7 @@ module Datadog
         # when DI is explicitly disabled, or the runtime cannot run DI
         # (JRuby, Ruby 2.5), that block — including this bit — is skipped.
         # The enable signal itself is delivered in APM_TRACING payloads and
-        # routed here by Tracing::Remote.process_config.
+        # routed here by Tracing::Remote.merge_and_apply_configs.
         CAPABILITIES = [
           1 << 38, # APM_TRACING_ENABLE_DYNAMIC_INSTRUMENTATION: Implicit DI enablement
         ].freeze
@@ -37,7 +37,7 @@ module Datadog
 
         # Entry point for the RC-driven DI enable/disable path.
         #
-        # Invoked from {Datadog::Tracing::Remote.process_config} when an
+        # Invoked from {Datadog::Tracing::Remote.merge_and_apply_configs} when an
         # APM_TRACING payload carries `dynamic_instrumentation_enabled`. Runs
         # on the remote-config thread; never raises.
         #
@@ -45,7 +45,7 @@ module Datadog
         #   false to stop it. The `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false`
         #   env var blocks an enable here (see {.explicitly_disabled?}).
         # @param repository [Datadog::Core::Remote::Configuration::Repository, nil]
-        #   the RC repository, passed by {Datadog::Tracing::Remote.process_config}
+        #   the RC repository, passed by {Datadog::Tracing::Remote.apply_lib_config}
         #   so that a stopped->started transition can reconcile against probes that
         #   were delivered in an earlier poll. nil when called outside the RC
         #   dispatch path (e.g. unit tests), in which case no reconcile happens.