惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

博客园_首页
The GitHub Blog
The GitHub Blog
美团技术团队
Know Your Adversary
Know Your Adversary
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
The Register - Security
The Register - Security
Stack Overflow Blog
Stack Overflow Blog
Attack and Defense Labs
Attack and Defense Labs
G
Google Developers Blog
I
InfoQ
博客园 - 司徒正美
T
Troy Hunt's Blog
Google DeepMind News
Google DeepMind News
J
Java Code Geeks
MongoDB | Blog
MongoDB | Blog
博客园 - 聂微东
A
About on SuperTechFans
云风的 BLOG
云风的 BLOG
S
Security Affairs
M
MIT News - Artificial intelligence
Simon Willison's Weblog
Simon Willison's Weblog
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
T
Tailwind CSS Blog
量子位
Vercel News
Vercel News
月光博客
月光博客
V
Vulnerabilities – Threatpost
N
News and Events Feed by Topic
Hugging Face - Blog
Hugging Face - Blog
酷 壳 – CoolShell
酷 壳 – CoolShell
L
LangChain Blog
D
Darknet – Hacking Tools, Hacker News & Cyber Security
L
LINUX DO - 最新话题
F
Full Disclosure
The Hacker News
The Hacker News
Hacker News: Ask HN
Hacker News: Ask HN
T
Tor Project blog
A
Arctic Wolf
Application and Cybersecurity Blog
Application and Cybersecurity Blog
Forbes - Security
Forbes - Security
IT之家
IT之家
Apple Machine Learning Research
Apple Machine Learning Research
B
Blog
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Y
Y Combinator Blog
GbyAI
GbyAI
B
Blog RSS Feed
V
Visual Studio Blog
T
The Blog of Author Tim Ferriss
F
Fortinet All Blogs

Datadog | The Monitor blog

Introducing our open source AI-native SAST Instrument and monitor Boomi integration flows with OpenTelemetry and Datadog Not all index scans are equal: How we cut query latency by over 99% Platform engineering metrics: What to measure and what to ignore Integrate Recorded Future threat intelligence with Datadog Cloud SIEM CI/CD security: threat modeling using a MITRE-style threat matrix CI/CD security: How to secure your GitHub ecosystem Ingress NGINX is EOL: A practical guide for migrating to Kubernetes Gateway API Operating agentic AI with Amazon Bedrock AgentCore and Datadog LLM Observability: Lessons from NTT DATA Introducing the Datadog Code Security MCP Capture and analyze custom heatmaps in Session Replay Understand session replays faster with AI summaries and smart chapters Monitor ClickHouse query performance with Datadog Database Monitoring How we designed empathetic alert sounds for on-call engineers Search and act across Datadog to resolve issues faster with Bits Assistant Measure the business impact of every product change with Datadog Experiments Analyzing round trip query latency Configuring JavaScript caches for better performance Introducing Bits AI Dev Agent for Code Security Datadog achieves ISO 42001 certification for responsible AI Monitor Nutanix clusters, hosts, and VMs with Datadog Monitor Juniper Mist in Datadog A new Host Map for modern infrastructure Annotate traces to improve LLM quality with Datadog LLM Observability What’s new in Cloud SIEM: AI-powered investigations, enhanced threat intelligence, and scalable security operations Explore Kubernetes with native OpenTelemetry data Monitor Oracle Fusion Cloud Applications with Datadog Announcing the Datadog Terraform provider v4.0.0 Scaling Kubernetes workloads on custom metrics How to design cloud environments for AI-powered threat analysis Monitor Aruba Central in Datadog How we centralize and remediate risks with Datadog Case Management Accelerate incident response with Datadog and ServiceNow Monitor your application and network load balancer logs Understanding Karpenter architecture for Kubernetes autoscaling Tools for collecting metrics and logs from Karpenter Monitor Karpenter with Datadog What your product data is actually saying Key metrics for monitoring Karpenter Securing Datadog’s platform in the AI age: The role of observability data Four ways engineering teams use the Datadog MCP Server to power AI agents Approaching your observability migration with the right mindset Meet the new Bits AI SRE: Deeper reasoning, twice as fast Key learnings from the 2026 State of DevSecOps study Use plain English to query your multi-cloud infrastructure in Resource Catalog Simplifying troubleshooting across the user journey with Datadog Synthetic Monitoring Protect your OCI resources with Datadog Cloud Security This Month in Datadog - February 2026 Amazon EC2 security: How misconfigured and public AMIs expand your cloud attack surface Enable end-to-end visibility into your Java apps with a single command Measure and improve mobile app startup performance with Datadog RUM Evaluating our AI Guard application to improve quality and control cost Identify untested code across every level of your codebase Make use of guardrail metrics and stop babysitting your releases Monitor Versa Networks SD-WAN performance in Datadog Improve performance and reliability with APM Recommendations Remediate transitive vulnerabilities faster with Datadog Software Composition Analysis Generate audit-ready vulnerability and compliance reports with Datadog Sheets Monitor Fortinet FortiManager performance in Datadog Improve test coverage across codebases with Datadog Code Coverage Move fast, don’t break things: Consistent testing standards at scale Enrich logs with ServiceNow CMDB context before routing to any SIEM or logging tool Monitor Lustre with Datadog Make faster, better product decisions with Datadog Product Analytics Surface and remediate runtime posture issues with Workload Protection Findings Protect agentic AI applications with Datadog AI Guard How to optimize JavaScript code with CSS Trace Google Pub/Sub workloads in Cloud Run with Datadog Detect human names in logs with ML in Sensitive Data Scanner How we cut our NLQ agent debugging time from hours to minutes with LLM Observability Debug PostgreSQL query latency faster with EXPLAIN ANALYZE in Datadog Database Monitoring Datadog acquires Propolis Unify and correlate frontend and backend data with retention filters Scale compliance across global frameworks with Datadog Cloud Security Monitor Arista VeloCloud SD-WAN performance with Datadog Building reliable dashboard agents with Datadog LLM Observability Simplify log collection and aggregation for MSSPs with Datadog Observability Pipelines Mitigation for Node.js denial-of-service vulnerability affecting Datadog APM Automate flaky test fixes with the Bits AI Dev Agent and Test Optimization How we built an AI SRE agent that investigates like a team of engineers Datadog integrations 2025 recap: Observability for AI, security, and hybrid cloud Design effective executive dashboards with Datadog Implement dbt data quality checks with dbt-expectations Bring faster visibility into AWS Lambda functions with remote instrumentation Troubleshoot faster with the GitLab Source Code integration in Datadog How Cambia Health Solutions saved $30,000 monthly with Cloud Cost Management and the Datadog Resource Catalog Normalize any logs for Cloud SIEM with Datadog's OCSF processor Optimizing Datadog at scale: Cost-efficient observability at Zendesk Detect, diagnose, and resolve network issues easily with CNM Network Health Connect engineering errors to user impact in early-stage products Cilium configuration for Kubernetes operations at scale Designing feedback loops for progressive delivery Ship features faster and safer with Datadog Feature Flags Choosing the right OpenTelemetry Collector distribution Route your monitor alerts with Datadog monitor notification rules Automate Cloud SIEM investigations with Bits AI Security Analyst Cloud threat detection: How to identify risky activity across control and data planes Collecting Kafka performance metrics Monitoring Kafka with Datadog Monitoring Kafka performance metrics
Understand production LLM behavior with Patterns in Agent Observability
Rashel Hoover, Vincent Cornet · 2026-06-09 · via Datadog | The Monitor blog

When you deploy an LLM-powered application, you make assumptions about how users will interact with it. In practice, production traffic rarely matches those assumptions. Users ask questions outside the intended scope, shift goals mid-conversation, and develop workflows the application was never designed to support. At the same time, patterns that worked well at launch can quietly degrade: Costs creep up in specific interaction categories, evaluation scores drop for a subset of requests, or a cluster of behavior that was once predictable starts growing faster than everything else.

Individual trace review can surface that something is wrong, but it can’t tell you which behaviors—including what types of questions users are asking, and what kinds of outputs your agents generate—are associated with the regression, or reveal interaction patterns you didn’t know existed in the first place. The result is that teams end up investigating symptoms without a clear view of the underlying user behavior driving them.

Patterns in Datadog Agent Observability gives you that view, helping you answer two important questions about production traffic: What are users trying to do that the application was not designed for, and what behaviors have meaningfully changed over time? Patterns automatically clusters production interactions into hierarchical topics that give you an interpretable view of your agents’ production behavior, including user input and agent responses, without requiring predefined categories or manual labeling. This enables you to see actual trends in how users are engaging with your application and how your agents are behaving, including workflows, tool calls, and other behaviors you didn’t anticipate. Each cluster surfaces cost, latency, error rate, and evaluation coverage benchmarked against your other patterns, so the interactions driving quality and cost issues are immediately visible. 

In this post, we’ll look at how Patterns helps you:

  • Understand how users are actually interacting with your LLM application

  • Identify behavioral patterns that are driving quality, latency, and cost issues

  • Build evaluations and datasets around the interactions that matter most

Understand how users are actually interacting with your application

Many teams think about their LLM applications in terms of a few primary workflows, but production traffic tends to contain many more distinct interaction patterns than expected. For example, a customer support assistant might support billing questions, account changes, troubleshooting requests, onboarding guidance, and escalation handling, all with multiple variations inside each category. Some of these interaction types may never have been represented in evaluation datasets or preproduction testing.

This gap becomes difficult to detect through traditional trace analysis alone. Filtering traces by errors or latency can reveal that something is wrong, but it does not explain if the category of user behavior was tested for in preproduction. Teams often need to manually inspect hundreds of traces before they can identify a recurring pattern.

Patterns addresses this problem by automatically clustering production interactions into groups with thematic similarity. These clusters help you understand how users are actually using your application, including workflows and requests that were never anticipated during development.

Patterns view in Agent Observability showing clustered production interactions grouped by behavior and volume

Patterns organizes interactions into clusters: hierarchical topic structures that can represent both broad and narrow categories of behavior. For example, a top-level “billing questions” cluster might contain nested subcategories such as “subscription changes,” “refund requests,” and “cancellation requests.” 

Because Patterns is built directly into Datadog Agent Observability, every cluster includes operational and quality context alongside the behavioral grouping itself. You can immediately compare metrics such as traffic volume, latency, cost per interaction, error rate, and evaluation scores against the norms established in other behavioral patterns to identify meaningful outliers.

This context becomes especially important when investigating changes in application behavior over time. A pattern that suddenly increases in volume or begins generating higher costs may indicate a shift in user expectations, a regression in agent behavior, or a new workflow emerging in production traffic.

Investigate the patterns driving quality and cost issues

Behavioral clustering becomes most valuable when you can connect patterns directly to operational and quality signals. A cluster with higher-than-average latency, a spike in failed evaluations, or rapidly increasing token costs can point to a specific category of interactions that deserves deeper analysis.

Patterns helps you move from broad symptoms to concrete investigation targets. Instead of asking why evaluation scores dropped globally, you can identify the specific interaction clusters associated with the regression. Similarly, instead of reviewing expensive traces individually, you can identify which categories of conversations are responsible for rising inference costs.

The pattern detail view provides additional context to help you investigate these issues. You can analyze trends over time for a specific cluster, inspect the most common tool calls and prompts associated with the pattern, and review evaluation pass and fail breakdowns for each evaluator attached to the traffic. This makes it easier to isolate whether failures are tied to a particular retrieval step, prompt structure, or downstream tool invocation.

Pattern detail view in Agent Observability showing latency trends, evaluation pass rates, tool calls, and cost metrics for a production interaction cluster

Patterns also highlights clusters that do not currently have evaluation coverage. These uncovered patterns can represent blind spots in your approach to evaluating and maintaining quality, especially when they correspond to high-volume or high-cost interactions. By surfacing these gaps directly in the workflow, Patterns enables you to identify where additional evaluations or datasets are needed before issues become larger production incidents.

Build evaluations and datasets around production behavior

For structured assistants and workflow-driven agents, the most valuable patterns are often the ones that teams did not anticipate. Users may ask questions outside the supported scope of the application, shift goals midway through a conversation, or request actions that the agent cannot currently perform. These interactions expose capability gaps that are difficult to identify through synthetic testing alone.

Because Patterns runs continuously against your production traffic, it helps you understand when something shifts in your application. For example, users might repeatedly ask a support assistant for troubleshooting guidance that requires external documentation, or they may attempt follow-up workflows that depend on long-term conversational memory. These recurring requests can point teams toward concrete improvements such as adding new tools, expanding prompt instructions, or improving session memory. Patterns will also cluster on trends in agent behavior, helping you spot unexpected tool calls or agent responses.

At the same time, Patterns helps you identify behavioral drift across existing workflows. A cluster that suddenly grows faster than others, produces more errors, or consumes significantly more tokens may indicate changing user expectations or unintended changes in application behavior.

From either starting point, the next step is often the same: understanding whether the relevant production traffic is represented in datasets and evaluation workflows. Patterns helps you identify how much evaluation coverage exists for a given cluster and where measurement remains limited.

You can then create datasets directly from representative traces inside a specific pattern and attach evaluators that target the associated behavior. 

Agent Observability workflow that routes traces from a selected pattern into a dataset

This approach helps you align your quality infrastructure with the interactions users are actually having in production, instead of relying exclusively on datasets built from synthetic tests, which may not generalize well to real traffic. By building evaluations around production behavior, you can improve coverage for emerging workflows, monitor regressions more effectively, and prioritize quality improvements based on real user interactions.

Explore production LLM behavior with Patterns

Patterns in Agent Observability helps you understand how users are actually interacting with your LLM applications in production. By automatically clustering interactions into behavioral groups and correlating those patterns with operational and quality signals, Patterns makes it easier to investigate regressions, identify capability gaps, and prioritize evaluation coverage around the workflows that matter most.

To get started, read the Patterns documentation and request access to the Preview. If you’re new to Datadog, you can sign up for a 14-day free trial.