topic Need a way to use DQL for searching extension logs in DQL

Need a way to use DQL for searching extension logs

deni — Mon, 12 May 2025 06:46:27 GMT

Hello,

I need help with searching logs from the SSL Certificate Monitor extension. I noticed that if the monitored site is down or if there is an error reading the certificate, the certificate just disappears from the discovered certificates. I found some logs in:
./remotepluginmodule/log/extensions/datasources/com.dynatrace.custom.python-certificate-monitor/python3.log
Is there a way to read these logs through DQL and set up an alert if such issues occur?

Thanks!

Regards, Deni

Re: Need a way to use DQL for searching extension logs

RohitBisht — Mon, 12 May 2025 00:51:45 GMT

You can install OneAgent on the activegate host and then enable log monitoring for the file.

Re: Need a way to use DQL for searching extension logs

deni — Mon, 12 May 2025 11:05:31 GMT

How can I enable this log monitoring?

I tried to add a custom log configuration in settings: Linux path: /var/lib/dynatrace/remotepluginmodule/log/extensions/datasources/com.dynatrace.custom.python-certificate-monitor/python3.log

but
fetch logs
| filter matchesValue(content, "8443")
| sort timestamp desc

still don't return anything. The digit is a port number which exists in the file:
sudo grep 8443 . -R | grep 2025-05-12

./remotepluginmodule/log/extensions/datasources/com.dynatrace.custom.python-certificate-monitor/python3.log:[3dacb2c3-3e7b-3354-91b4-6cf6d488d5d6][-4727436546405702787][37757][out]2025-05-12 13:21:40,036 [DEBUG] (ThreadPoolExecutor-0_0): Check bindings: [ProcessPortBinding(address='78.83.113.249', port=8443, pid=None)]

..... and a lot more

/var/lib/dynatrace$ pwd
/var/lib/dynatrace

Re: Need a way to use DQL for searching extension logs

RohitBisht — Tue, 13 May 2025 01:06:41 GMT

Its a 2 step process as stated here: https://docs.dynatrace.com/docs/shortlink/log-monitoring-custom-source

The entire process consists of two parts:

Source definition (custom log source configuration), which is described on this page.
Log acquisition (adding logs to storage), which is described on Log ingest rules.

I believe step 2 is missing for you, once you do this content of log file should be there, try to search for check if the logs are flowing in first and then you can perform specific searches like port number. Hope this helps.