https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Missing-Log-Files-Due-to-OneAgent-Log-Monitoring/ta-p/302252 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <H2>Summary</H2> <DIV>This article applies to Dynatrace Log Monitoring with OneAgent and helps troubleshoot situations where a log file is expected to appear in Dynatrace but is not being ingested. It specifically covers cases where OneAgent Log Monitoring security rules prevent a file from being collected and explains how to use the Dynatrace Log Security Rules Checker to validate and resolve the issue.</DIV> <P>&nbsp;</P> <H2>Problem</H2> <DIV> <P>A log file is configured or expected to be monitored by OneAgent, but the log does not appear in Dynatrace.</P> <P>Common symptoms include:</P> <UL> <LI>The log file is present on the host and actively receiving data.</LI> <LI>No matching log records are visible in Dynatrace.</LI> <LI>No obvious ingestion errors are displayed in the Dynatrace UI.</LI> <LI>The affected file may be located in a directory that is not covered by the default OneAgent security rules or may match an exclusion rule.</LI> </UL> <P>OneAgent Log Monitoring uses built-in security rules to ensure that only appropriate log files are ingested. These rules are designed to prevent accidental collection of configuration files, secrets, and other non-log content. When a file path is blocked by these rules, the file will not be ingested.</P> </DIV> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <DIV> <H3>Validate the file path</H3> <P>Before proceeding, ensure that you have:</P> <UL> <LI>The absolute file path of the log file.</LI> <LI>All symbolic links resolved.</LI> <LI>The installed OneAgent version.</LI> <LI>Python 3 available on your workstation.</LI> </UL> <P>Clone the Log Security Rules Checker repository:</P> </DIV> <LI-CODE lang="python">git clone https://github.com/Dynatrace/Dynatrace-Log-Security-Rules-Checker.git cd Dynatrace-Log-Security-Rules-Checker</LI-CODE> <DIV> <H3>Check the path against the default OneAgent rules</H3> <P>Run the following command:</P> <LI-CODE lang="python">python3 LogAgentSecurityRulesChecker.py -a &lt;agent_version&gt; -o linux &lt;absolute_path&gt;</LI-CODE> <P>&nbsp;Example:</P> <LI-CODE lang="python">python3 LogAgentSecurityRulesChecker.py -a 1.301 -o linux /usr/sap/BQH/HDB03/cssbq3d01/trace/available.log</LI-CODE> <P>&nbsp;</P> <DIV> <P>Review the result:</P> <UL> <LI><STRONG>INCLUDED</STRONG> – The file is allowed by the security rules and should be eligible for ingestion.</LI> <LI><STRONG>EXCLUDED</STRONG> – Continue to the next step.</LI> </UL> <DIV> <H3>Identify the exact matching rule</H3> <P>Run the checker in verbose mode:</P> <LI-CODE lang="python">python3 LogAgentSecurityRulesChecker.py -a &lt;agent_version&gt; -o linux &lt;absolute_path&gt; -v</LI-CODE> <DIV> <P>The output identifies the specific security rule responsible for the exclusion.</P> <P>Example:</P> <LI-CODE lang="python">Try to match rule { ^/usr/**/**{ * }{ EXCLUDE }**o { /usr/sap/BQH/HDB03/cssbq**01/trace/ }{ available.log } **- directory**art MATCHED, file part MATCHED --**the rule is matched. '/usr**ap/BQH/HDB03**ssbq3d01/trace/available.log' is **CLUDED.</LI-CODE></DIV> <P>&nbsp;</P> <DIV> <H3>Check if a newer OneAgent version resolves the issue</H3> <P>Run the checker without specifying a OneAgent version:</P> <LI-CODE lang="python">python3 LogAgentSecurityRul**Checker.py -o linux &lt;absolute_pat** -v</LI-CODE></DIV> </DIV> </DIV> <P>&nbsp;</P> <DIV> <P>This tests the path against the newest known security rule set.</P> <P>Review the result:</P> <UL> <LI><STRONG>INCLUDED</STRONG> – Upgrading OneAgent to the corresponding version or later may resolve the issue.</LI> <LI><STRONG>EXCLUDED</STRONG> – Continue to the resolution steps.</LI> </UL> </DIV> </DIV> <H2>&nbsp;</H2> <H2>Resolution</H2> <DIV> <H3>Generate a custom security rules configuration</H3> <P>If the file remains excluded and an upgrade is not possible or does not resolve the issue, generate a custom configuration:</P> <LI-CODE lang="python">python3 LogAgentSecurityRu**sChecker.py -a &lt;agent_version&gt; -o**inux &lt;absolute_path&gt; -g custom_co**ig.json -v</LI-CODE></DIV> <P><EM>&nbsp;</EM></P> <DIV>This creates a <CODE>custom_config.json</CODE> file containing an INCLUDE rule for the target path. The generated configuration also includes support for common log rotation filename variations.</DIV> <DIV> <DIV> <H3>Validate the generated configuration</H3> <P>Before deployment, verify that the custom configuration allows the file:</P> <LI-CODE lang="python">python3 LogAgentSecurity**lesChecker.py -a &lt;agent_version&gt; ** linux &lt;absolute_path&gt; -c custom_**nfig.json -v</LI-CODE></DIV> </DIV> <DIV>Confirm that the output reports:</DIV> <LI-CODE lang="python">INCLUDED**</LI-CODE> <DIV> <H3>Deploy the custom configuration</H3> <OL> <LI>Copy the validated <CODE>custom_config.json</CODE> file to the target OneAgent host.</LI> <LI>Place the configuration in the location specified by the Dynatrace security rules documentation.</LI> <LI>Restart OneAgent if required by the operating system and deployment method.</LI> <LI>Verify that the log file is subsequently ingested and visible in Dynatrace.</LI> </OL> <H3>Additional checker options</H3> <DIV class="___1dmoc29 f10pi13n ftgm304 f1enuhaj fdclmfp f1nbblvp fat0sn4 f1ov4xf1 fekwl8i f1lmfglv f1oz7aqm f1abmfm4 f1w619qj f16h0jq8"> <TABLE class="___1vyiefv f1ddd56o f16vktn6 f1ahpp82 f11qra4b f1uinfot fibjyge fvueend f9yszdx f1fu4s3n f3l3pb3 f10ghnd0 f8fmt76 fjvbh62 f1qrqxae f1vw5qpk fc02sbz fxawf59 fymf513 f1aoyrul f1el8yx3 f1pymoxg f1ofu761 fe6itr f7coize f1794535 f1o0pw0q fbjjl9v fk1v6el f16pyhcb f1ixlhx9 f12zef0i flu5r5u f19haqzy f1owmcxx f1oddm8q f1004tna fcoaxci fh0ee9u f15v23i2 f1dmj53 f1r1gcv9 f14z1veh ffufd3x f1ypplot f1660cg"> <TBODY> <TR> <TH>Option</TH> <TH>Description</TH> </TR> <TR> <TD><CODE>-i paths.txt</CODE></TD> <TD>Validate multiple paths from a file</TD> </TR> <TR> <TD><CODE>-n</CODE></TD> <TD>Skip online version checks</TD> </TR> <TR> <TD><CODE>-o windows</CODE></TD> <TD>Test Windows security rules</TD> </TR> <TR> <TD><CODE>--help</CODE></TD> <TD>Display all available options</TD> </TR> </TBODY> </TABLE> </DIV> <H3>Important notes</H3> <UL> <LI>Always test using the <STRONG>absolute path</STRONG>.</LI> <LI>Resolve all symbolic links before validation.</LI> <LI>Custom security rules <STRONG>supplement</STRONG> the default rules and do not replace them.</LI> <LI>Security rules evolve over time, so testing against newer OneAgent versions may identify a version where the path is already permitted.</LI> </UL> </DIV> <P><EM>&nbsp;</EM></P> <H2>What's next</H2> <DIV> <P>If this article didn't resolve the issue, please open a support ticket and mention that you followed the troubleshooting steps described here.</P> <H3>Opening a support ticket</H3> <P>Include the following information:</P> <UL> <LI>Full absolute path of the affected log file.</LI> <LI>OneAgent version.</LI> <LI>Operating system and version.</LI> <LI> <DIV>Output from: <DIV class="___77lcry0 f10pi13n"> <DIV class="___1hewfwb f10pi13n f7oukh6 f5p0z4x" tabindex="0" role="group" aria-label="Code Preview"> <DIV> <DIV class="scriptor-component-code-block Ds9+tcw0llUdlOER+3QMrw== scriptor-codeblock-virtualized" tabindex="-1"> <DIV class="IdRfIs658qCsauVGBNzC9g=="> <DIV class="rrd10u0 fui-AriaLive__assertive" aria-live="assertive"><LI-CODE lang="python">python3 LogAgentSecurity**lesChecker.py -a &lt;agent_version&gt; ** &lt;os&gt; &lt;path&gt; -v</LI-CODE></DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </LI> </UL> </DIV> <DIV> <UL> <LI>Generated <CODE>custom_config.json</CODE> file (if applicable).</LI> <LI>Screenshots showing: <UL> <LI>Log Monitoring configuration.</LI> <LI>Log viewer searches used to verify missing data.</LI> </UL> </LI> <LI>Confirmation whether testing against the latest known rule set resulted in <STRONG>INCLUDED</STRONG> or <STRONG>EXCLUDED</STRONG>.</LI> <LI>Any custom OneAgent security rule configurations currently in use.</LI> </UL> </DIV> <DIV> <H3>Alternatives</H3> <UL> <LI> <P>Review the official Dynatrace documentation for OneAgent security rules:<BR /><A class="fui-Link fai-bebop ___1v1lyro f2hkw1w f3rmtva f1ewtqcl f16muhyy f1k6fduh f1w7gpdv f1mo0ibp fjoy568 ff5ikls f1s184ao f1mk8lai fnbmjn9 f1o700av f13mvf36 f33ey8m f9n3di6 f1ids18y f1tx3yz7 feiuef2 f1eh06m1 f54796x fhgqx19 f1olyrje f1p93eir f1nev41a f132whgj f1v74mp6 f1tsf1ni fnq52rx f16zlvvm" tabindex="0" href="https://docs.dynatrace.com/docs/observe-and-explore/logs/lma-log-ingestion/lma-log-ingestion-via-oa/lma-security-rules" target="_blank" rel="noopener noreferrer" data-tabster="{&quot;restorer&quot;:{&quot;type&quot;:1}}">OneAgent Log Monitoring Security Rules</A></P> </LI> <LI> <P>Use the Dynatrace Log Security Rules Checker repository for offline validation and testing:<BR /><A class="fui-Link fai-bebop ___1v1lyro f2hkw1w f3rmtva f1ewtqcl f16muhyy f1k6fduh f1w7gpdv f1mo0ibp fjoy568 ff5ikls f1s184ao f1mk8lai fnbmjn9 f1o700av f13mvf36 f33ey8m f9n3di6 f1ids18y f1tx3yz7 feiuef2 f1eh06m1 f54796x fhgqx19 f1olyrje f1p93eir f1nev41a f132whgj f1v74mp6 f1tsf1ni fnq52rx f16zlvvm" tabindex="0" href="https://github.com/Dynatrace/Dynatrace-Log-Security-Rules-Checker" target="_blank" rel="noopener noreferrer" data-tabster="{&quot;restorer&quot;:{&quot;type&quot;:1}}">Dynatrace Log Security Rules Checker</A></P> </LI> <LI>Further troubleshooting- <A href="https://community.dynatrace.com/t5/Troubleshooting/Logs-Troubleshooting-Map/ta-p/302260" target="_self">Logs Troubleshooting Map</A>&nbsp;</LI> </UL> </DIV> </DIV> Wed, 29 Jul 2026 12:42:02 GMT noel_david 2026-07-29T12:42:02Z https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Missing-Log-Files-Due-to-OneAgent-Log-Monitoring/ta-p/302252 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H2>Summary</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.</EM></P> <P>&nbsp;</P> <H2>Problem</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&nbsp;important messages, errors, or information that will help the customer find this article when searching.</EM></P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P><EM>*This section can be omitted as necessary.</EM></P> <P><EM>Explain what troubleshooting steps should be taken to ensure the problem matches this article.</EM></P> <P>&nbsp;</P> <H2>Resolution</H2> <P><EM>*This section can be omitted for articles that guide customers on ticket creation.</EM></P> <P><EM>Explain the solution or all possible solutions resulting from the troubleshooting steps.<BR /><BR /></EM></P> <H2>What's next</H2> <P><EM>*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&nbsp;</EM></P> <P><EM>Explain what to do if the article did not help.&nbsp;</EM><EM>Note that there are multiple options available, including:</EM></P> <OL> <LI><EM><STRONG>Opening a support ticket</STRONG> - be as specific as possible about the information the customer should include in the ticket.&nbsp;</EM> If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket: <UL> <LI>link to XYZ</LI> <LI>screenshot of XYZ</LI> <LI>information about XYZ</LI> </UL> </LI> <LI><EM><STRONG>Suggesting Product Idea</STRONG> - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.</EM></LI> <LI><EM><STRONG>Explain this will change in the future</STRONG> - explain that this behaviour will change in a future release. (No product idea / support ticket needed)</EM></LI> <LI><EM><STRONG>Alternatives -</STRONG>&nbsp;any other actions or links to other articles that could move the customer forward.</EM></LI> </OL> <P>&nbsp;</P> <P><EM>*If it exists, link this article to the relevant troubleshooting map using the following guideline</EM></P> <H3>More articles can be found on the <A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_self">XXX Troubleshooting Map</A></H3> </DIV> Wed, 29 Jul 2026 12:42:02 GMT https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Missing-Log-Files-Due-to-OneAgent-Log-Monitoring/ta-p/302252 noel_david 2026-07-29T12:42:02Z https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Missing-Log-Files-Due-to-OneAgent-Log-Monitoring/tac-p/302555#M1170 <P>Hi,</P><P>Thank you! I was not aware of this command line utility&nbsp;<img class="lia-deferred-image lia-image-emoji" src="https://community.dynatrace.com/html/@0159DAC3E7471E7A67CC76770F97BEC3/images/emoticons/clap.gif" alt=":clap:" title=":clap:" /></P><P>Best regards</P> Wed, 29 Jul 2026 12:50:45 GMT https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Missing-Log-Files-Due-to-OneAgent-Log-Monitoring/tac-p/302555#M1170 AntonPineiro 2026-07-29T12:50:45Z