https://community.dynatrace.com/t5/Troubleshooting/Logs-Not-Being-Ingested-Due-to-F5-Distributed-Cloud-WAAP/ta-p/302352 <H2>Summary</H2> <P>This article applies to <STRONG>Dynatrace OneAgent communication and Log Monitoring</STRONG>. It helps troubleshoot situations where logs are delayed, intermittently ingested, or completely missing because OneAgent communication is being intercepted by an <STRONG>F5 Distributed Cloud WAAP (formerly Volterra)</STRONG> deployment positioned in front of a Dynatrace Cluster.</P> <P>The article explains how to identify the issue using OneAgent logs and communication traces and how to work with network teams to restore normal log ingestion.</P> <HR /> <H2>Problem</H2> <P>Customers may observe one or more of the following symptoms:</P> <UL> <LI>Logs stop appearing in Dynatrace.</LI> <LI>Log ingestion becomes significantly delayed.</LI> <LI>Some hosts continue sending logs while others stop completely.</LI> <LI>OneAgent appears healthy.</LI> <LI>No Dynatrace-side ingestion errors are visible.</LI> <LI>File uploads or communication requests fail intermittently.</LI> </UL> <P>OneAgent logs may contain messages similar to:</P> <PRE><CODE>Did not expect to receive data on asynchronous channel - ignoring </CODE></PRE> <P>or</P> <PRE><CODE>Could not parse response from server </CODE></PRE> <P>In affected environments, communication requests may appear successful because the HTTP request returns a valid status code:</P> <PRE><CODE>HTTP/1.1 200 OK </CODE></PRE> <P>Despite the successful HTTP response, the response body is generated by an intermediary security device instead of the Dynatrace Cluster.</P> <HR /> <H2>Troubleshooting Steps</H2> <H3>Step 1: Review OneAgent Communication Logs</H3> <P>Search the OneAgent logs for:</P> <PRE><CODE>Did not expect to receive data on asynchronous channel - ignoring </CODE></PRE> <P>This message indicates that OneAgent received a response body when it expected no response body.<SPAN>Responses containing data are unexpected and typically indicate traffic interception or modification.</SPAN></P> <HR /> <H3>Step 2: Check Communication Traces</H3> <P>Review the communication log immediately before the error.</P> <P><STRONG>Example:</STRONG></P> <PRE><CODE>POST /communication HTTP/1.1 Host: &lt;cluster-url&gt; HTTP/1.1 200 OK server: volt-adc content-length: 269 x-volterra-location: mb2-mum Did not expect to receive data on asynchronous channel - ignoring </CODE></PRE> <P>The following response headers strongly indicate that traffic is traversing F5 Distributed Cloud infrastructure:</P> <UL> <LI><CODE>server: volt-adc</CODE></LI> <LI><CODE>x-volterra-location</CODE></LI> </UL> <BLOCKQUOTE> <P>These headers are not generated by Dynatrace.</P> </BLOCKQUOTE> <HR /> <H3>Step 3: Look for Fixed-Length Responses</H3> <P>Another key indicator is the presence of a repeated response length:</P> <PRE><CODE>content-length: 269 </CODE></PRE> <P>During investigation, request sizes varied significantly while response sizes remained consistently 269 bytes.</P> <BLOCKQUOTE> <P>This behavior strongly suggests a proxy-generated response rather than a Dynatrace protocol response.</P> </BLOCKQUOTE> <HR /> <H3>Step 4: Search for Parsing Failures</H3> <P>Search OneAgent logs for:</P> <PRE><CODE>Could not parse response from server </CODE></PRE> <P><STRONG>Example:</STRONG></P> <PRE><CODE>FileUploadStream: Upload of zipped stream failed Could not parse response from server: 269 bytes beginning with ... </CODE></PRE> <P>This indicates that OneAgent expected a Dynatrace protocol response but instead received HTML content.</P> <BLOCKQUOTE> <P>Receiving HTML in response to Dynatrace cluster communication is a strong indicator that another system generated the response before it reached the Dynatrace backend.</P> </BLOCKQUOTE> <HR /> <H3>Step 5: Verify Reverse Proxy or WAAP Deployment</H3> <P>Work with the network or security team to determine whether any of the following components exist between OneAgent and the Dynatrace Cluster:</P> <UL> <LI>F5 Distributed Cloud WAAP</LI> <LI>Volterra</LI> <LI>Web Application Firewall (WAF)</LI> <LI>Application Delivery Controller (ADC)</LI> <LI>DDoS protection platform</LI> <LI>API gateway or API protection solution</LI> <LI>Bot defense platform</LI> </UL> <P>Particular attention should be given to products providing:</P> <UL> <LI>DDoS protection</LI> <LI>Rate limiting</LI> <LI>Intrusion prevention</LI> <LI>Bot defense</LI> <LI>Request filtering</LI> <LI>Content inspection</LI> <LI>Traffic rewriting</LI> </UL> <HR /> <H2>Resolution</H2> <P>The root cause may be that an F5 Distributed Cloud WAAP deployment is intercepting OneAgent communication before it reaches the Dynatrace Cluster.</P> <P>During investigation, the following observations were made:</P> <UL> <LI>OneAgent successfully established communication sessions.</LI> <LI>HTTP requests returned <CODE>200 OK</CODE>.</LI> <LI>Responses contained Volterra-specific headers.</LI> <LI>Response bodies consistently measured 269 bytes.</LI> <LI>OneAgent received HTML instead of Dynatrace protocol responses.</LI> <LI>Communication uploads failed with parsing errors.</LI> </UL> <P>OneAgent expects protocol-specific binary responses from Dynatrace. When a security device generates its own response instead, OneAgent cannot process the data and communication failures occur.</P> <P><STRONG>To resolve the issue:</STRONG></P> <OL> <LI>Review F5 Distributed Cloud WAAP policies.</LI> <LI>Allow Dynatrace OneAgent traffic to pass through without modification.</LI> <LI>Exclude Dynatrace communication endpoints from inspection when appropriate.</LI> <LI>Review rate-limiting, bot-defense, WAF, and API security controls.</LI> <LI>Verify that requests reach the Dynatrace Cluster directly.</LI> <LI>Confirm that communication errors disappear after the policy change.</LI> </OL> <P>After appropriate exclusions or allowlisting are implemented, log ingestion should return to normal.</P> <HR /> <H2>What's Next</H2> <H3>Opening a Support Ticket</H3> <P>If this article did not resolve the issue, please open a Dynatrace Support ticket and mention that you followed this article.</P> <P>Include the following information:</P> <UL> <LI>OneAgent support archive.</LI> <LI>Affected host names.</LI> <LI>OneAgent version.</LI> <LI>Dynatrace Cluster URL.</LI> <LI>Screenshots showing delayed or missing logs.</LI> <LI>Details of any reverse proxy, WAAP, WAF, ADC, API gateway, or load balancer positioned between OneAgent and the Dynatrace Cluster.</LI> </UL> <HR /> <H2>Alternatives</H2> <P>If a reverse proxy is required in your environment:</P> <UL> <LI>Work with the security team to allowlist Dynatrace OneAgent communication.</LI> <LI>Review WAAP logs for dropped, rejected, or modified requests.</LI> <LI>Compare traffic from affected and unaffected hosts.</LI> <LI>Validate that the <CODE>/communication</CODE> endpoint is not inspected or modified.</LI> </UL> <HR /> <H2>More Information</H2> <P>More troubleshooting articles can be found on the <A title="Logs Troubleshooting Map - Community Home" href="https://community.dynatrace.com/t5/Troubleshooting/Logs-Troubleshooting-Map/ta-p/302260" target="_blank" rel="noopener"><STRONG>Logs Troubleshooting Map – Community Home</STRONG>.</A></P> Wed, 19 Aug 2026 14:16:11 GMT nikitachauhan 2026-08-19T14:16:11Z https://community.dynatrace.com/t5/Troubleshooting/Logs-Not-Being-Ingested-Due-to-F5-Distributed-Cloud-WAAP/ta-p/302352 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H2>Summary</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.</EM></P> <P>&nbsp;</P> <H2>Problem</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&nbsp;important messages, errors, or information that will help the customer find this article when searching.</EM></P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P><EM>*This section can be omitted as necessary.</EM></P> <P><EM>Explain what troubleshooting steps should be taken to ensure the problem matches this article.</EM></P> <P>&nbsp;</P> <H2>Resolution</H2> <P><EM>*This section can be omitted for articles that guide customers on ticket creation.</EM></P> <P><EM>Explain the solution or all possible solutions resulting from the troubleshooting steps.<BR /><BR /></EM></P> <H2>What's next</H2> <P><EM>*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&nbsp;</EM></P> <P><EM>Explain what to do if the article did not help.&nbsp;</EM><EM>Note that there are multiple options available, including:</EM></P> <OL> <LI><EM><STRONG>Opening a support ticket</STRONG> - be as specific as possible about the information the customer should include in the ticket.&nbsp;</EM> If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket: <UL> <LI>link to XYZ</LI> <LI>screenshot of XYZ</LI> <LI>information about XYZ</LI> </UL> </LI> <LI><EM><STRONG>Suggesting Product Idea</STRONG> - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.</EM></LI> <LI><EM><STRONG>Explain this will change in the future</STRONG> - explain that this behaviour will change in a future release. (No product idea / support ticket needed)</EM></LI> <LI><EM><STRONG>Alternatives -</STRONG>&nbsp;any other actions or links to other articles that could move the customer forward.</EM></LI> </OL> <P>&nbsp;</P> <P><EM>*If it exists, link this article to the relevant troubleshooting map using the following guideline</EM></P> <H3>More articles can be found on the <A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_self">XXX Troubleshooting Map</A></H3> </DIV> Wed, 19 Aug 2026 14:16:11 GMT https://community.dynatrace.com/t5/Troubleshooting/Logs-Not-Being-Ingested-Due-to-F5-Distributed-Cloud-WAAP/ta-p/302352 nikitachauhan 2026-08-19T14:16:11Z