https://community.dynatrace.com/t5/Troubleshooting/Log-source-not-detected-or-not-ingested-Troubleshoot-source/ta-p/303792 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>&nbsp;</P> <H2>Summary</H2> <P><SPAN>Determine whether a source is producing records, autodiscovered by Dynatrace, and covered by the intended active or inherited ingest rule.</SPAN></P> <P>Use this article when an expected log source isn't shown in Dynatrace, or when the source is autodiscovered but isn't covered by an ingest rule.</P> <P>The <STRONG>Sources</STRONG> tab in the Log Module configuration provides an environment-level view of autodiscovered host groups, Kubernetes clusters, hosts, and log sources. It also shows source coverage and allows active and inherited rules to be reviewed together</P> <H2>Problem</H2> <P>You might observe one or more of the following symptoms:</P> <UL> <LI>The expected file or source isn't listed anywhere in Dynatrace.</LI> <LI>One host discovers the source while another doesn't.</LI> <LI>A source disappeared after a path, deployment, or permission change.</LI> <LI>The source is shown but isn't covered by an ingest rule.</LI> <LI>A rule exists, but it applies at an unexpected scope.</LI> <LI>Logs stopped after a matcher or source-attribute change.</LI> </UL> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P>Treat source availability, discovery, and ingestion as separate checks:</P> <TABLE> <THEAD> <TR> <TH class="lia-align-center"><FONT size="2">Stage</FONT></TH> <TH class="lia-align-center"><FONT size="2">Question</FONT></TH> <TH class="lia-align-center"><FONT size="2">Where to check</FONT></TH> </TR> </THEAD> <TBODY> <TR> <TD><STRONG>1. Source availability</STRONG></TD> <TD>Is the application or system creating new records?</TD> <TD>The source system itself</TD> </TR> <TR> <TD><STRONG>2. Source discovery</STRONG></TD> <TD>Does Dynatrace know the source exists?</TD> <TD>Sources tab in Log module config</TD> </TR> <TR> <TD><STRONG>3. Ingest-rule coverage</STRONG></TD> <TD>Is an applicable rule covering the source?</TD> <TD>Sources tab — coverage column</TD> </TR> <TR> <TD><STRONG>4. Record availability</STRONG></TD> <TD>Can the ingested record be found in Dynatrace?</TD> <TD>Logs app</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>Verify each stage in order. A source can pass stage 2 and still fail stage 3. Do not assume a detected source is automatically ingested.</P> <H3>Step 1: Confirm the source is active</H3> <OL> <LI>Confirm that the file, container output, or source exists on the system.</LI> <LI>Confirm that the application writes new records to it.</LI> <LI>Record the exact path or source identity.</LI> <LI>Generate a <STRONG>uniquely identifiable test record</STRONG>&nbsp;for example, write a known string such as <CODE>DT-TEST-1234</CODE> to the source.</LI> <LI>Confirm the test record appears at the original source before continuing.</LI> </OL> <P>If the source doesn't produce new records, investigate the application or logging framework first. Dynatrace cannot ingest what isn't written.</P> <HR /> <H3>Step 2: Open the Sources tab</H3> <P>Open:</P> <DIV class="dutmcw0"> <DIV class="dutmcw1"> <DIV class="_1bzvwaf5q-3-9-0 _1bzvwaf6e-3-9-0 _1bzvwaf2-3-9-0 _1bzvwaf79-3-9-0" data-dt-component="Grid"> <DIV class="strato-button-label _10kgnsa9-3-9-0 _10kgnsab-3-9-0">&nbsp;</DIV> </DIV> </DIV> <PRE class="dutmcw2"><CODE>Settings app &gt; Collect and capture &gt; Log monitoring &gt; Configure log module &gt; Sources </CODE></PRE> </DIV> <P>Select the relevant host group, Kubernetes cluster, host, or workload. Search for the expected source path or name.</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="noel_david_0-1787738525885.png"><img src="https://community.dynatrace.com/t5/image/serverpage/image-id/34129i067C92E7140FC87F/image-size/large?v=v2&amp;px=999" alt="noel_david_0-1787738525885.png" title="noel_david_0-1787738525885.png" /></span> <P>&nbsp;</P> <HR /> <H3>Step 3: If the source is not detected</H3> <P>If the source does not appear in the Sources tab, the Log module has not discovered it. Compare the source with the monitored entity and review the following verified change areas:</P> <UL> <LI>Source path or file name change</LI> <LI>Application logging destination change</LI> <LI>Host, container, or workload identity change</LI> <LI>File ownership or permission change</LI> <LI>Mount or volume configuration change</LI> <LI>Remote or network filesystem (disabled for log monitoring by default)</LI> <LI>Log Monitoring security rules blocking the path</LI> <LI>Custom source configuration path pattern typos, filesystem scope mismatch</LI> </UL> <P>Use these existing articles when applicable:</P> <UL> <LI><A href="https://community.dynatrace.com/t5/Troubleshooting/Enable-Log-Visibility-in-Dynatrace/ta-p/242716" target="_blank" rel="noopener noreferrer">Enable Log Visibility in Dynatrace</A>&nbsp;for initial enablement checks</LI> <LI><A href="https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Missing-Log-Files-Due-to-OneAgent-Log-Monitoring/ta-p/302252" target="_blank" rel="noopener noreferrer">Troubleshooting Missing Log Files Due to OneAgent Log Monitoring Security Rules</A>&nbsp;when a security rule may be blocking the path</LI> <LI><A href="https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-missing-logs-in-Log-module/ta-p/300209" target="_blank" rel="noopener noreferrer">Troubleshooting Missing Logs in Log Module</A>&nbsp; for individual sources missing from the Log module</LI> </UL> <P>After correcting a verified discovery condition, generate another unique test record and check whether the source appears in the Sources tab.</P> <HR /> <H3>Step 4: Use SFM events to confirm discovery state</H3> <P>If SFM events are enabled (OneAgent 1.339+ / SaaS 1.340+), query the current state of the source directly without navigating the Settings UI:</P> <DIV class="dutmcw0"> <DIV class="dutmcw1"> <DIV class="_1bzvwaf5q-3-9-0 _1bzvwaf6e-3-9-0 _1bzvwaf2-3-9-0 _1bzvwaf79-3-9-0" data-dt-component="Grid"> <DIV class="strato-button-label _10kgnsa9-3-9-0 _10kgnsab-3-9-0">&nbsp;</DIV> </DIV> </DIV> <PRE class="dutmcw2"><CODE class="language-dql">fetch dt.system.events | filter event.type == "log_source.status" | filter log.source == "/var/log/your-expected-source.log" </CODE></PRE> </DIV> <P>Key attributes returned:</P> <TABLE> <THEAD> <TR> <TH class="lia-align-center"><FONT size="2">Attribute</FONT></TH> <TH class="lia-align-center"><FONT size="2">What it tells you</FONT></TH> </TR> </THEAD> <TBODY> <TR> <TD><CODE>log.source.file_status</CODE></TD> <TD><CODE>OK</CODE>,<SPAN>&nbsp;</SPAN><CODE>Not Exist</CODE>,<SPAN>&nbsp;</SPAN><CODE>Binary</CODE>, or<SPAN>&nbsp;</SPAN><CODE>Sensitive Masking Timeout</CODE></TD> </TR> <TR> <TD><CODE>log.source.ingest_status</CODE></TD> <TD><CODE>Fully ingested</CODE>,<SPAN>&nbsp;</SPAN><CODE>Partially ingested</CODE>, or<SPAN>&nbsp;</SPAN><CODE>Not ingested</CODE></TD> </TR> <TR> <TD><CODE>log.source.origin</CODE></TD> <TD><CODE>Automatically detected</CODE><SPAN>&nbsp;</SPAN>or<SPAN>&nbsp;</SPAN><CODE>Custom log source</CODE></TD> </TR> </TBODY> </TABLE> <UL> <LI><STRONG>No results returned</STRONG> → the source has not been discovered at all. Continue with Step 3.</LI> <LI><STRONG><CODE>file_status: Not Exist</CODE></STRONG> → the Log module knows the source name but cannot find the file. Check path, permissions, and filesystem access.</LI> <LI><STRONG><CODE>ingest_status: Not ingested</CODE></STRONG> → the source is discovered but not covered by a rule. Continue with Step 5.</LI> </UL> <BLOCKQUOTE> <P><STRONG>Note:</STRONG> SFM events are reported with a delay of up to 90 seconds from the actual state change.</P> </BLOCKQUOTE> <HR /> <H3>Step 5: If the source is detected, review coverage</H3> <P>If the source appears in the Sources tab but is not covered, no ingest rule applies to it. Records are not being collected.</P> <OL> <LI>Review the source attributes shown in the Sources view.</LI> <LI>Identify the intended ingest rule.</LI> <LI>Compare its <STRONG>matcher</STRONG> with the current source attributes.</LI> </OL> <BLOCKQUOTE> <P><STRONG>Critical distinction:</STRONG> The log source matcher matches the <STRONG>log source name</STRONG>, not the file path.</P> <UL> <LI>Example: a matcher <CODE>/path/a.2026.log</CODE> does <STRONG>not</STRONG> match a source named <CODE>/path/a.#.log</CODE>, even if the file <CODE>/path/a.2026.log</CODE> exists in the filesystem.</LI> </UL> </BLOCKQUOTE> <OL start="4"> <LI>Review the rule's <STRONG>scope</STRONG>&nbsp; confirm it applies at the correct level (environment, host group, host).</LI> <LI>Correct or create the rule according to the intended collection policy.</LI> </OL> <HR /> <H3>Step 6: Review active and inherited rules together</H3> <P>The effective rule list for any source is a <STRONG>concatenation of all rules from all applicable configuration scopes</STRONG>&nbsp; environment, host group, and host. Rules are evaluated <STRONG>top-to-bottom</STRONG> and the first match decides the outcome. For more details check <A href="https://docs.dynatrace.com/docs/shortlink/lma-log-ingest-rules#matching-a-list-of-rules-to-log-data" target="_self">here</A>.</P> <P>When reviewing coverage, confirm:</P> <UL> <LI>The expected rule is present at the expected scope</LI> <LI>Its matcher matches the <STRONG>current source name</STRONG> (not the file path)</LI> <LI>Its scope corresponds to the intended entity</LI> <LI>No higher-priority rule from a broader scope overrides it with an exclude action</LI> <LI>A recent matcher, source, or deployment change did not break the match</LI> </UL> <P>Avoid broadening a matcher just to make one test source appear. Confirm the intended policy and scope first.</P> <HR /> <H3>Step 7: Validate with a unique record</H3> <OL> <LI>Write the unique test string to the source (e.g., <CODE>DT-TEST-1234</CODE>).</LI> <LI>Record the source timestamp and timezone.</LI> <LI>Wait for the next Log module polling cycle.</LI> <LI>Search for the unique string in the <STRONG>Logs app</STRONG>.</LI> <LI>Filter by the affected host, workload, or available source attributes.</LI> <LI>Confirm the record's timestamp and source attributes match what you expect.</LI> </OL> <HR /> <H3>Step 8: If the source is covered but the record is still missing</H3> <P>If coverage is confirmed but records still don't appear, continue based on the observed symptom:</P> <TABLE> <THEAD> <TR> <TH class="lia-align-center"><FONT size="2">Symptom</FONT></TH> <TH class="lia-align-center"><FONT size="2">Next step</FONT></TH> </TR> </THEAD> <TBODY> <TR> <TD>Unhealthy component or source status event</TD> <TD><A href="https://community.dynatrace.com/t5/tkb/workflowpage/tkb-id/troubleshooting/article-id/1188" target="_blank" rel="noopener noreferrer">My logs went silent&nbsp; where do I start?</A></TD> </TR> <TR> <TD>Records arrive but with a delay</TD> <TD><A href="https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-log-ingest-delay-in-Log-module/ta-p/300190" target="_blank" rel="noopener noreferrer">Troubleshooting Log Ingest Delay in Log Module</A></TD> </TR> <TR> <TD>Rotation-related gaps or duplicates</TD> <TD><A href="https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-log-rotation-issues-in-Log-Module/ta-p/300207" target="_blank" rel="noopener noreferrer">Troubleshooting Log Rotation Issues in Log Module</A></TD> </TR> <TR> <TD>Timestamp or boundary issues</TD> <TD><A href="https://community.dynatrace.com/t5/Troubleshooting/Timestamps-in-Logs-with-OneAgent-1-313/ta-p/281611" target="_blank" rel="noopener noreferrer">Timestamps in Logs with OneAgent 1.313+</A></TD> </TR> <TR> <TD>Records visible but content, attributes, or timestamps are wrong</TD> <TD><A href="https://community.dynatrace.com/t5/tkb/workflowpage/tkb-id/troubleshooting/article-id/1190?prePageCrumb=TkbDashboardPage" target="_blank" rel="noopener noreferrer">What do log ingest warnings on my records mean?</A></TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>&nbsp;</P> <H2>What's next</H2> <P>&nbsp;</P> <UL> <LI><EM><STRONG>Opening a support case&nbsp; with below details</STRONG></EM><EM><BR /><BR /></EM> <UL> <LI>Exact or sanitized source path or source name</LI> <LI>Affected host, host group, Kubernetes cluster, namespace, or workload</LI> <LI>Confirmation that the source writes new records</LI> <LI>Screenshot or details from the <STRONG>Sources tab</STRONG> showing coverage state</LI> <LI>Applicable active and inherited rules with matchers and scopes</LI> <LI>SFM <CODE>log_source.status</CODE> query result for the affected source (if SFM is enabled)</LI> <LI>Sanitized sample record</LI> <LI>Unique-record search result (found / not found, with timestamp)</LI> <LI>Recent changes: application, deployment, permissions, file path, or Dynatrace configuration</LI> <LI>Applicable OneAgent version or Dynatrace Operator version</LI> </UL> </LI> </UL> <H2><BR />Related reading</H2> <UL> <LI><A href="https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-via-oa/lma-log-agent-sfm" target="_blank" rel="noopener noreferrer">Monitor log source health with SFM events</A></LI> <LI><A href="https://docs.dynatrace.com/docs/analyze-explore-automate/log-monitoring/lmc-troubleshooting/log-module-self-monitoring-events-classic" target="_blank" rel="noopener noreferrer">Log module self-monitoring events&nbsp; Log Monitoring Classic</A></LI> <LI><A href="https://community.dynatrace.com/t5/tkb/workflowpage/tkb-id/troubleshooting/article-id/1188" target="_blank" rel="noopener noreferrer">My logs went silent&nbsp; where do I start?</A></LI> <LI><A href="https://www.dynatrace.com/news/blog/modern-log-management-resilience-and-self-service-upgrades-for-log-ingestion/" target="_blank" rel="noopener noreferrer">Improve log ingest health with smarter log management</A></LI> <LI><A href="https://community.dynatrace.com/t5/Troubleshooting/Logs-Troubleshooting-Map/ta-p/302260" target="_blank" rel="noopener noreferrer">Dynatrace Logs Troubleshooting Map</A></LI> </UL> <P>&nbsp;</P> </DIV> Fri, 04 Sep 2026 06:49:42 GMT noel_david 2026-09-04T06:49:42Z https://community.dynatrace.com/t5/Troubleshooting/Log-source-not-detected-or-not-ingested-Troubleshoot-source/ta-p/303792 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H2>Summary</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.</EM></P> <P>&nbsp;</P> <H2>Problem</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&nbsp;important messages, errors, or information that will help the customer find this article when searching.</EM></P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P><EM>*This section can be omitted as necessary.</EM></P> <P><EM>Explain what troubleshooting steps should be taken to ensure the problem matches this article.</EM></P> <P>&nbsp;</P> <H2>Resolution</H2> <P><EM>*This section can be omitted for articles that guide customers on case creation.</EM></P> <P><EM>Explain the solution or all possible solutions resulting from the troubleshooting steps.<BR /><BR /></EM></P> <H2>What's next</H2> <P><EM>*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&nbsp;</EM></P> <P><EM>Explain what to do if the article didn't help.&nbsp;</EM><EM>Note that there are multiple options available, including:</EM></P> <OL> <LI><EM><STRONG>Opening a chat or support case&nbsp;</STRONG>- be as specific as possible about the information the customer should include in the case.&nbsp;</EM><EM>Use the following formula and fill or change the bullet points:<BR /><BR /></EM> If this article didn't help, <STRONG>create a chat or open a support case</STRONG> <UL> <LI>Mention that you reviewed this article.</LI> <LI>Include the following details: <UL> <LI>Link to XYZ</LI> <LI>Screenshot of XYZ</LI> <LI>Information about XYZ</LI> </UL> </LI> </UL> </LI> <LI><EM><STRONG>Suggesting Product Idea</STRONG> - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.<BR /></EM> <DIV>Please submit a Product Idea with detailed information about your request and use case in the Product Ideas forum. Our Product Management team regularly reviews these suggestions:</DIV> <A href="https://community.dynatrace.com/t5/Dynatrace-product-ideas/idb-p/DynatraceProductIdeas" target="_blank" rel="noopener">https://community.dynatrace.com/t5/Dynatrace-product-ideas/idb-p/DynatraceProductIdeas</A></LI> <LI><STRONG><EM>Explain this will change in the future </EM></STRONG><EM>- explain that this behavior will change in a future release. (No product idea / support case needed)</EM></LI> <LI><STRONG><EM>Alternatives -</EM></STRONG><EM>&nbsp;any other actions or links to other articles that could move the customer forward.</EM></LI> </OL> <H2><BR />Related reading</H2> <P><EM>*Link this article to other relevant configuration or troubleshooting guides, including any applicable troubleshooting maps.<BR />:open_book:&nbsp;&nbsp;</EM><A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_blank" rel="noopener">XXX Troubleshooting Map</A></P> <P>:open_book:&nbsp; Link 1</P> <P>:open_book:&nbsp; Link 2</P> <P>:open_book:&nbsp; Link 3</P> <P>:open_book:&nbsp; Link 4</P> </DIV> Fri, 04 Sep 2026 06:49:42 GMT https://community.dynatrace.com/t5/Troubleshooting/Log-source-not-detected-or-not-ingested-Troubleshoot-source/ta-p/303792 noel_david 2026-09-04T06:49:42Z