AWS S3 Log Forwarder troubleshooting guide

m_garwolinski — Mon, 12 Oct 2026 11:32:47 GMT

Summary

This article helps you troubleshoot the Dynatrace AWS S3 log forwarder that sends logs from Amazon S3 to Dynatrace. The forwarder is a serverless deployment (S3 → SQS → Lambda) placed in Customer AWS account.

There are two versions of the forwarder, and each has its own troubleshooting guide. This article helps you pick the right one.

dynatrace-aws-platform-monitoring-s3-log-forwarder - intended for environments using the new Dynatrace AWS Cloud Platform Monitoring.

dynatrace-aws-s3-log-forwarder - intended for environments using Dynatrace Classic for AWS cloud monitoring.

Problem

Your S3 log forwarder deployment fails, or logs from S3 don't show up in Dynatrace. You may see one of these symptoms:

CloudFormation stack creation fails (CREATE_FAILED, ROLLBACK_COMPLETE...).
The forwarder Lambda function logs show errors.
The forwarder Lambda function isn't invoked at all.

Troubleshooting steps

Identify which forwarder you deployed. The simplest way is to check the description of the main forwarder CloudFormation stack in AWS. The description also contains a link to the correct GitHub repository.

Resolution

Open the guide for your forwarder and go to the section that matches your symptom.

AWS Platform Monitoring forwarder: Troubleshooting guide

Classic forwarder: Troubleshooting guide

Both guides cover:

CloudFormation deployment failures.
Lambda errors and missing logs.
Dynatrace token issues.
Log processing rule misconfiguration.
Throttling, timeouts, and the dead letter queue.
Security vulnerabilities (CVEs).
General debugging tips.

What's next

If this article didn't help, create a chat or open a support case.

Mention that you reviewed this article and the troubleshooting guide for your forwarder.
Include the following details:
- Which forwarder you use (Platform Monitoring or Classic) and its version.
- The failed CloudFormation event (the "Likely root cause" status reason), if the deployment failed.
- The relevant Lambda log entries.
- The number of messages in the dead letter queue, if any.
- The type of logs you forward (for example ALB, VPC Flow, CloudTrail).