<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>article Syslog Ingestion Troubleshooting. in Troubleshooting</title>
    <link>https://community.dynatrace.com/t5/Troubleshooting/Syslog-Ingestion-Troubleshooting/ta-p/264112</link>
    <description>&lt;P&gt;This article shows the common issues and fixes for issues with ingestion of Syslog into Dynatrace via ActiveGate.&lt;BR /&gt;Make sure you have followed the steps on the page below.&lt;/P&gt;
&lt;P&gt;&lt;A href="https://docs.dynatrace.com/docs/shortlink/lma-ingestion-syslog#enable-syslog-ingestion" target="_blank" rel="noopener"&gt;https://docs.dynatrace.com/docs/shortlink/lma-ingestion-syslog#enable-syslog-ingestion&lt;/A&gt;&lt;/P&gt;
&lt;P&gt;The logs will be visible in the below location&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="python"&gt;/var/lib/dynatrace/remotepluginmodule/log/extensions/datasources/otelSyslog/dynatraceotelcollector.log&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Case 1&lt;/H2&gt;
&lt;P&gt;If you see the warning below in the log:&lt;/P&gt;
&lt;LI-CODE lang="python"&gt;[otelSyslog][otelSyslog][147494][err]Error: cannot start pipelines: start stanza: failed to listen on interface: failed to configure tcp listener: listen tcp 0.0.0.0:601: bind: permission denied
[otelSyslog][otelSyslog][147494][err]2024/10/10 16:59:09 collector server run finished with error: cannot start pipelines: start stanza: failed to listen on interface: failed to configure tcp listener: listen tcp 0.0.0.0:601: bind: permission denied&lt;/LI-CODE&gt;
&lt;P&gt;If the filesystem mountpoint is using the ‘nosuid’ option.&amp;nbsp;We need to remove the&amp;nbsp;nosuid&amp;nbsp;option from&amp;nbsp;/opt&amp;nbsp;. If&amp;nbsp;SELinux&amp;nbsp; is there, please disable it.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Case 2&lt;/H2&gt;
&lt;P&gt;If you see the warning below in the log:&lt;/P&gt;
&lt;LI-CODE lang="python"&gt;[otelSyslog][otelSyslog][126924][err]Error: cannot start pipelines: start stanza: failed to open connection: listen udp 0.0.0.0:514: bind: address already in use
[otelSyslog][otelSyslog][126924][err]2024/11/20 12:36:46 collector server run finished with error: cannot start pipelines: start stanza: failed to open connection: listen udp 0.0.0.0:514: bind: address already in use
[otelSyslog][otelSyslog][129642][err]2024-11-20T13:36:49.760+0100 info service@v0.99.0/service.go:99 Setting up own telemetry…
[otelSyslog][otelSyslog][129642][err]2024-11-20T13:36:49.760+0100 info service@v0.99.0/service.go:140 Skipped telemetry setup. {"address": ":8888", "level": "None"}&lt;/LI-CODE&gt;
&lt;P&gt;This means port 514 is already used by something else on the system, so it cannot be bound twice. Either change the port configuration or kill the process already occupying this port.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Case3&lt;/H2&gt;
&lt;P&gt;If you see the warning below in the log:&lt;/P&gt;
&lt;LI-CODE lang="python"&gt;[otelSyslog][otelSyslog][68537][err]2024-11-22T17:01:39.689+0100 error helper/transformer.go:101 Failed to process entry {"kind": "receiver", "name": "syslog/udp", "data_type": "logs", "operator_id": "syslog_input_internal_parser", "operator_type": "syslog_parser", "error": "expecting a version value in the range 1-999 [col 4]", "action": "send"}&lt;/LI-CODE&gt;
&lt;P&gt;Adjust the configuration as described here (Syslog ingestion)&lt;BR /&gt;Set the used protocol to rfc3164&lt;/P&gt;
&lt;P&gt;&lt;STRONG&gt;Example:&lt;/STRONG&gt;&lt;/P&gt;
&lt;LI-CODE lang="python"&gt;receivers:
  syslog/udp:
    udp:
      listen_address: '0.0.0.0:514'
      add_attributes: true
    protocol: rfc3164
    operators:
      - type: syslog_parser
        protocol: rfc3164&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Case 4&lt;/H2&gt;
&lt;P&gt;If you see the warning below in the log:&lt;/P&gt;
&lt;LI-CODE lang="python"&gt;[otelSyslog][otelSyslog][2579615][err]2024-10-24T13:01:00.269Z error helper/transformer.go:101 Failed to process entry {"kind": "receiver", "name": "syslog/tcp", "data_type": "logs", "operator_id": "syslog_parser", "operator_type": "syslog_parser", "error": "expecting a priority value within angle brackets [col 0]", "action": "send"}&lt;/LI-CODE&gt;
&lt;P&gt;This can occur if you send a syslog message without a pre-header.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Case 5&lt;/H2&gt;
&lt;LI-CODE lang="python"&gt;2026-07-15 06:55:21.041 UTC [****] warning [native] EECStatusContainer - new EEC status inserted: LOG_PERSISTENCE_FULL - Log persistence full, rejecting logs.&lt;/LI-CODE&gt;
&lt;P&gt;When the persistence reaches its storage limit, the EEC can no longer accept new log records and begins rejecting them. This results in log data gaps in Dynatrace.&lt;/P&gt;
&lt;P&gt;The persistence is located at:&lt;/P&gt;
&lt;DIV&gt;Windows&lt;/DIV&gt;
&lt;DIV&gt;&lt;LI-CODE lang="python"&gt;%PROGRAMDATA%\dynatrace\remotepluginmodule\agent\runtime\extensions\persistence​&lt;/LI-CODE&gt;&lt;/DIV&gt;
&lt;DIV&gt;Linux&lt;/DIV&gt;
&lt;DIV&gt;&lt;LI-CODE lang="python"&gt;/var/lib/dynatrace/remotepluginmodule/agent/runtime/extensions/persistence&lt;/LI-CODE&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;P&gt;By default, this directory is capped at&amp;nbsp;&lt;STRONG&gt;600 MB&lt;/STRONG&gt;. The full reliability mechanism also requires an additional buffer of&amp;nbsp;&lt;STRONG&gt;1.5GB&lt;/STRONG&gt;, meaning a minimum of&amp;nbsp;&lt;STRONG&gt;2100 MB of total free disk space&lt;/STRONG&gt;&amp;nbsp;is required on the host at default settings.&lt;/P&gt;
&lt;P&gt;If the host has sufficient free disk space, increase the maximum persistence volume by editing the EEC configuration file.&lt;/P&gt;
&lt;P&gt;Configuration file location:&lt;/P&gt;
&lt;DIV&gt;
&lt;DIV&gt;Windows&amp;nbsp;&lt;/DIV&gt;
&lt;DIV&gt;&lt;LI-CODE lang="python"&gt;C:\ProgramData\dynatrace\remotepluginmodule\agent\conf\extensionsuser.conf​​&lt;/LI-CODE&gt;&lt;/DIV&gt;
&lt;DIV&gt;Linux&lt;/DIV&gt;
&lt;DIV&gt;&lt;LI-CODE lang="python"&gt;/var/lib/dynatrace/remotepluginmodule/agent/conf/extensionsuser.conf&lt;/LI-CODE&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;P&gt;Add or update the following property (value is in kilobytes):&lt;/P&gt;
&lt;PRE&gt;&lt;CODE&gt;persistence.total_limit_kb = 614400
&lt;/CODE&gt;&lt;/PRE&gt;
&lt;P&gt;The default value is&amp;nbsp;&lt;CODE&gt;614400&lt;/CODE&gt;&amp;nbsp;(600 MB). Increase it to a value your disk can support.&lt;/P&gt;
&lt;H2&gt;Case 6&lt;/H2&gt;
&lt;LI-CODE lang="python"&gt;2026-07-15 06:55:21.043 UTC [*****] warning [native] HttpSession::onRead. Request failed HTTP/1.1 401 Unauthorized&lt;/LI-CODE&gt;
&lt;P&gt;&lt;SPAN&gt;This can happen when in the&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;custom config parameter&amp;nbsp;&lt;CODE&gt;extension_controller&lt;/CODE&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;is set to false,&amp;nbsp; change to true and restart the AG this will be fixed.&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 22 Jul 2026 07:02:48 GMT</pubDate>
    <dc:creator>noel_david</dc:creator>
    <dc:date>2026-07-22T07:02:48Z</dc:date>
    <item>
      <title>Syslog Ingestion Troubleshooting.</title>
      <link>https://community.dynatrace.com/t5/Troubleshooting/Syslog-Ingestion-Troubleshooting/ta-p/264112</link>
      <description>&lt;P&gt;&lt;LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"&gt;&lt;/LI-TOC&gt;&lt;/P&gt;
&lt;DIV class="lia-message-template-content-zone"&gt;
&lt;P&gt;*&lt;EM&gt;Use a table of contents for longer articles.&amp;nbsp;&lt;/EM&gt;&lt;/P&gt;
&lt;H2&gt;Summary&lt;/H2&gt;
&lt;P&gt;&lt;EM&gt;*This is a mandatory section.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&lt;EM&gt;Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Problem&lt;/H2&gt;
&lt;P&gt;&lt;EM&gt;*This is a mandatory section.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&lt;EM&gt;Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&amp;nbsp;important messages, errors, or information that will help the customer find this article when searching.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Troubleshooting steps&lt;/H2&gt;
&lt;P&gt;&lt;EM&gt;*This section can be omitted as necessary.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&lt;EM&gt;Explain what troubleshooting steps should be taken to ensure the problem matches this article.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;H2&gt;Resolution&lt;/H2&gt;
&lt;P&gt;&lt;EM&gt;*This section can be omitted for articles that guide customers on ticket creation.&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&lt;EM&gt;Explain the solution or all possible solutions resulting from the troubleshooting steps.&lt;BR /&gt;&lt;BR /&gt;&lt;/EM&gt;&lt;/P&gt;
&lt;H2&gt;What's next&lt;/H2&gt;
&lt;P&gt;&lt;EM&gt;*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&amp;nbsp;&lt;/EM&gt;&lt;/P&gt;
&lt;P&gt;&lt;EM&gt;Explain what to do if the article did not help.&amp;nbsp;&lt;/EM&gt;&lt;EM&gt;Note that there are multiple options available, including:&lt;/EM&gt;&lt;/P&gt;
&lt;OL&gt;
&lt;LI&gt;&lt;EM&gt;&lt;STRONG&gt;Opening a support ticket&lt;/STRONG&gt; - be as specific as possible about the information the customer should include in the ticket.&amp;nbsp;&lt;/EM&gt; If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket:
&lt;UL&gt;
&lt;LI&gt;link to XYZ&lt;/LI&gt;
&lt;LI&gt;screenshot of XYZ&lt;/LI&gt;
&lt;LI&gt;information about XYZ&lt;/LI&gt;
&lt;/UL&gt;
&lt;/LI&gt;
&lt;LI&gt;&lt;EM&gt;&lt;STRONG&gt;Suggesting Product Idea&lt;/STRONG&gt; - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.&lt;/EM&gt;&lt;/LI&gt;
&lt;LI&gt;&lt;EM&gt;&lt;STRONG&gt;Explain this will change in the future&lt;/STRONG&gt; - explain that this behaviour will change in a future release. (No product idea / support ticket needed)&lt;/EM&gt;&lt;/LI&gt;
&lt;LI&gt;&lt;EM&gt;&lt;STRONG&gt;Alternatives -&lt;/STRONG&gt;&amp;nbsp;any other actions or links to other articles that could move the customer forward.&lt;/EM&gt;&lt;/LI&gt;
&lt;/OL&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;EM&gt;*If it exists, link this article to the relevant troubleshooting map using the following guideline&lt;/EM&gt;&lt;/P&gt;
&lt;H3&gt;More articles can be found on the &lt;A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_self"&gt;XXX Troubleshooting Map&lt;/A&gt;&lt;/H3&gt;
&lt;/DIV&gt;</description>
      <pubDate>Wed, 22 Jul 2026 07:02:48 GMT</pubDate>
      <guid>https://community.dynatrace.com/t5/Troubleshooting/Syslog-Ingestion-Troubleshooting/ta-p/264112</guid>
      <dc:creator>noel_david</dc:creator>
      <dc:date>2026-07-22T07:02:48Z</dc:date>
    </item>
  </channel>
</rss>

