Container platform monitoring - Openshift - No logs are ingested

[zhenglong]

Hello all,

Problem: No logs are ingested

Our team followed the steps on the page below:

Get started with Full Kubernetes observability (cloud-native full-stack deployment) — Dynatrace Mana...

Configuration:

Dynatrace Managed 1.336.99

Dynakube - dynatrace.com/v1beta6

spec.logMonitoring: {}

The logs from ruxitagent_host shows:

URL https://<URL>/communication not working (SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19))

DispatcherPeriodicMessageCenter::sendHeartbeatMessage: Heartbeat failed: requesting reconnect...

We observed the same configuration worked for Kubernetes but not for Openshift. We would really appreciate any ideas where to troubleshoot?

Regards,

Zhenglong

[t_pawlak]

Hi Zhenglong,

Based on the log message, I would first focus on the TLS/certificate trust issue rather than on logMonitoring itself:

SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)

For Dynatrace Managed with a self-signed or private CA certificate, the DynaKube configuration must either trust the Managed CA certificate or disable Dynatrace SSL certificate verification. The Dynatrace installation guide also mentions this option specifically for Dynatrace Managed with self-signed certificates.

I would check the following:

Verify whether SSL verification was disabled/generated correctly in the DynaKube YAML, or configure the proper CA certificate via DynaKube.
Check DynaKube status and pod status:

oc get dynakube -n dynatrace
oc get pods -n dynatrace
oc describe dynakube <dynakube-name> -n dynatrace

Check whether OpenShift-specific requirements are fulfilled, especially SCC/CSI driver configuration. Dynatrace documentation states that OpenShift requires SCC configuration for deployments using the Operator CSI driver, including cloudNativeFullStack.
Validate logs from OneAgent, ActiveGate, Operator and log-monitoring components.
Confirm that log ingest rules in Dynatrace allow Kubernetes/OpenShift container logs.

So in this case, the most likely root cause is that the OneAgent/log module on OpenShift cannot establish a trusted HTTPS connection to the Dynatrace Managed endpoint because the Managed certificate chain is not trusted.