OneAgent doesn't communicate with ActiveGate

[Walter2]

Hi there,

A few weeks I found out that I was not receiving data from hosts without internet connections, and I discovered that all OA´s are communicating directly to my Saas environment(the ones that have internet connections).

PS: ActiveGate is up and in the same Network_Zone but I can´t find out the problem.

[MariusNicolae]

Hi,

Can you try to run a telnet command from the host with OA to the AG?

A simple 

telnet ${activeGateIP} 9999 

Can do the trick, if it hangs then your activegate is not reachable by the host where the oneagent is working. Do you know if there is a firewall between the oneagent and the activegate?

[Walter2]

Hi,

I ran the command:

telnet ${activeGateIP} 9999 

its shows that was unable to connect to remote host: Connection timed out

I´ll try to reach the Infra guy to open this port on our firewall to see if its work...

[Walter2]

Hi, @MariusNicolae i opened the port:9999 on my firewall and still the same!!! im out of option right now.

[MariusNicolae]

Hi Walter,

Can you confirm now that the telnet from the OA host is working?

Can you try to run

traceroute -T -p 9999 ipAG

And confirm if this is also working? Make sure that the connection is possible now and maybe try to restart the oneagent

[Walter2]

I did restart the one agent(oneagentctl --restart-service) before and still not working

traceroute to ipAG (ipAG), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

[MariusNicolae]

Hi Walter,

You need to use your activegate ip, not literally "ipAG"

Can you do that with your activegate ip?

Best regards.

[Walter2]

@MariusNicolae i used the AG ip adress, i just masked here with "ipAG" just to show what the result was!!!

[MariusNicolae]

Hi Walter,

Well in that case it doesn't look like the activegate is reachable by the host on port 9999/tcp, are you sure the communication from the host with oneagent to activegate on port 9999 in tcp is allowed by the network team?

[Walter2]

@MariusNicolae it worked before, after that we had a network problem from supplier, then few weeks ago i lost those connections from OA's to AG. Yesterday i asked the infra-team to enable port 9999 on our firewall and didn't fix.

[TomekRybczynski]

Hi @Walter2,

One of the possible reasons could be that OneAgent was installed before ActiveGate was available in the environment and after OneAgent lost internet access he could not have the connections endpoints list refreshed by the server.

Try to run oneagentctl --get-server on OneAgent that doesn't have a connection to the cluster to check if desired AcitiveGate is on the list of connection endpoints

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/oneagent-configura...

You can use oneagentctl --set-server to set the proper endpoint.

[Walter2]

Hi @TomekRybczynski 

I ran oneagentctl --get-server on OA's that doesn't have connections to the enviroment AG and the AG is on the list of each one (5 hosts).

[techean · Accepted solution]

Hi, could you please check the listening port services of active gate server. The best possible way would be take access of active gate server and run a net stat command to check the listening port for services. This will confirm if the active gate are up and running port no. Once thats is done you can perform a self curl -kv ip:port to verify the curl output. Similar output should be received at OA installed server.

[Walter2 · Accepted solution]

It Helped me to check the AG server firewall and added a new rule to enable entry connection on port 9999 and is working like a charm😅. Was focusing on something to complex, and end up to be something small... THANK YOU GUYS FOR THE HELP
@MariusNicolae @TomekRybczynski 

[Abidyaseen]

Hi,

curl -kv https://10.1.10.65:9999     got this output 

[sysadmin@fzcidt02va1p ~]$ curl -kv https://10.1.10.65:9999
*   Trying 10.1.10.65:9999...
* Connected to 10.1.10.65 (10.1.10.65) port 9999 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: O=Dynatrace; CN=ActiveGate
*  start date: Jul 17 08:39:49 2025 GMT
*  expire date: Jul 18 08:39:49 2035 GMT
*  issuer: O=Dynatrace; CN=ActiveGate
*  SSL certificate verify result: self-signed certificate (18), continuing anywa                                                                                                                                                             y.
* TLSv1.2 (OUT), TLS header, Unknown (23):
> GET / HTTP/1.1
> Host: 10.1.10.65:9999
> User-Agent: curl/7.76.1
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Unknown (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Date: Mon, 05 Jan 2026 10:55:10 GMT
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html;charset=iso-8859-1
< Content-Length: 105
<
<html>
<head><title>
Error: 404 Not Found</title></head>
<body>Error: 404 Not Found<br/>
</body>
</html>
* Connection #0 to host 10.1.10.65 left intact
[sysadmin@fzcidt02va1p ~]$  

sudo netstat -tulnp | grep 9999 this 

even tried to restart the activegate 

sudo systemctl restart dynatracegateway

but still the agents are not reporting through the said activegate 

[Julius_Loman]

@Abidyaseen in your case, ActiveGate is fine.
Check the OneAgent logs on the hosts and check if they know about the ActiveGate. One of the most obvious reasons for agents not visible in Dynatrace is when the host has been disabled in Dynatrace UI.
Another common reason is local firewall on the ActiveGate host (typically Linux distros such as RHEL block the 9999/tcp port in default setup). But if the curl is from your OneAgent host, this is not the case.

And do you see the Dynatrace ActiveGate in Dynatrace deployment status? If it's not connected, the endpoint does not propagate to OneAgents.