cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
ryan_korteway
Dynatrace Participant
Dynatrace Participant

Observed Behavior: Host disk is filling with logs or process core files following OneAgent install, update, or some other unknown cause

You begin to observe rapidly filling disks on your hosts after installing the OneAgent for the first time or after a OneAgent update.

 

Best first step

The best first step would be to stop process injection either using the oneagentctl tool or via the Dynatrace Web UI "Process Injection" toggle under "Host Settings" > "Host monitoring" page > "Advanced Settings" tab.

 

Background Info 

High disk space usage typically falls under two possible causes:

  • Process crashes being captured and preserved by the OneAgent for investigation (technically these files should be removed shortly after creation automatically and if they are not then that needs to be investigated), or
  • short lived processes are still being deeply monitored.

 

OneAgent code module logs are deleted automatically by the oneagentos process / oneagent host monitoring service so stopping the oneagent service stops the clean up logic BUT NOT the process injection. That will still be taking place but leading to inactive OneAgent Technology code modules. Additionally in this state the oneagent will not be able to provide logs remotely for support to investigate.

This is why disabling the process injection should be the first step compared to stopping the oneagent host service.

Doing so should stop any process crashes that could be related to the automatic injection logic and will help stop the creation of Oneagent code module logs if the high disk usage is coming from repeated log file creation by "Short lived" application processes that are still getting deeply monitored.

 

Additional Details:

The oneagentos process must be running on the host to collect a support archive via the oneagentctl tool so stopping the oneagent service before trying to use this tool will lead to failure.

If your issue is that the oneagentos process / service cannot start/ stay running and is leading to the creation of core or log files then manual collection of the oneagent logs from the necessary folders on the host would be needed instead.

 

Next Steps

If you require assistance in diagnosing which could be occurring on your host, process crashes or short lived processes generating too many OneAgent Code Module logs, then please open a Dynatrace Support ticket with the following information available:
1. The Host Name

2. A list of the files that are taking up space and their full path on the host

3. A link to the host you are or were able to see in Dynatrace so Support can then remotely collect a Support Archive.

4. If you have stopped the oneagent service completely, then briefly starting it again to then use the oneagentctl tool to collect a support archive to provide to the case would be needed instead.

 

Helpful links:

Details on collecting a support archive are explained on this page https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/oneagent-configura...

Details on disabling process injection via the oneagentctl can be found on this page: https://docs.dynatrace.com/docs/ingest-from/dynatrace-oneagent/oneagent-configuration-via-command-li...

Default location to find oneagent files on Windows: https://docs.dynatrace.com/docs/shortlink/oneagent-disk-requirements-windows#oneagent-directories-an... 

Default location to find oneagent files on Linux (while using a direct oneagent install to the nodes or Classic Full Stack Dynatrace Operator deployments): https://docs.dynatrace.com/docs/shortlink/oneagent-disk-requirements-linux#sizes 

Version history
Last update:
‎03 Feb 2025 03:16 PM
Updated by: