Fixing Missing Azure Resource Logs: Troubleshooting Guide for Azure Native Dynatrace Integration

[Pawel-Siwek]

Summary

This guide provides troubleshooting steps to figure out why Azure resource logs are not appearing in Dynatrace when using the Azure Native Dynatrace service.

Problem

The Azure Native Dynatrace Service has been deployed to the Azure Portal, and log forwarding is enabled. However, Azure logs are not showing up in Dynatrace. There are several potential root causes for this issue.

Troubleshooting steps

1. Unsupported Resource Types

Some Azure resource types may not support Azure Monitor logs and therefore won't have Diagnostic Settings available. For example, a Managed Identity (Microsoft.ManagedIdentity/userAssignedIdentities) has a Monitoring blade, but it lacks the option for Diagnostic Settings.

The up-to-date list of supported resource types for Azure Monitor is available in the official Microsoft documentation, which you can find at the following link: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/resource-logs-schema. 

2. Tag Filtering Rules

The Azure Native Dynatrace Service may be configured to exclude certain resources based on its tag filtering rules. Double-check these rules to ensure the resources you expect to see logs for are not being filtered out.

3. Diagnostic Settings Limit

Azure Portal allows a maximum of five Diagnostic Settings per resource. If this limit is reached, the Azure Native Dynatrace Service cannot create an additional one, which prevents logs from being forwarded.

4. Read-Only Resource Locks

A resource may have a Read Only resource lock configured. In this case, Diagnostic Settings cannot be created or modified, which prevents Dynatrace from collecting logs.

5 . Azure Activity Logs for Specific Errors

For other Azure-specific errors, you can troubleshoot by reviewing Azure Activity logs. The following DQL query can help you find issues related to the creation of Diagnostic Settings:

fetch logs
| filter audit.action == "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE"
| parse content, "JSON:json"
| parse json[properties][statusMessage], "JSON:statusMessage"
| fieldsAdd statusCode=json[properties][statusCode], 
resultType=json[resultType],
eventCategory=json[properties][eventCategory],
resourceId=json[resourceId],
action=json[identity][authorization][action],
role=json[identity][authorization][evidence][role],
principalId=json[identity][authorization][evidence][principalId],
message = coalesce(statusMessage[error][message],statusMessage[message])
|fieldsKeep timestamp,message, action, resultType, eventCategory,statusCode,  resourceId, role, principalId

This query will help you identify any ongoing issues with the creation of Diagnostic Settings.

What's next

• Get familiar with the documentation: Review the official Dynatrace documentation for the Azure native integration at: https://docs.dynatrace.com/docs/ingest-from/microsoft-azure-services/azure-platform/azure-native-int....

• Open a support ticket: If you are still not getting Azure logs ingested into Dynatrace, consider opening a support ticket. Be sure to provide the following information:

  • The type of resource for which you are missing logs (e.g., microsoft.compute/virtualmachines).

  • Which Diagnostic Settings you have enabled.

  • The Azure resource ID for the Azure Native Dynatrace Service you are having a problem with.