How to change impacted entity for log based event / problem

[darya-ramashko]

Abstract

Even though Dynatrace platform tries to identify the most relevant monitored entity to report log based event sometimes its behavior does not match your expectations and problems raised based on reported events are visible on monitored entity that you do not prefer. 

Problem

Log based events have one main monitored entity considered as impacted and that is the monitored entity where problems will be visible and Dynatrace tries to identify this entity as precisely as possible. The impacted entity for log event in majority of cases matches dt.source_entity attribute value of log record. But there are cases when you could possibly prefer to adjust the default behavior, for example:

• Dynatrace tries to identify most granular entity (like process) but you need to have event reported on higher level entity (like host);

• Dynatrace finds several potential impacted entities and dt.source_entity attribute contains array of entity ids and by default the first one will be used to report event.

Troubleshooting steps

To check impacted entity for a problem check Problems application:

or Problems Classic application:

If you are not satisfied with entity presented there, take a look on logs related to the problem ("Logs" tab for problem in Problems application or "Analyze logs" link in Problems Classic application) to check if there are other entities available in log record in dt.source_entity attribute or in any dt.entity.* attributes.

Resolution

⚠️ Below steps are applicable starting from version 1.313.0 on both managed and SaaS deployments.

Add property in event template to override dt.source_entity attribute with preferred value. It is strongly recommended to use a placeholder for another attribute presented in log record that contains entity id you would prefer, for example:

• {dt.entity.host} - contains id of the host entity from where the log came from
• {dt.entity.sql:sql_server_instance} - contains id of the entity created for extension of Microsoft SQL Server

It could be done in settings for Classic events (Settings > Log Monitoring > Events extraction) :

or for Davis events in OpenPipeline ("Data Extraction" stage > "Davis event" processor) :

With this configuration change all new log events matching the template should be reported on the entity defined in the template properties.

What's next

If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket:

• for managed deployment
  • screenshot of the event template configured
  • screenshot of the problem reported
  • screenshot of problem related logs or exported logs in json/csv
    
• for SaaS deployment
  • link to the event template configured / event extraction configuration in OpenPipeline
  • link to the problem reported
  • screenshot of problem related logs or exported logs in json/csv