This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Troubleshooting
Articles about how to solve the most common problems
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Community Home
- Platform
- Troubleshooting
- Logs Troubleshooting Map
Options
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Printer Friendly Page
noel_david
Dynatrace Advisor
Options
- Mark as New
- Subscribe to RSS Feed
- Permalink
29 Jul 2026 07:21 AM - edited 04 Sep 2026 09:25 AM
- Logs Troubleshooting Map
- How to use this map
- Step 1A — Logs that previously worked have stopped
- Step 1B — Source has never appeared in Dynatrace
- Step 1C — Source is visible but not ingesting records
- Step 1D — Log Monitoring is enabled but logs are still missing
- Step 2 — One ingestion method is affected
- Step 3 — Logs are delayed or only partially arriving
- Step 4 — Log volume changed unexpectedly
- Step 5 — Logs are visible but incorrect
- Step 6 — Log metric or event is not triggering
- Step 7 — Trace link missing from a log record
- Step 8 — Dynatrace Managed cluster warnings
- Before contacting Support
- Further Reading
Logs Troubleshooting Map
A decision-tree guide for troubleshooting log ingestion, source health, delays, volume, parsing, correlation, and alerting issues in Dynatrace.
First time here? Find your symptom in the table below and jump directly to the right section. No need to read top to bottom.
How to use this map
Find your symptom
| What you are seeing | Go to |
|---|---|
| Logs that worked before have suddenly stopped | Step 1A |
| A source has never appeared in Dynatrace | Step 1B |
| A source is visible but not ingesting records | Step 1C |
| Log Monitoring is enabled but still no logs | Step 1D |
| One ingestion method is affected (API, K8s, Azure, etc.) | Step 2 |
| Logs arrive late or only partially | Step 3 |
| Log volume increased or decreased unexpectedly | Step 4 |
| Logs are visible but content, attributes, or timestamps are wrong | Step 5 |
| A log metric or event is not triggering | Step 6 |
| Trace link missing from a log record | Step 7 |
| Dynatrace Managed cluster shows a log warning | Step 8 |
Step 1A — Logs that previously worked have stopped
Start here first: Open Dashboards → Log module self-monitoring and check the Currently active issues panel. The platform may have already identified the cause via a self-monitoring event (SFM event). Act on that before changing any configuration.
SFM events are available at OneAgent 1.339+ / SaaS 1.340+. Earlier versions require opt-in via the Settings API see Monitor log source health with SFM events.
My logs went silent — where do I start?
Covers: OneAgent Log Module unhealthy · Kubernetes Log Module unhealthy · ActiveGate health issue · SFM event reference · source coverage check · module restart behaviour
Step 1B — Source has never appeared in Dynatrace
Troubleshooting missing logs in Log module
Covers: path and permission checks · security rules · custom source configuration · SFM log_source.status query · global Log Monitoring toggle · app log content access flag
Step 1C — Source is visible but not ingesting records
Log source not detected or not ingested: Troubleshoot source discovery and ingest-rule coverage
Covers: Sources tab · ingest-rule coverage · matcher vs source name · active and inherited rule review · unique-record validation
Step 1D — Log Monitoring is enabled but logs are still missing
Work through these in order:
| Situation | Article |
|---|---|
| Initial setup never produced records on this host | Enable Log Visibility in Dynatrace |
| Enabled and monitored but records aren't visible | Why are logs still missing after enabling Log Monitoring? |
| Security rules may be blocking the path | Troubleshooting Missing Log Files Due to OneAgent Log Monitoring Security Rules |
| Server-side prerequisites (Logs Classic) | What might prevent logs from appearing on the server? |
| F5 Distributed Cloud WAAP intercepting communication | Logs Not Being Ingested Due to F5 Distributed Cloud WAAP |
Step 2 — One ingestion method is affected
Select the ingestion method:
Step 3 — Logs are delayed or only partially arriving
| Situation | Article |
|---|---|
| Records arrive late (including expected ~90s Kubernetes baseline) | Troubleshooting log ingest delay in Log module |
| Ingest endpoint returns HTTP 429 | Dynatrace does not ingest logs: HTTP 429 |
| ActiveGate extension buffer or persistence full | Logs Not Arriving from ActiveGate Extensions: Log Persistence Full |
| Multiple sources via one ActiveGate affected | Check Ingest components health in Log module self-monitoring dashboard → ActiveGate sizing for Kubernetes |
Step 4 — Log volume changed unexpectedly
Both volume spikes and drops use the same starting article.
Log volume spiked overnight where is it coming from?
Covers: Top log producers · OpenPipeline self-monitoring metrics · ingest-rule scope review · volume decrease investigation · preventive alerting
Step 5 — Logs are visible but incorrect
Quick check before parsing investigation: Run
fetch logs | filter isNotNull(dt.ingest.warnings) | summarize count(), by:{dt.ingest.warnings, log.source} | limit 100— if warnings are present, start with the ingest warnings article, not the parsing article.
Step 6 — Log metric or event is not triggering
| Situation | Article |
|---|---|
| Log-based metric shows no data | Dynatrace Log Monitoring: Metric Shows No Data |
| Problem opens against the wrong entity | How to Change Impacted Entity for a Log-Based Event or Problem |
Step 7 — Trace link missing from a log record
Why I Can't See Traces in Log View Page
Step 8 — Dynatrace Managed cluster warnings
| Warning message | Article |
|---|---|
Log ingest queue is full |
Log Ingest Queue Is Full: Dynatrace Managed |
Ingested log data is trimmed |
Ingested Log Data Is Trimmed: Dynatrace Managed |
Before contacting Support
Collect the following before opening a ticket:
- When the issue started and the timezone used
- Affected host, host group, cluster, namespace, workload, or source path
- Screenshot from the Log module self-monitoring dashboard — Currently active issues panel
- SFM event type, severity, and any source or entity context
- Source coverage state from the Sources tab
- Active and inherited ingest rules with matchers and scopes
- Sanitised sample record and result of a unique-record search
dt.ingest.warningsDQL result (if records are visible but incorrect)- Recent changes — application, permissions, deployment, or Dynatrace configuration
- OneAgent, ActiveGate, Operator, or collector version
Do not include credentials, access tokens, personal data, or unmasked log content.
Further Reading
