*Use a table of contents for longer articles.
Self Service Summary
The dtuserag account is a local, unprivileged Linux user created by the Dynatrace ActiveGate installer to run its services securely. While it cannot be used for direct login, it has access to specific configuration directories with restricted permissions that typically require root access.
Security teams may raise concerns because this account operates outside standard user management workflows and may not be visible in centralized monitoring. Additionally, the operating system must support high resource limits for this user, at least 500,000 open files and 20,000 processes, to ensure proper functionality. These requirements may trigger alerts or scrutiny during audits or vulnerability scans.
| Issue |
Solution |
Tasks |
Alternatives |
Security team flagged dtuserag for elevated permissions or lack of visibility |
Explain that dtuserag is a dedicated unprivileged local Linux user created by the ActiveGate installer - See below for more information. |
Share official documentation and explain to your Security team. |
Submit a support ticket if you need additional details or you face a different scenario |
Explanation
The dtuserag account is a service account used by Dynatrace ActiveGate on Linux systems.
According to Dynatrace documentation: https://docs.dynatrace.com/managed/shortlink/activegate-default-settings-linux#service-account
“All ActiveGate services are by default running as dedicated unprivileged user dtuserag. The only exception is dynatraceautoupdater, which requires root privileges. If the user dtuserag does not already exist in the system, the installer will create it.”
This account is not intended for interactive login or administrative tasks. It exists solely to run ActiveGate services securely and with minimal privileges. The dynatraceautoupdater component may require elevated privileges during installation or updates. You will find all the services related to ActiveGate in this documentation: https://docs.dynatrace.com/managed/shortlink/activegate-default-settings-linux#services
Recommendations
- Share the official documentation with your security team.
- Confirm that
dtuserag is used only by ActiveGate services and not for manual operations.
- Please reach out to Dynatrace Support for further clarification or other scenarios.
When opening a support ticket, please mention that this article was used and provide the following in the ticket:
