Summary
This article applies to Dynatrace Log Monitoring with OneAgent and helps troubleshoot situations where a log file is expected to appear in Dynatrace but is not being ingested. It specifically covers cases where OneAgent Log Monitoring security rules prevent a file from being collected and explains how to use the Dynatrace Log Security Rules Checker to validate and resolve the issue.
Problem
A log file is configured or expected to be monitored by OneAgent, but the log does not appear in Dynatrace.
Common symptoms include:
- The log file is present on the host and actively receiving data.
- No matching log records are visible in Dynatrace.
- No obvious ingestion errors are displayed in the Dynatrace UI.
- The affected file may be located in a directory that is not covered by the default OneAgent security rules or may match an exclusion rule.
OneAgent Log Monitoring uses built-in security rules to ensure that only appropriate log files are ingested. These rules are designed to prevent accidental collection of configuration files, secrets, and other non-log content. When a file path is blocked by these rules, the file will not be ingested.
Troubleshooting steps
Validate the file path
Before proceeding, ensure that you have:
- The absolute file path of the log file.
- All symbolic links resolved.
- The installed OneAgent version.
- Python 3 available on your workstation.
Clone the Log Security Rules Checker repository:
git clone https://github.com/Dynatrace/Dynatrace-Log-Security-Rules-Checker.git
cd Dynatrace-Log-Security-Rules-Checker
Check the path against the default OneAgent rules
Run the following command:
python3 LogAgentSecurityRulesChecker.py -a <agent_version> -o linux <absolute_path>
Example:
python3 LogAgentSecurityRulesChecker.py -a 1.301 -o linux /usr/sap/BQH/HDB03/cssbq3d01/trace/available.log
Review the result:
- INCLUDED – The file is allowed by the security rules and should be eligible for ingestion.
- EXCLUDED – Continue to the next step.
Identify the exact matching rule
Run the checker in verbose mode:
python3 LogAgentSecurityRulesChecker.py -a <agent_version> -o linux <absolute_path> -v
The output identifies the specific security rule responsible for the exclusion.
Example:
Try to match rule { ^/usr/**/**{ * }{ EXCLUDE }**o { /usr/sap/BQH/HDB03/cssbq**01/trace/ }{ available.log }
**- directory**art MATCHED, file part MATCHED --**the rule is matched.
'/usr**ap/BQH/HDB03**ssbq3d01/trace/available.log' is **CLUDED.
Check if a newer OneAgent version resolves the issue
Run the checker without specifying a OneAgent version:
python3 LogAgentSecurityRul**Checker.py -o linux <absolute_pat** -v
This tests the path against the newest known security rule set.
Review the result:
- INCLUDED – Upgrading OneAgent to the corresponding version or later may resolve the issue.
- EXCLUDED – Continue to the resolution steps.
Resolution
Generate a custom security rules configuration
If the file remains excluded and an upgrade is not possible or does not resolve the issue, generate a custom configuration:
python3 LogAgentSecurityRu**sChecker.py -a <agent_version> -o**inux <absolute_path> -g custom_co**ig.json -v
This creates a custom_config.json file containing an INCLUDE rule for the target path. The generated configuration also includes support for common log rotation filename variations.
Validate the generated configuration
Before deployment, verify that the custom configuration allows the file:
python3 LogAgentSecurity**lesChecker.py -a <agent_version> ** linux <absolute_path> -c custom_**nfig.json -v
Confirm that the output reports:
INCLUDED**
Deploy the custom configuration
- Copy the validated
custom_config.json file to the target OneAgent host.
- Place the configuration in the location specified by the Dynatrace security rules documentation.
- Restart OneAgent if required by the operating system and deployment method.
- Verify that the log file is subsequently ingested and visible in Dynatrace.
Additional checker options
| Option |
Description |
-i paths.txt |
Validate multiple paths from a file |
-n |
Skip online version checks |
-o windows |
Test Windows security rules |
--help |
Display all available options |
Important notes
- Always test using the absolute path.
- Resolve all symbolic links before validation.
- Custom security rules supplement the default rules and do not replace them.
- Security rules evolve over time, so testing against newer OneAgent versions may identify a version where the path is already permitted.
What's next
If this article didn't resolve the issue, please open a support ticket and mention that you followed the troubleshooting steps described here.
Opening a support ticket
Include the following information:
- Full absolute path of the affected log file.
- OneAgent version.
- Operating system and version.
-
Output from:
python3 LogAgentSecurity**lesChecker.py -a <agent_version> ** <os> <path> -v
- Generated
custom_config.json file (if applicable).
- Screenshots showing:
- Log Monitoring configuration.
- Log viewer searches used to verify missing data.
- Confirmation whether testing against the latest known rule set resulted in INCLUDED or EXCLUDED.
- Any custom OneAgent security rule configurations currently in use.
