Troubleshooting NAM ICMP monitors showing CONSTRAINT_VIOLATED 0% of packets

[HannahM]

Summary

Troubleshoot Network Availability Monitoring (NAM) ICMP monitors reporting 0% availability or CONSTRAINT_VIOLATED due to 0% packets. Learn how to reproduce ICMP checks from the ActiveGate, validate permissions, compare routing paths, and identify issues such as non‑root user restrictions, interface mismatch, MTU (Maximum Transmission Unit) problems, or ICMP rate limits.

• Summary
• Problem
• Troubleshooting steps
• Run an on-demand execution
• Reproduce ICMP checks from the ActiveGate
• Check which route & interface are used
• Resolution
• What's next
• Related reading

Problem

Network Availability Monitoring (NAM) ICMP monitor shows 0% availability / CONSTRAINT_VIOLATED due to missing packets.

Goal: Verify if ActiveGate ↔ target host connectivity, user permissions, or routing used by Dynatrace differ from what the customer is testing.

Troubleshooting steps

Run an on-demand execution

Check if the behavior is still occurring by running an on-demand execution.

Reproduce ICMP checks from the ActiveGate

Run these commands directly on the ActiveGate host (important: not from your workstation).

1. Run with root (or equivalent) user

ping -c 1 -s 32 -t 64 -4 -M do -W 1 -i 0.2 <TARGET_IP>

If this occasionally fails, increase the count to rule out one‑off packet loss:

ping -c 20 -s 32 -t 64 -4 -M do -W 1 -i 0.2 <TARGET_IP>

👉 Interpretation

• 100% success → basic network connectivity from the AG is fine.
• Intermittent loss / high RTT / timeouts → likely a real network/latency issue; NAM result may be correct.
• Consistent failures → focus on routing, firewall/ACLs, MTU/fragmentation, or ICMP rate limits.

 

2. Run as the Dynatrace ActiveGate user

Dynatrace doesn’t run pings as root, so you may need to mimic how the AG actually executes ICMP checks.

sudo -H -u dtuserag bash -c 'ping -c 20 -s 32 -t 64 -4 -M do -W 1 -i 0.2 <TARGET_IP>'

(Replace dtuserag with the real ActiveGate service user if it's different.)

👉 Why this matters

• Non‑root user may have:
  • Different capabilities (e.g. missing CAP_NET_RAW / permission to send raw ICMP packets)
  • Different network namespace, route tables, or firewall zones
  • Different limits enforced by security tools/agents

If the root ping works but the dtuserag ping fails → that explains why NAM shows 0% availability / CONSTRAINT_VIOLATED. You'll need to allow the dtuserag user access to the endpoint.

 

3. Run the checks for a longer period

If the failures are intermittent, you'll need to run the check from step 2 at regular intervals over a longer period. You could do this manually or create a job to do this. 

Check which route & interface are used

Sometimes manual ping tests are via one path, but the ActiveGate uses another NIC, VLAN, or routing rule.

From the ActiveGate:

ip route get <TARGET_IP>

Example output:

<TARGET_IP> via 10.10.10.1 dev eth1 src 10.10.10.20
cache

Key things to note:

• dev ethX – which interface is used
• src – which source IP is used
• via – the gateway

 

Resolution

1. Different source IP / interface
   • ActiveGate uses another NIC, VLAN, or IP that the firewall doesn’t allow.
   • Fix: update firewall rules for the AG’s source IP and interface as shown by ip route get.
2. Non‑root user restrictions
   • dtuserag (or equivalent) doesn’t have permission to send ICMP echo requests.
   • Fix: adjust permissions
3. ICMP rate limits or throttling
   • Network devices (firewalls, load balancers, routers) may rate limit ICMP.
   • NAM ICMP monitor may send pings at a frequency that triggers the limit, while ad‑hoc manual ping does not.
   • Fix: adjust rate limits or reduce synthetic frequency.
4. Path MTU / fragmentation issues
   • The use of -M do (don’t fragment) can surface MTU issues.
   • Manual ping without -M do may work, while NAM‑equivalent ping fails.
   • Fix: review MTU along the path; adjust network or monitor settings.
5. IPv4 vs IPv6 differences
   • ICMPv4 allowed, ICMPv6 blocked, or vice versa.
   • Fix: ensure NAM config & network policy align on protocol.
6. Security agents on the ActiveGate host
   • Host‑based firewall, IDS, or endpoint security may block non‑root ICMP from the Dynatrace user.

What's next

If the above steps didn't resolve the issue, open a chat and provide a link to the monitor, along with details of the troubleshooting steps you have already completed.

Related reading

📖  Synthetic Troubleshooting Map

📖  Create a NAM monitor 

📖  NAM monitor results reporting