Troubleshooting log rotation issues in Log Module

Kacper · ‎02 Jun 2026

Summary

This article helps you troubleshoot log rotation issues that prevent Log module from correctly ingesting your log files. It applies to Log module deployed via OneAgent or Dynatrace Operator on both SaaS and Managed environments, and covers file-based logs on Linux and Windows.

Problem

Logs from a rotated file are missing, duplicated, or only partially ingested. Common symptoms include:

Rotated files exist on disk but are not ingested by Log module.
The active log file is ingested, but gaps appear at every rotation boundary.
Rotated files are ingested, but the currently active log file is missing.
The tail of a log file is missing at rotation boundaries (the last lines before rotation are absent).
The same log content appears twice in Dynatrace after rotation.

Is your rotation scenario supported?

Use the table below to check whether the rotation behavior you're seeing is supported. If your scenario is listed as unsupported, jump to the corresponding section for guidance or a workaround.

Scenario	Support
Index-based rotation (`.1`, `.2`, …)	✅ Supported
Rename-and-replace	✅ Supported
Copy-and-truncate	✅ Supported (content must not be deleted before the agent reads it)
Rotation identifier in filename (date, counter, GUID with separator)	✅ Supported
Fast rotation on CRI-O	✅ Supported
Rotation with directory change	❌ Not supported
Immediate compression after rotation	❌ Not supported
Queue logic (fixed-size file, oldest content removed)	❌ Not supported
Unrecognized rotation identifier	❌ Not detected

Resolution

Custom log source path pattern misconfiguration

Symptoms

Rotated files exist on disk but are not ingested by Log module.
The active log file is ingested, but gaps appear at every rotation boundary.
Or the reverse: rotated files are ingested, but the currently active log file is missing.

Cause

The custom log source path does not match both the active file and its rotated counterparts. The most common mistake is placing an extra separator character (such as .) before the # wildcard. That separator exists in the rotated filename but not in the active filename, so the pattern matches only one of them.

Example

Files on disk:

Active: /var/log/app/test.log
Rotated: /var/log/app/test.2026.05.07.log

Configured path	Matches `test.log`	Matches `test.2026.05.07.log`	Result
`/var/log/app/test.log`	✅	❌	Active file only; rotated files missed
`/var/log/app/test.#.log`	❌	✅	Rotated files only; active file missed
`/var/log/app/test#.log`	✅	✅	Both active and rotated files ingested

Resolution

In Settings > Collect and capture > Log Monitoring > Custom log sources, update the custom log source path to remove the separator between the static part of the filename and the # placeholder:

Before: /var/log/app/test.#.log
After: /var/log/app/test#.log

Changes propagate to the agent within approximately 90 seconds. New rotated files are picked up at the next rotation scan (every 5 minutes for custom log sources).

Rotation with a directory change

Symptoms

The active log file is monitored correctly, but rotated files in a subdirectory or archive folder are not ingested.
Occasionally, the same log content appears twice (duplicate records in Dynatrace).

Cause (brief)

The Log Module does not follow files that are moved across directory boundaries during rotation. When a rotation tool moves a rotated file to a different directory, Log module loses track of it. Depending on timing, this can result in either data loss or duplicate ingestion.

Resolution

Configure your rotation tool to keep all rotated files in the same directory as the active log file.

Immediate compression after rotation

Symptoms

The first rotated file (for example, app.log.1.gz) appears in the directory, but its content is not ingested.
Logs from the period immediately before rotation are missing.
All subsequent rotated files (.2, .3, …) also show no ingestion because they are also compressed.

Cause (brief)

Log Module cannot read compressed files. This is a known limitation.

Workaround

Configure your rotation tool to delay compression. Keep rotated files in their uncompressed form long enough for Log module to read them before compression occurs.

File deleted before Log module reads all content

Symptoms

The tail of a log file is missing at rotation boundaries (the last lines before rotation are absent).
The issue occurs specifically with copy-and-truncate rotation, where the copied file is deleted shortly after it's created.
On Kubernetes: a Log Module restart combined with fast container log rotation causes the last line of a rotated file to be dropped.

Cause (brief)

If a file is deleted before Log module finishes reading it, the remaining content is lost. This affects:

Copy-and-truncate rotation, where the rotation script deletes the copied file quickly.
Application restarts that remove and recreate the log file before the agent reads the pre-restart tail.
Fast container log rotation coinciding with a Log Module restart.

Current status

This is a known limitation. An improvement is tracked in the product backlog but is not yet available.

Workaround

Try any of the following:

Increase the delay between file deletion and the next rotation step. For example, add a short sleep in your post-rotation script before cleanup.
For application restarts, ensure the application flushes its log buffer before exiting, so all content is written before rotation.
Reduce the rotation frequency so the agent has more time to read the file before it is removed.

Queue-style log sources

Symptoms

The log file size remains approximately constant; old records are continuously overwritten.
Dynatrace shows repeated or shuffled log content from the same source.
Very old timestamps appear in newly ingested records.

Cause

Some applications use a circular-buffer approach: the log file has a fixed maximum size, and the oldest content is removed in place as new content is appended. This rotation model is fundamentally not supported by Log Module.

Workaround

There is no workaround that restores full support for queue-style sources. Consider one of the following:

If your application supports an alternative logging mode (for example, standard append-only files with external rotation), switch to that.
Use the Dynatrace API or an OpenTelemetry Collector to ingest these logs via a custom exporter that handles the circular-buffer semantics.

What's next

For missing logs unrelated to rotation, see Troubleshooting missing logs.
For ingest delay, see Troubleshooting log ingest delay.
For multi-line entries split incorrectly or grouped together, see Troubleshooting log record boundary detection.
For JSON-specific parsing issues, see Troubleshooting JSON log parsing.