Diagnose Dynatrace OneAgent process group auto-detection failure in Service Flow

Recognizable condition

You open Dynatrace Service Flow and see services listed without a process group assignment, even though the underlying processes are clearly running. OneAgent logs display “Process group detection failed” and the services remain unmapped despite active workloads. This symptom typically signals that the OneAgent cannot read sufficient process metadata from the host operating system to match executables to defined process groups. Key terms: OneAgent is the Dynatrace monitoring agent installed on each host; process group is a logical collection of processes that share a common purpose or executable, used throughout Dynatrace for service mapping; Service Flow is the Dynatrace visualization that shows how services relate and depend on each other; dtuser is the default process user under which OneAgent runs, requiring specific OS-level permissions to inspect process details.

Diagnostic table: cause vs symptom

Symptom	Likely cause
Services unmapped in Service Flow	OneAgent process group auto-detection failed
OneAgent logs “Process group detection failed”	Insufficient read permissions on /proc (Linux) or process-list access (Windows)
Custom process group rules not applying	Rule priority overrides or excluded patterns
Issue appears on some hosts but not others	Inconsistent OneAgent restart or permission scope across a cluster

Ordered checks

1. Check OneAgent version and /proc permissions Where: On the affected host, as the dtuser process user. Command: dtmonitor --version. Required permissions: dtuser must have read access to the /proc filesystem on Linux or equivalent process-metadata exposure on Windows. On Linux, this means the dtuser account (or the group it belongs to) needs at least read-execute permissions on /proc directories corresponding to running processes. On Windows, the dtuser must possess SeDebugPrivilege or belong to the Administrators group for process enumeration. Expected check: The command returns a version string (e.g., 1.223.0.1). Compare this output against the Dynatrace LTS version matrix to confirm that the process-group auto-detection feature is supported in that release. Risk: Running the command as root may mask permission gaps; always verify as dtuser to reproduce the actual detection path that the agent uses. If the command fails with “permission denied” or returns no output as dtuser, proceed to adjust OS-level access before continuing.

2. Review Dynatrace Process Group rules Where: Settings > Process Groups in the Dynatrace web UI. Check: Examine the list of custom process group rules. For each rule, verify that the include pattern matches the actual executable names of the services in question, that the executables are not listed in any exclude section, and that no higher-priority rule is silently overriding auto-detection. Custom process group rules with higher priority can override the auto-detection logic, leading to unexpected service‑mapping gaps. Pay attention to rule order: rules are evaluated top‑to‑bottom, and the first matching rule wins. If a custom rule matches but uses an action that excludes the process from auto-detection, the service will appear without a group. Risk: Changing rule order without subsequently restarting OneAgent may propagate inconsistently across a Dynatrace cluster, especially in multi‑node environments where rule propagation can take up to five minutes.

3. Restart OneAgent or apply rule changes Where: On each host where OneAgent runs, as root (Linux) or administrator (Windows). Command: On Linux: systemctl restart dynatrace-oneagent; on Windows, restart the “Dynatrace Service” via Services MMC or sc restart DynatraceService. Expected check: After 2‑5 minutes, monitor the “Process group detection” status under Settings > Process Groups; the Last success timestamp should align with expected process activity for the services in question. If the timestamp updates and services now appear mapped, the issue is resolved. Risk: Repeated OneAgent restarts before cluster‑wide rule propagation completes can produce inconsistent Service Flow views across nodes. Allow the full propagation window before deciding whether further action is needed.

Fixes tied to findings

• Resolve permissions: On Linux, ensure the dtuser can read /proc directories. This often requires adjusting sysctl settings or, in containerized environments, adding the proc capability to the container security context. On Windows, grant the dtuser account SeDebugPrivilege via Group Policy, or run the OneAgent service under an account with process‑enumeration rights. After adjusting OS permissions, verify access by running ls -la /proc as dtuser (Linux) or using Process Monitor (Windows) to confirm no “Access denied” errors appear when enumerating process objects.
• Update rule set: Adjust Process Group include/exclude patterns to match the actual executable names of the services you are monitoring. If using wildcard patterns, test them against a known-running process executable first. Verify rule priority order so that auto-detection is not silently superseded by a custom rule that matches but excludes or renames the group. After editing rules, save and note the timestamp of the change.
• Restart OneAgent: After permission or rule changes, restart the OneAgent service as described in Check 3. This ensures the agent re‑reads both the updated OS permissions and the new rule configuration.

Limitations and practical way to check the result

Rule changes may take up to five minutes to propagate across the Dynatrace cluster; during this window, different nodes may show varying Service Flow states. Permission fixes on multi‑node clusters require a OneAgent restart on each host; omitting a restart on one node will result in inconsistent Service Flow coverage. To practically verify resolution, follow these steps:

1. Check the Process Group detection status under Settings > Process Groups; confirm that the Last success timestamp is recent and corresponds to a period of expected process activity.
2. Run a shell command as dtuser to list detected processes and compare executable names with the services you expect to see mapped. On Linux, ps -eo pid,user,cmd | grep dtpipe filtered for the dtuser can show which processes the agent currently sees; on Windows, use wmic process list full in an elevated command prompt filtered by the dtuser context.
3. Validate that no “Process group detection failed” messages appear in the OneAgent logs (/var/log/dynatrace/oneagent/oneagent.log on Linux, %ProgramData%\dynatrace\oneagent\log\oneagent.log on Windows) for the affected services over a 10‑minute observation window.

If all three checks pass—timestamp updates, executable visibility as dtuser, and no fresh error logs—the auto-detection failure is considered resolved.

Escalation criteria

Engage Dynatrace Level‑2 support if the “Process group detection” status does not show a successful Last success timestamp within 10 minutes after a OneAgent restart, or if the issue recurs across multiple hosts despite identical configurations. When opening a support ticket, provide:

• The OneAgent version output from dtmonitor --version as dtuser.
• A relevant Process Group rule export (JSON or UI screenshot) showing include/exclude patterns and rule order.
• Host‑level permission audit logs, such as the output of ls -la /proc as dtuser on Linux or a Process Monitor capture on Windows showing the dtuser’s access attempts to process metadata.

Support can investigate whether the root cause involves kernel‑level restrictions, container runtime security policies, or Dynatrace platform‑wide configuration issues.