Log management and analytics is used for troubleshooting and monitoring your applications.
This section contains generic audit log information.
Query audit logs in Grail.
fetch logs | filter isNotNull(audit.action)
Categorization and information on the audit log.
| Attribute | Type | Description | Examples |
|---|---|---|---|
audit.action | string | stable Display name: Audit actionAudited action. | Access to Azure Resource Manager; New User Created; User added to Group |
audit.identity | string | stable Display name: Audit identityUser name, service account name, or principal name that executes audited action. | name.surname@example.com |
audit.result | string | stable Display name: Audit resultResult of the audited action. | Succeeded; Failed |
audit.status | string | stable Display name: Audit statusStatus of the audited action. | Started; In Progress; Succeeded; Failed; Active; Resolved |
audit.time | timestamp | experimental Display name: Audit timeTimestamp of the audited action. | 16/01/2025, 10:34 AM |
authentication.is_multifactor | boolean | experimental Display name: Is multifactor authenticationReports whether the executant of the audited action has performed a multi-factor authentication. | |
content | string | stable Display name: ContentUnstructured content of the record. It should contain a human-readable message. Often it is the raw version of a record read from a source. | No keepalive from datasource statsd. Restarting |
event.type | string | stable Display name: Event typeThe unique type identifier of a given event. Tags: permission | LOG |
log.record.uid | string | experimental Unique identifier of the log record. Records sharing the same uid are considered duplicates and may be safely deduplicated. Two distinct log records MUST have different uid values. When logs are ingested from an external tool, this attribute will hold the original vendor log ID. | c42dbd31-17b5-4270-b1a7-824a52e0d0e9 |
log.source | string | stable Display name: Log sourceHuman-readable attribute that identifies a log stream. 1 Tags: permission | /var/log/messages; Windows Event Log; Docker Container Output; stdout |
loglevel | string | stable Display name: Log levelThe log event severity level. | ERROR; INFO; TRACE |
status | string | experimental Display name: StatusOverall significance of log event, derived from log level. Only INFO and NONE values are allowed. | INFO; NONE |
timestamp | timestamp | stable Display name: TimestampTime (UNIX Epoch time in nanoseconds) when the event originated, typically when the event was ingested into Dynatrace. | 1649822520123123123 |
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).
Information about the audited action result.
| Attribute | Type | Description | Examples |
|---|---|---|---|
result.code | long | experimental Display name: Result codeError code associated with the result. | 0; 50126; 400 |
result.detail | string | experimental Display name: Result detailFurther details regarding the result. | The user did not enter the right credentials |
result.message | string | experimental Display name: Result messageBrief message attached to the result. | User created successfully; Error validating credentials due to invalid username or password. |
Information about the client app used by the identity to perform the audit action.
| Attribute | Type | Description | Examples |
|---|---|---|---|
client.app.name | string | experimental Display name: Client app nameThe name of the client application used to perform the request. | MS Outlook |
client.ip | ipAddress | experimental Display name: Client IP addressThe IP address of the client that makes the request. This can be IPv4 or IPv6. Tags: sensitive-spans sensitive-user-events | 194.232.104.141; 2a01:468:1000:9::140 |
Information regarding the actor who peformed the audited action.
| Attribute | Type | Description | Examples |
|---|---|---|---|
actor.geo.city.name | string | experimental Display name: Actor city nameName of the city from which the actor operates. | Rome |
actor.geo.country.name | string | experimental Display name: Actor country nameName of the country from which the actor operates. | Canada |
actor.geo.location.lat | string | experimental Display name: Actor geo latitudeThe approximate WGS84 latitude. | 45.505918 |
actor.geo.location.lon | string | experimental Display name: Actor geo longitudeThe approximate WGS84 longitude. | -73.614830 |
actor.ips | ipAddress[] | stable Display name: Actor IP addressesList of the client's IP addresses (IPv4 or IPv6) from which the actor operates. | [168.10.15.23, 2a01:468:1000:9::140] |
Information regarding the device used by the identity peforming the audited action.
| Attribute | Type | Description | Examples |
|---|---|---|---|
browser.name | string | resource stable Display name: Browser nameThe browser name. | Chrome |
browser.version | string | resource stable Display name: Browser versionThe browser version. | Version 142.0.7444.176 |
device.id | string | experimental Display name: Device IDGUID that uniquely identifies the device which is used to perform the audited action. | 11c1add1-612a-483d-8b24-cccbb35d3306 |
device.name | string | experimental Display name: Device nameThe name associated with the device which is used to perform the audited action. | DEVICE-HOFW9324FJN |
device.os.name | string | experimental Display name: Device OS nameHuman-readable operating system name. | MacOs; Windows |
The cloud provider information (if any) associated with the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
cloud.provider | string | resource stable Display name: Cloud providerName of the cloud provider. | alibaba_cloud |
The Azure tenant information (if any) associated with the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
azure.tenant.id | string | resource experimental Display name: Azure tenant IDUnique, immutable identifier assigned to the Azure tenant. | 37c4add3-612a-483d-8b24-cccbb35d3306 |
azure.tenant.name | string | resource experimental Display name: Azure tenant nameName assigned to the Azure tenant. | MyAzureTenant |
The AWS account (if any) associated with the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
aws.account.id | string | resource stable Display name: AWS account IDThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: permission primary-field | 123456789012 |
aws.account.name | string | resource experimental Display name: AWS account nameName associated with the AWS account. | example.com |
The GCP organization (if any) associated with the audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
gcp.organization.id | string | resource experimental Display name: GCP organization IDUnique, immutable identifier assigned to an organization resource. | 123456789012 |
gcp.organization.name | string | resource experimental Display name: GCP organization nameName assigned to the GCP organization. | dynatrace.com |
This section contains general log information. There can be additional records added both resource attributes describing source as well as log record attributes to add structured log record data.
Query logs in Grail.
fetch logs
The log module, in certain situations, may associate multiple process group instances with a single log.
This can occur when more than one process group instance opens a file in write mode or if there are multiple
process group instances in a single container. In such cases, the
dt.entity.process_group_instance and dt.entity.process_group
may be reported as arrays. To prepare queries for such situations, use matchesValue
instead of == for equality checks.
| Attribute | Type | Description | Examples |
|---|---|---|---|
content | string | stable Display name: ContentUnstructured content of the record. It should contain a human-readable message. Often it is the raw version of a record read from a source. | No keepalive from datasource statsd. Restarting |
dt.entity.process_group | string | resource deprecatedThis field is deprecated and will be removed in the future. Use dt.process_group.id or dt.process_group.detected_name instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so dt.process_group.id exists only for compatibility. Preferably use dt.process_group.detected_name to identify process groups.Display name: Process groupThe entity ID of the process group that has emitted the log. Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use matchesValue instead of == for equality checks.Tags: entity-id | PROCESS_GROUP-E0D8F94D9065F24F |
dt.entity.process_group_instance | string | resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.process instead.Display name: Process group instanceThe entity ID of the process group that has emitted the log. Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use matchesValue instead of == for equality checks.Tags: entity-id | PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F |
dt.source_entity | string[] | resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.Display name: Source entityThe entity IDs of the log's source. Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use matchesValue instead of == for equality checks. 1Tags: entity-id | ['PROCESS_GROUP_INSTANCE-22714B95E4BF6AE0', 'PROCESS_GROUP_INSTANCE-D6DD5FF37FBEF0DF'] |
event.type | string | stable Display name: Event typeThe unique type identifier of a given event. Tags: permission | LOG |
log.iostream | string | stable Display name: Log I/O streamThe I/O stream to which the log was emitted. | stdout; stderr |
log.record.uid | string | experimental Unique identifier of the log record. Records sharing the same uid are considered duplicates and may be safely deduplicated. Two distinct log records MUST have different uid values. When logs are ingested from an external tool, this attribute will hold the original vendor log ID. | c42dbd31-17b5-4270-b1a7-824a52e0d0e9 |
log.source | string | stable Display name: Log sourceHuman-readable attribute that identifies a log stream. 2 Tags: permission | /var/log/messages; Windows Event Log; Docker Container Output; stdout |
loglevel | string | stable Display name: Log levelThe log event severity level. | ERROR; INFO; TRACE |
ordinal | long | stable The field is used to order records produced by a single source. It is monotonically increasing across successive records, but the step between values is unspecified. The field encodes only a local (source‑specific) ordering, not a global one, so it is typically used as a secondary sort key after the timestamp to preserve the original sequence when timestamp resolution is insufficient. Examples include a byte offset within the source file or the __SEQNUM field in systemd‑journald. | 1479670 |
process.technology | string[] | stable Display name: Process technologyTechnologies detected for the process. | ['Java', 'Tomcat']; ['Go', 'Envoy'] |
span_id | string | experimental Display name: Span IDA unique identifier for a span within a trace. The span_id is an 8-byte id and hex-encoded if shown as a string. | f76281848bd8288c |
status | string | experimental Display name: StatusOverall significance of log event, derived from log level. Only INFO, WARN, ERROR and NONE values are allowed. | ERROR; WARN; INFO; NONE |
timestamp | timestamp | stable Display name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
trace_id | string | experimental Display name: Trace IDA unique identifier for a trace. The trace_id is a 16-byte id and hex-encoded if shown as a string. | 357bf70f3c617cb34584b31bd4616af8 |
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).