Dynatrace will update internal communication endpoints after June 30, 2021.
The domain used for internal communication by ActiveGates and OneAgents that send data to Dynatrace SaaS will be changed from *.live.ruxit.com
to *.live.dynatrace.com
.
In a typical scenario, this change will be completely transparent and no manual action is required.
This change might affect Dynatrace SaaS customers if one of the following is true:
If you use domain allowlisting on outbound proxies, or AWS PrivateLink to connect your OneAgents to Dynatrace:
If you use domain allowlisting on your proxy, adjust your configuration.
If you limit your outbound traffic on your proxy or firewall to only allowlisted domains, most likely you have rules that would permit connections to:
*.live.ruxit.com
or sg-*.live.ruxit.com
sg-us-east-X-XX-XXX-XXX-XXX-yyyyXX-virginia.live.ruxit.com
<environment_id>.live.dynatrace.com
If you have such rules in place, make sure to also permit domains with the suffix live.dynatrace.com
.
Starting June 30, 2021, OneAgents and ActiveGates will no longer be able to connect to the Dynatrace direct public endpoints. They will switch to your environment domain (<environment_id>.live.dynatrace.com
) as a fallback. They will still periodically test the connectivity to more direct endpoints, which may result in error entries in log files of OneAgent, ActiveGate, and possibly your proxy server.
In the unlikely event that your <environment_id>.live.dynatrace.com
domain is blocked as well, you may be completely disconnected from Dynatrace service until your proxy configuration is corrected.
For the operation of Dynatrace, there must be connectivity to at least the environment domain. Many Dynatrace services rely on connectivity to the environment domain.
live.dynatrace.com
?You should update your allowlisting rules at the soonest. You don’t have to wait for the switch to happen. Make sure you still leave live.ruxit.com
allowlisting until June 30, 2021.
Adjust your configuration. If you use AWS PrivateLink to connect your OneAgent traffic to Dynatrace, you most likely have a DNS override for *.live.ruxit.com
domains.
Make sure you also have a domain override for your environment domain: <environment_id>.live.dynatrace.com
For details on how to configure the override, see AWS PrivateLink.
Starting with June 30, 2021, all OneAgents will stop using PrivateLink due to the domain change. OneAgents may be able to connect to Dynatrace via the internet, but will not use PrivateLink. Depending on your network configuration, this could also result in OneAgents not being able to communicate with Dynatrace at all.
Adding the required DNS override will allow OneAgents to report to Dynatrace via PrivateLink.
You can update your PrivateLink configuration at the soonest. You don’t have to wait for the switch to happen. Make sure to leave live.ruxit.com
override until June 30, 2021.
Verify the connection. If you are uncertain whether this change could affect you, you can test the connectivity from your hosts currently connecting to Dynatrace.
Verify connectivity for your environment domain:
curl –Is https://<environment_id>.live.dynatrace.com/communication`
You should get a response similar to this:
HTTP/1.1 204 No Content
If this domain is not reachable for any of your environments, please adjust your proxy configuration.
You then should also test connectivity to the more direct endpoints used internally, such as:
curl -Is https://sg-us-east-X-XX-XXX-XXX-XXX-yyyXX-virginia.live.dynatrace.com/communication
If the connection is failing, please review your configuration. It may be blocked by a proxy.
You may need to use the URL that is used by your environment instead of the URL in the example above. The list of communication endpoints can be found in the ActiveGate configuration file cluster.properties
. For more information regarding ActiveGate configuration files, see ActiveGate directories.