To fully automate the monitoring of your operating systems, processes, and network interfaces, Dynatrace requires privileged access to your operating system during installation and operation.
OneAgent is tested extensively to ensure that it has minimal performance impact on your system and conforms to the highest security standards.
During installation, OneAgent requires root privileges for:
- Installing OneAgent components in system library directories.
- Setting up
/etc/ld.so.preloadto automatically monitor processes.
- Adapting SELinux policies to allow for the monitoring of processes.
If you have Log Monitoring enabled, root privileges are also required for:
- Creating the Dynatrace Log Monitoring OneAgent configuration file, which stores security flags (for example, log content access and log auto-detection) and rules that define files that should be treated as log files (based on file extension and location).
During operation, OneAgent requires root privileges to:
- Access the list of open sockets for each process.
- Access the list of libraries loaded for each process.
- Access the name and path of the executable file for each process.
- Access command-line parameters for each process.
- Monitor network traffic.
- Read application configuration files.
- Parse executables for Go Discovery.
- Gather monitoring data related to Docker containers.
If you have Log Monitoring enabled, root privileges are also required for:
- Accessing system logs:
- Accessing the list of open file handlers for each process (
- Accessing the log file for each process.
System logs downloaded by OneAgent
OneAgent downloads specific system logs so that Dynatrace can diagnose issues that may be caused by conditions in your environment. Most often such issues are related to deep monitoring or auto-update installations.
/bin/journalctl -t auditd command
To revoke access to Linux system logs, use the
oneagentctl command-line interface with the
--set-system-log-content-access parameter set to
For more information, see OneAgent configuration via command-line interface
Linux non-privileged mode
You can install OneAgent in non-privileged mode, in which superuser privileges are used once to initiate the installation process.
OneAgent is then run under an unprivileged user, retaining the complete set of functionalities.
See OneAgent installation on Linux to learn how to enable non-privileged mode during OneAgent installation.
To install OneAgent in non-privileged mode, your system must meet the following requirements:
- The filesystem must support extended attributes.
- The system must have
libcap2installed. For example, the default Red Hat Enterprise Linux 5 installation doesn't have
- The filesystem must not be mounted as
- Linux Filesystem Capabilities must be enabled. For example, SUSE Linux Enterprise Server 11 has Linux Filesystem Capabilities disabled by default. For more information, see Non-privileged mode and Linux Filesystem Capabilities below.
If your system doesn't meet all of the above requirements, the installer ignores the
NON_ROOT_MODE=1 parameter and installs OneAgent in standard mode.
When run in non-privileged mode, the OneAgent installer requires superuser privileges to:
- Set file capabilities for OneAgent binaries located at
- Invoke the
oneagentservice script to start
- On systems with systemd, communicate with systemd daemon via d-bus to run the following commands:
systemctl <start|stop|enable|disable> oneagent.service
- On systems with SysV, execute
/sbin/chkconfigto add the
oneagentservice script to autostart or to remove it.
- Write to
Superuser privileges are dropped when the Dynatrace OneAgent service script is executed:
- On systems with systemd, the unprivileged user is included in the service definition (unit file). The systemd daemon thus runs the OneAgent service script in unprivileged mode.
- On systems with SysV, the privileges are dropped in the script when starting the OneAgent Watchdog process.
Dynatrace OneAgent Watchdog starts and runs all other processes under an unprivileged user without superuser access. OneAgent binaries leverage the following Linux System Capabilities.
|Binary||Linux System Capabilities|
|OneAgent Installer executed during auto-update||
1 Required only during initialization phase and is unconditionally dropped afterwards.
2 Kept in permitted set only and raised to the effective set when needed.
3 Only if ambient capabilities aren't supported.
4 Only if ambient capabilities are supported.
5 Only on kernels older than 2.6.33.
Automatic updates and operation
The scope of privileges required by OneAgent depends on whether the kernel supports Linux ambient capabilities. As a general rule, kernel 4.3+ supports ambient capabilities. However, in the case of Red Hat Enterprise Linux, these may be supported in older kernel versions because of the Red Hat policy to backport patches. This makes ambient capabilities supported by kernel versions as old as 3.10.x.
Kernels with ambient capabilities (version 4.3+)
During an automatic update, the installer starts under an unprivileged
dtuser with proper ambient capabilities set. OneAgent doesn't require root access to perform an automatic update.
Red Hat Enterprise Linux 7 has a too low
systemd (v219 instead of the required v221), and to be able to run automatic updates in non-privileged mode, we're temporarily elevating the privileges to run
systemctl <start|stop|enable|disable> oneagent.service.
Kernels without ambient capabilities (version 2.6.26 to 4.3)
OneAgent will work under the non-privileged
dtuser in the majority of cases. When the kernel doesn't provide ambient capabilities, it automatically elevates its privileges to the superuser level using
setuid(0) in the following cases:
- OneAgent automatic updates
- Host OSI ID generation on Azure hosts
- Docker containers properties detection
If you don't want to grant the superuser permission level to OneAgent, you can disable it by adding the
DISABLE_ROOT_FALLBACK=1 parameter to the OneAgent installation command. For example:
sudo /bin/sh Dynatrace-OneAgent-Linux-1.0.0.sh NON_ROOT_MODE=1 DISABLE_ROOT_FALLBACK=1
In such cases, you must perform manual updates on individual hosts. We don't recommend using the
DISABLE_ROOT_FALLBACK=1 parameter for OneAgents on Azure or Docker containers.
Non-privileged mode and Linux Filesystem Capabilities
Linux Filesystem Capabilities are required to install OneAgent in non-privileged mode. SUSE Linux Enterprise Server 11 has Linux Filesystem Capabilities disabled by default. These capabilities might also be disabled in other supported Linux distributions or as the result of a custom configuration. Since version 1.171, the OneAgent installer prints the following message if Linux Filesystem Capabilities are disabled:
Warning: Failed to enable non-privileged mode, kernel does not support file capabilities.
You can also check the kernel boot options to see if Linux Filesystem Capabilities are enabled. Run the following command to check your kernel boot options.
If you find
file_caps=1 in the output, your setup is fine.
To enable Linux Filesystem Capabilities, add
file_caps=1 to your kernel boot options. For example, on SUSE Linux Enterprise Server 11, use YaST, edit kernel boot options, add
file_caps=1, and reboot the machine.
How do I know if I've successfully enabled non-privileged mode?
The installer prints a message at the end of OneAgent installation. Depending on the kernel version and its support for ambient capabilities, you will see one of the following messages:
Non-privileged mode is enabled
The kernel supports ambient capabilities, the root access is not used for updates or operation.
Enabled non-privileged mode, but ambient capabilities are not supported by kernel
The kernel is within the minimum supported version, but due to non-supported ambient capabilities, OneAgent needs to elevate privileges in select cases, see above.
Failed to enable non-privileged mode
The kernel doesn't meet the minimum version requirements to enable non-privileged mode.
To learn more about Linux capabilities, refer to Linux man pages and chapter 39 of "The Linux Programming Interface."