2.2 ActiveGate Capabilities: Proxying, Private Synthetic, Cloud Integrations & Extensions

2.2 ActiveGate Capabilities: Proxying, Private Synthetic, Cloud Integrations & Extensions

While an ActiveGate's primary function in network design is routing telemetry, it is architecturally structured as a modular host platform that executes multiple specialized background subsystems. In Dynatrace terminology, these modular subsystems are known as ActiveGate Capabilities (or modules). Depending on operational needs, an administrator can configure an ActiveGate instance to fulfill one or more specific roles.

On the Dynatrace Certified Associate exam, candidates must understand what each capability does, where it should be placed in an enterprise network, its hardware resource implications, and how to configure it.

---

Modular Subsystems of ActiveGate

An ActiveGate can run the following modular capabilities:

1. Routing and Telemetry Aggregation (OneAgent Proxying): Buffering, compressing, and proxying PurePath traces, metrics, logs, and events.
2. Memory Dump Offloading: Storing diagnostic heap and thread dumps locally on disk.
3. Private Synthetic Monitoring Engine: Executing synthetic HTTP monitors and full headless browser clickpaths against internal endpoints.
4. Virtualization Monitoring (VMware vCenter / ESXi): Agentlessly discovering hypervisor topology and polling ESXi performance metrics.
5. Cloud Platform Monitoring: Polling cloud provider monitoring APIs (AWS CloudWatch, Azure Monitor, Google Cloud Operations).
6. Extensions 2.0 Execution (Extension Execution Controller - EEC): Remotely polling targets via SNMP, WMI, Prometheus, and SQL database queries.
7. Log Ingestion & OpenTelemetry Gateway: Ingesting OTLP telemetry and local/remote syslog streams.

---

Capability 1: Traffic Proxying, Aggregation & Memory Dump Offloading

Telemetry Aggregation and WAN Optimization

The routing capability is enabled by default upon ActiveGate installation. It terminates incoming TLS connections from OneAgents, parses message envelopes, strips network overhead, aggregates timeseries data into batched payloads, and applies high-ratio compression before transmitting the data upstream over port 443. This reduces bandwidth overhead by up to 70% and prevents external network interfaces from being overwhelmed by thousands of concurrent persistent connections.

Disk Spooling and Network Resilience

If the upstream network link between an ActiveGate and the Dynatrace Cluster fails or experiences severe degradation, the ActiveGate does not drop telemetry immediately. Instead, it activates its disk spooling buffer:

• Inbound telemetry from OneAgents is written to a temporary spool directory on the ActiveGate host's local filesystem (/var/lib/dynatrace/gateway/temp on Linux or %PROGRAMDATA%\dynatrace\gateway\temp on Windows).
• Once upstream connectivity to the Dynatrace Cluster is restored, the ActiveGate drains the spool buffer in chronological sequence while continuing to process real-time incoming streams.
• This buffer ensures zero telemetry loss during transient network disconnects or scheduled cluster maintenance windows.

Memory Dump Storage Offloading

When troubleshooting complex production memory leaks or thread deadlocks, developers and operations teams can trigger on-demand heap dumps or thread dumps directly from the Dynatrace web UI for Java, .NET, or Node.js processes. Generating a 4 GB heap dump on a production application host and transferring it across a WAN to Dynatrace SaaS could saturate production interfaces.

To prevent this, the ActiveGate serves as a local diagnostic repository:

• The OneAgent transfers the raw dump file locally across the LAN to the designated Environment ActiveGate.
• The ActiveGate stores the dump file in its local directory (/var/lib/dynatrace/gateway/dump on Linux).
• Authorized engineers can download the dump file directly from the ActiveGate via the Dynatrace UI or REST API, keeping heavy diagnostic network traffic isolated from critical application uplinks.

---

Capability 2: Private Synthetic Monitoring

Dynatrace offers both Public Synthetic Locations (managed by Dynatrace across global cloud regions) and Private Synthetic Locations (deployed by customers within their internal infrastructure). Private Synthetic locations allow enterprises to monitor internal web applications, core banking portals, intranet sites, and internal microservice APIs that reside behind corporate firewalls and are completely inaccessible from the public internet.

Synthetic Execution Modules

A Private Synthetic ActiveGate runs two distinct execution engines:

1. Synthetic HTTP Engine: Executes lightweight single-step and multi-step HTTP requests. It validates API response codes, checks TLS handshake timings, asserts payload JSON/XML properties, and calculates HTTP response metrics. This engine has a minimal CPU and memory footprint.
2. Synthetic Browser Engine (Headless Chromium): Executes full browser clickpaths that simulate end-user transactions. The engine launches an actual headless Chromium browser process that renders HTML/CSS, executes complex client-side JavaScript, navigates DOM elements, captures full-page screenshots on failure, and measures end-user performance metrics (Visually Complete, Speed Index, User Action Duration).

Architectural Sizing & The Dedicated ActiveGate Rule

Because headless Chromium instances consume substantial CPU cycles and memory during page rendering and script execution, running concurrent browser clickpaths places severe demands on the underlying operating system.

[!CAUTION] Critical Exam Rule: Dedicated ActiveGates for Browser Synthetic. Dynatrace strongly recommends deploying dedicated Environment ActiveGates exclusively for Private Synthetic Browser monitoring. Co-locating Browser Synthetic workloads on an ActiveGate that also handles traffic aggregation for hundreds of OneAgents or polls heavy VMware clusters will lead to CPU starvation, socket exhaustion, and dropped OneAgent metrics.

Resource Sizing for Private Synthetic:

• HTTP Monitors Only: 2 to 4 vCPUs, 4 GB RAM.
• Browser Monitors (Chromium): Minimum 4 to 8 vCPUs, 8 to 16 GB RAM, and dedicated high-speed SSD storage. On Linux, specific operating system dependencies (such as Xvfb, libX11, GConf2, nss, and font libraries) must be installed to support the headless browser engine.
• Private Synthetic Location Pools: Multiple Private Synthetic ActiveGates can be assigned to a single Private Synthetic Location. Dynatrace automatically distributes scheduled synthetic executions across the ActiveGates in the pool, ensuring high availability and execution redundancy.

---

Capability 3: Cloud & Virtualization Integrations

Many infrastructure components do not support running host agents—most notably hypervisor appliances, managed cloud databases, and serverless infrastructure. ActiveGates bridge this gap through agentless remote API polling.

VMware vCenter / ESXi Monitoring

Dynatrace monitors VMware virtual infrastructure agentlessly via an Environment ActiveGate:

• The ActiveGate connects directly to the VMware vCenter Server API over HTTPS (port 443) using a read-only service account.
• It collects hypervisor inventory, ESXi host hardware utilization (CPU, memory, power), datastore capacity, read/write IOPS, storage latency, and VM provisioning state.
• Topology Mapping: The Dynatrace Smartscape engine automatically stitches together the VMware hypervisor topology discovered by the ActiveGate with the internal process and service topology discovered by OneAgents running inside the guest virtual machines.

Cloud Platform Monitoring (AWS, Azure, GCP)

For cloud environments, an ActiveGate deployed within a cloud VPC or on-premise datacenter connects to cloud management APIs:

• AWS Integration: Connects to AWS CloudWatch APIs (or ingests AWS Metric Streams via Kinesis Firehose) to capture metrics for Amazon RDS, DynamoDB, S3, Elasticache, and API Gateway.
• Azure Integration: Connects to the Azure Monitor REST API via an Azure App Registration / Service Principal to collect metrics and resource health across Azure subscriptions.
• Google Cloud Integration: Queries Google Cloud Monitoring APIs using a Google Cloud Service Account to monitor Google Compute Engine, Cloud SQL, and Google Kubernetes Engine (GKE).

---

Capability 4: Extensions 2.0 & Extension Execution Controller (EEC)

Dynatrace Extensions 2.0 enables monitoring of third-party network devices, legacy applications, and specialized hardware. The ActiveGate hosts the Extension Execution Controller (EEC), which acts as the execution runtime for remote extensions:

• SNMP Monitoring (v1, v2c, v3): The ActiveGate polls network switches, routers, load balancers, and firewalls for MIB/OID metrics and processes incoming SNMP traps.
• Prometheus Metric Scraping: Scrapes internal /metrics endpoints across internal Kubernetes clusters or standalone servers that expose OpenMetrics formats.
• WMI (Windows Management Instrumentation): Remotely queries performance counters on legacy Windows servers without requiring local agent installation.
• Database Monitoring (SQL/JDBC): Executes custom performance and diagnostic queries against Oracle, Microsoft SQL Server, PostgreSQL, MySQL, and IBM DB2 databases.

---

ActiveGate Configuration Architecture: custom.properties

All ActiveGate operational parameters, module activations, proxy settings, and network identities are defined in a central configuration file named custom.properties.

Configuration File Locations

• Linux: /var/lib/dynatrace/gateway/config/custom.properties
• Windows: %PROGRAMDATA%\dynatrace\gateway\config\custom.properties

Key Directives in custom.properties

[connectivity]
# Defines the public IP or FQDN advertised to OneAgents
dnsEntryPoint = https://activegate.internal.corp:9999

[network_zone]
# Defines the Network Zone this ActiveGate belongs to
networkZone = dc-chicago-prod

[http.client.proxy]
# Configures an upstream corporate proxy for egress to Dynatrace SaaS
host = proxy.corporate.local
port = 8080
user = dynatrace_svc
password = SecretProxyPassword123

[modules]
# Explicitly controls active capability modules
routing = true
synthetic = false
remote_configuration = true

Whenever changes are made to custom.properties, the ActiveGate service must be restarted to apply the new configuration:

• Linux: sudo systemctl restart dynatracegateway
• Windows: net stop "Dynatrace Gateway" && net start "Dynatrace Gateway"

---

Capability Sizing and Placement Summary