13.2 VMware vSphere, Extensions & Other Agentless Ingestion Paths
Key Takeaways
- VMware Monitor Hub connects to vCenter to gather data on clusters, hosts, virtual machines, datastores, and disks, covering the hypervisor layer that an in-guest OneAgent cannot see.
- Hypervisor visibility is what turns an unexplained CPU steal-time reading inside a guest into a named contended ESXi host.
- Extensions collect from technologies that expose no agent surface — SNMP network devices, WMI, JMX, Prometheus endpoints, and message queues — and are activated from the Dynatrace Hub.
- Remote and datasource-based extensions execute on an ActiveGate, which is why ActiveGate placement determines what an extension can reach.
- For serverless and agentless workloads where no collector fits, the generic ingest APIs for metrics, logs, events, and business events remain the fallback path.
The official learning path's Ingestion lesson names three agentless routes explicitly: log ingestion, cloud integrations, and the VMware Monitor Hub. Section 13.1 covered the hyperscalers; this section covers the private-cloud and technology-specific paths that complete the Cloud Integrations and Ingestion portions of the blueprint.
VMware vSphere Monitoring
VMware Monitor Hub enables the ingestion of metrics and logs from VMware vSphere environments. It connects to vCenter to gather data on clusters, hosts, virtual machines, datastores, and disks, helping monitor health and performance.
The mechanics:
- An ActiveGate connects to the vCenter Server API over HTTPS using a read-only service account. No software is installed on ESXi hosts.
- Dynatrace discovers the vSphere inventory — datacenters, clusters, ESXi hosts, datastores, and virtual machines — and collects performance counters for each.
- Where a VM also runs OneAgent, Dynatrace correlates the guest to its hypervisor, so a monitored host entity knows which ESXi host it is running on.
That correlation is the exam-relevant payoff. Section 4.4 established that CPU steal time inside a guest proves the hypervisor is withholding cycles but cannot say why. With vSphere monitoring in place, the picture completes: you can see that the ESXi host is over-committed, identify the noisy neighbour VM sharing it, and act. Without it, the investigation stops at "something outside the VM."
Datastore metrics matter for the same reason at the storage layer. A datastore approaching capacity or exhibiting high latency degrades every VM placed on it, which is the classic explanation for a group of unrelated application hosts all slowing down simultaneously with no shared application dependency.
Extensions
Many technologies expose no place to install an agent — a network switch, a storage array, a mainframe subsystem, a third-party appliance. Extensions are the packaged collectors for these, and they are browsed, installed, and managed from the Dynatrace Hub (Section 1.1).
Common extension datasources:
| Datasource | Typical targets |
|---|---|
| SNMP | Switches, routers, firewalls, UPS units, storage arrays |
| WMI | Windows infrastructure counters and services |
| JMX | JVM-based middleware, application servers, brokers |
| Prometheus | Any workload exposing a /metrics endpoint |
| SQL | Query-based metrics from relational databases |
| Python / scripted | Bespoke APIs and vendor-specific protocols |
Execution location is the detail exam questions target. Extensions run in one of two places:
- On the host, via OneAgent — for datasources local to a monitored machine, such as reading a local JMX endpoint or a local log-derived metric.
- Remotely, on an ActiveGate — for datasources polled over the network, such as SNMP devices or a remote SQL endpoint.
The consequence: an extension can only reach what its executing ActiveGate can reach. If a scenario describes SNMP devices in an isolated network segment, the answer is to place an ActiveGate inside that segment — the same network-zone reasoning as Section 2.3, applied to ingestion rather than to agent routing.
OpenTelemetry and Open Standards
Dynatrace ingests OpenTelemetry traces, metrics, and logs through the OTLP protocol, either directly to the platform endpoint or via an ActiveGate. This is the route for technologies OneAgent does not support, for teams with an existing OpenTelemetry investment, and for languages or runtimes outside the automatic-injection matrix. Chapter 12 covers OpenTelemetry and OpenPipeline in depth; the point here is that it belongs to the same agentless family — a way to get data in when automatic instrumentation is not an option.
The Generic Ingest APIs
When no extension, integration, or agent fits, Dynatrace exposes direct HTTP ingest endpoints:
- Metric ingest — line-protocol metric data points
- Log ingest — used in serverless environments or wherever OneAgent installation isn't possible
- Events ingest — deployment markers, configuration changes, custom annotations
- Business events ingest — JSON business records (Chapter 14)
These are the fallback of last resort in exam scenarios, and there is a cost dimension worth remembering: metric data points ingested this way are metered per data point (Section 1.4), so a poorly designed custom metric with high-cardinality dimensions can be dramatically more expensive than an equivalent extension.
Choosing the Right Ingestion Path
Work down this list and take the first match:
- Can OneAgent be installed? Use it — it gives full-stack, code-level data automatically.
- Is it a managed cloud service? Use the cloud integration for that provider (13.1).
- Is it a hypervisor or virtual infrastructure? Use VMware vSphere monitoring.
- Is there a Hub extension for the technology? Activate it, and place the executing ActiveGate where it can reach the target.
- Does the workload already emit OpenTelemetry? Ingest OTLP.
- None of the above? Use the generic ingest APIs, and design the data model carefully for cost.
Exam answers that skip straight to step 6 when step 1 or 4 would work are the most common trap in this topic.
Several unrelated application hosts, owned by different teams and sharing no application dependency, all degrade at the same time. Each guest reports elevated CPU steal time. Which additional data source would identify the cause?
A team must collect metrics from SNMP-enabled network switches located in an isolated datacenter segment that has no route to the internet. What deployment detail determines whether the SNMP extension will work?
A developer proposes pushing several thousand high-cardinality custom metric data points per minute through the generic metric ingest API for a technology that has a supported Dynatrace Hub extension. Why is this a poor choice?