OneAgent release notes version 1.349

• Release notes
• 18-min read
• Rollout start on Nov 09, 2026

This page showcases new features, changes, and bug fixes in Dynatrace OneAgent version 1.349. It contains:

• Feature updates: 27
• Breaking changes: 5
• Fixes and maintenance: 71 (3 vulnerabilities)

Oldest supported versions

With this release, the following are the oldest supported OneAgent versions.

For details, see How long are versions supported following rollout?.

Feature updates

Application Observability | Distributed Tracing

Trace HTTPX2 requests in Python

OneAgent now supports HTTPX2 tracing in Python.

Application Observability | Distributed Tracing

z/OS Connect 3.0 Enterprise Edition support for CICS and IMS

OneAgent z/OS Connect 3.0 Enterprise Edition now also supports CICS and IMS. To enable the support, follow the installation steps for z/OS Java middleware.

Application Observability | Distributed Tracing

Extended Azure Function instrumentation for .NET for Windows and Linux plans

We have extended Azure Functions (tracing and log correlation) instrumentation for .NET for the following plans:

• Windows Premium and Consumption plan.
• Linux Premium and Flex Consumption plan.

The Dedicated plan has an updated implementation.

Application Observability | Distributed Tracing

Azure SDK Event Hub and Service Bus tracing in .NET

We now support automatic Event Hub and Service Bus tracing (sending and receiving messages) for the Azure SDK for .NET.

Application Observability | Distributed Tracing

Go static monitoring no longer requires ptrace on Linux

Go static monitoring no longer requires the Linux ptrace capability. This improvement is planned to replace the existing opt-in OneAgent feature Go improved static monitoring.

Application Observability | Distributed Tracing

Improved compatibility for injection of statically linked Go applications

The new Go static ELF loader feature provides an improved way of injecting OneAgent into statically linked Go applications. It maps the executable into memory, just like the operating system loader would, and removes the need to start a temporary child process. This avoids the requirement for the Linux ptrace capability, which might be unavailable in some container environments, or the memfd_create syscall, which might get flagged by security tools and cause additional memory overhead.

This replaces the existing Go static injection using in-memory file feature that is now deprecated. We recommend switching to the new mechanism, which takes precedence in case both are enabled.

Application Observability | Distributed Tracing

Monitor Go applications built with Go 1.27

OneAgent now supports monitoring Go applications built with Go 1.27.

Application Observability | Distributed Tracing

Java Azure Function triggers support extended with Azure SQL

We have extended Java Azure Functions support with the Azure SQL trigger .

Application Observability | Distributed Tracing

New Python Azure Function triggers support

We have extended Python Azure Function support with the following triggers: Model Context Protocol and IoT Hub.

Application Observability | Distributed Tracing

Extended Java Azure Function triggers support

Java Azure Functions now has extended support with the following triggers: Cosmos DB , RedisPubSubTrigger , RedisListTrigger , and RedisStreamTrigger .

Application Observability | Log Analytics

Recover compressed log files after a OneAgent restart or upgrade

The OneAgent Log module now recovers log records from compressed log files (ZIP, GZIP) created during a OneAgent restart or upgrade.

• Previously, if log rotation compressed a file while OneAgent was temporarily offline, those log records could be missed.
• Now, OneAgent detects and reads files that were compressed during its downtime upon restart, helping to ensure that no log data is lost during maintenance or upgrade windows.

Application Observability | Log Analytics

Support for NLog

OneAgent now supports log enrichment for the NLog framework. The minimum supported NLog version is 4.5.11. This requires the Advanced .NET Instrumentation Mode OneAgent feature to be enabled. To enable the feature:

• Go to Settings > Collect and capture > General monitoring settings > OneAgent features.
• Enable Advanced .NET Instrumentation Mode.
• Restart the affected processes.

Application Observability | Log Analytics

Updated binary log file recognition

You can now decide how OneAgent handles binary log files: block the entire log source, or block only the files that contain binary content. A new binary recognition algorithm is also available. You can configure both in Advanced settings.

Digital Experience | RUM Web

Identify which user interaction was the trigger for the user action

RUM JavaScript now sets a new field interaction.is_user_action_trigger on the interaction event that caused the user action to be created.

Digital Experience | RUM Web

Capture support for Long Animation Frames

We have now added support for Long Animation Frames (LoAF). LoAFs are now sent as standalone events (characteristics.has_long_animation_frame) and aggregated on summaries.

Digital Experience | RUM Web

RUM JavaScript Agent Web API usage

The RUM JavaScript Agent is updated to use the following Web APIs:

Digital Experience | RUM Web

The RUM JavaScript now supports sessions controlled by the mobile agent, allowing you to correlate user sessions between your mobile and web app.

Infrastructure Observability | Hosts

Improved Java and .NET technology detection

We have now improved the detection of JVM and CLR lazy initialization on Linux.

Infrastructure Observability | Hosts

Support for multi-value dt.security_context

We have now implemented support for multi-value dt.security_context enrichment.

Platform

Software Bill of Materials (SBOM) in OneAgent containerized deployment

OneAgent for containerized deployment now includes a Software Bill of Materials (SBOM) for supply chain transparency. This helps you to identify the origin of potential security vulnerabilities within the OneAgent image.

Platform | OneAgent

Log module CPU usage limit

The OneAgent Log module now supports a configurable CPU usage cap on Linux hosts.

• The limit is set as a percentage of total host CPU.
• You can apply the limit at the environment, host group, or host level.
• You don't need to restart OneAgent for the changes to apply.

When the cap is reached, the log module scales back the processing to stay within the boundary.

This setting is available for environments with constrained CPU headroom that require additional resource guardrails.

Platform | OneAgent

Log module rotation mechanism enhancements

Log module rotation mechanism enhancements include:

• OneAgent version 1.343: The Log module now supports rotation patterns where files are compressed or removed immediately after rotation. It does this by keeping file handles open. This is supported on Linux for log files on local drives.
• OneAgent version 1.347: Extended to cover rotation during a Log module restart, when the file-handle approach alone can’t help. The Log module can now read rotated, GZIP-compressed logs even if the rotation happened while the module was restarting.
• OneAgent version 1.349: Added support for ZIP-compressed log files. GZIP and ZIP handling during a Log module restart is supported on both Windows and Linux.

For details, see Log rotation patterns.

Platform | OneAgent

Enrich data with cloud resource identifiers

OneAgent now enriches logs, events, metrics, spans and Smartscape nodes with the unique identifier of the cloud resource they run on: aws.arn on AWS, azure.resource.id on Azure and gcp.resource.name on GCP. The identifier comes from local cloud metadata and environment. Enrichment is on by default for supported platforms.

Platform | OneAgent

GraalVM Native Image: Outgoing HTTP tracing support for Netty-based clients

OneAgent now traces outgoing HTTP requests made with Spring RestClient in Spring Boot GraalVM Native Image applications (non-reactive).

Platform | OneAgent

R2DBC tracing for Java is now available as an experimental feature

You can now trace calls made through R2DBC drivers in your Java applications. This experimental feature is opt-in, and Dynatrace support can enable it for you.

Platform | OneAgent

Google Cloud Run support for Python

OneAgent now supports Python applications on Google Cloud Run.

Platform | OneAgent

Updated Cloud Native Images

We have updated Cloud Native Images. The new version brings two major changes:

• The software bill of materials (SBOM) is delivered together with the image.
• Image size was reduced and is now four times smaller.

Breaking changes

Infrastructure Observability | Extensions

Extensions Framework will use Python 3.14 instead of Python 3.10

Python 3.10 is no longer supported after October 26, 2026. For details, see Python end of support policy . With the end of support, Extensions Framework will use Python 3.14 to run Python-based extensions.

Action plan:

Update your Python-based extensions to a version built with a Python 3.14-compatible dt-extensions-sdk before you update OneAgent and ActiveGate to version 1.349. Extensions that are bundled with an older SDK might fail to start after the upgrade. For instructions on how to update your extensions, see Python 3.10 end of support.

Infrastructure Observability | Kubernetes

Consistent Container Entity ID calculation for Kubernetes and Cloud Foundry

Entity ID calculation for Kubernetes containers based on Docker is now consistently derived from Kubernetes metadata rather than mixed-in Docker-specific data.

On Cloud Foundry, Cloud Foundry-specific data is now also consistently included in the entity ID calculation.

As a result, container and process IDs can change; process group IDs stay the same.

Action plan: Keep track of container and process IDs changes.

This change doesn't affect environments created after Dynatrace SaaS version 1.258 since they use the new calculation by default, unless the option was manually changed.

Platform | OneAgent

Rules based on AWS and Azure tags temporarily no longer work as sources or in conditions for injected processes

In the Host/process property rules dropdown, the aws.tags and azure.tags based rules will temporarily no longer work as sources or in conditions for injected processes. Full cloud tags support, which brings that functionality back, is planned for a future release.

Action plan:

Use a custom value or a different supported source in Host/process property rules. We also recommend monitoring release notes for future releases.

Examples of rules with custom values:

Rule 1:

Type: Custom value

• Target: primary_tags.team
• Condition: matchesValue(dt.process_group.detected_name, "java-api")

Rule 2:

Type: Custom value

• Target: primary_tags.team
• Condition: matchesValue(host.name, "ec2-host-abc")

In this example, primary_tags.team=team-dev is applied to all the data coming from the java-api processes, and primary_tags.team=team-infra is applied to the rest of the data coming from hosts with the name ec2-host-abc.

Platform | OneAgent

{AzureRegion:Name} in service naming rules now returns a consistently lowercase value

{AzureRegion:Name} in service naming rules now returns a consistently lowercase value (for example, canadacentral) on all Azure environments, including Azure App Service and PCF-on-Azure. Previously, environments sourcing the region from the REGION_NAME environment variable returned PascalCase (for example, CanadaCentral), causing a mismatch with azure.location.

Action plan:

If you have naming rules or alerting profiles that match on the PascalCase form, update them to use lowercase.

Platform | OneAgent

Code modules no longer include Grail primary tags set via host properties

Code modules now drop any primary Grail tag attribute that is set via oneagentctl --set-host-property. Previously, host properties that were set this way were included as primary Grail tags in enrichment data emitted by injected code modules.

Action plan:

Make sure your primary tags originate only from explicit tag sources, such as DT_TAGS, oneagentctl --set-host-tag, or hostautotag.conf.

Fixes and maintenance

Resolved issues in this release

• Added previously missing Ubuntu 26.10 support for OneAgent. (OA-76621)
• Fixed an issue where Ingest Enrichment Configuration couldn't add dt.security_context to process entities. (OA-76446)
• Fixed an issue that caused zRemote to stop requesting configuration if it lost its connection to the Dynatrace cluster during a configuration request. (OA-76320)
• Vulnerability: Updated Go toolchain to 1.26.10 in Odin Lambda Log Collector to address a security vulnerability (CVE-2026-111943). (OA-76268)
• Fixed a bug where Go code module fails to start a trace if a Go database sensor executes a query and then iterates over the result set in another goroutine. (OA-75947)
• The rule order in Ingest enrichment configuration is now applied correctly in case a process-specific rule has higher priority than a host-specific rule. However, in the Host/process property rules dropdown, the aws.tags and azure.tags based rules will temporarily no longer work as sources or in conditions for injected processes. For details, see Breaking changes. (OA-75562)
• Fixed a bug where WebSphere Liberty 26.0.0.10 servers failed to start because of a NoClassDefFoundError. (OA-75546)
• Fixed an issue where a reinitialized CICS region didn't send its saved process group configuration to its zDC subsystem on registration. (OA-75227)
• Resolved IMS Configuration issues and cleaned up log spam. (OA-75059)
• Vulnerability: Addressed a security issue in the OneAgent installer for Linux and AIX by restricting access to temporary files created during installation. (OA-74778)
• Fixed an issue where the pymongo sensor didn’t produce any tracing data when a query statement contained non-JSON-serializable data, such as datetime objects. (OA-74764)
• Fixed an issue with an incorrect evaluation of Central Enrichment attributes. (OA-74747)
• Added missing components to the Software Bill of Materials (SBOM) delivered with OneAgent Cloud Native Image. (OA-74694)
• Changed component name in SBOM installer from dynatracewatchdog to oneagentwatchdog. (OA-74693)
• Spans for .NET HTTP triggers now contain all mandatory span attributes. (OA-74509)
• Spans for Java HTTP triggers now contain all mandatory span attributes. (OA-74495)
• Disabled the self-monitoring event that was triggered when the CPU quota was exhausted. (OA-74489)
• Fixed an issue where CICS Sensor Configurations weren't updated if PLEX support was enabled. (OA-73832)
• Fixed an exception in OneAgent when capturing business events in Spring WebFlux and Netty applications. (OA-73556)
• Fixed an issue where the hostname was used for the fully qualified (FQ) name reported by OneAgent instead of the fully qualified domain name (FQDN). (OA-73487)
• Fixed an issue where MBAgent (IBM App Connect/Integration Bus) could leave a trace's local path open for up to 1.5 hours after an asynchronous callable-flow or HTTP request lost its response, instead of closing it shortly after the request's own timeout. Flows whose asynchronous responses always arrive are not affected. (OA-73424)
• Fixed an issue where MBAgent (IBM App Connect/Integration Bus) could lose correlation for the response side of a callable flow when the invoked sub-flow cleared its local environment data before replying, which could cause the related trace to appear disconnected, and in rare cases delay the request until a timeout was reached. Flows that don’t clear local environment data within a callable sub-flow are not affected. (OA-73423)
• Fixed an issue where the psycopg2 sensor caused a TypeError when a proxied Cursor or Connection object was passed to native psycopg2 functions such as quote_ident. (OA-73403)
• Fixed an issue in IBM Integration Bus / App Connect Enterprise (WebSphere Message Broker) monitoring where message flows running on paths excluded from capture could omit outgoing trace tags. This could break the link between the message flow and the services it called, so those downstream calls appeared unconnected. Message flows on captured paths were not affected. (OA-73401)
• Fixed an issue where the SQL normalizer did not mask literal values in certain assignment statements when the literal used a type prefix (for example, SQL Server's Unicode N prefix (DECLARE @sql NVARCHAR(500) = N'...', UPDATE t SET col = N'...'), or PostgreSQL/MySQL/SQLite E/B/X prefixes). These literals are now masked the same way as unprefixed literals. (OA-73384)
• Added BaseConfigSensors guard against concurrent access. (OA-73279)
• Improved OneAgent behavior during flushing at the end of the AWS Lambda and Azure Functions execution. (OA-73276)
• Consumers using the IBM MQ .NET client (non-XMS version) with the .NET IBM MQ WMQ send trace context as message property feature disabled no longer see messages reporting an error with reason code 2471 (MQRC_PROPERTY_NOT_AVAILABLE). (OA-73256)
• Fixed Garden container detection and injection in cgroupv2 environments. (OA-73220)
• Fixed the ARM architecture not being detected. Logs now show ARM instead of Unknown. (OA-73219)
• Fixed a crash in PHP processes consuming RabbitMQ messages with php-amqplib versions earlier than 3.4.0. (OA-73212)
• Fixed an issue that could change the Exception Type and Message when RUM for AspNetCore was active. (OA-73155)
• Fixed DPG/PGR features not working for descendant processes of processes of types Erlang, SAP, Redis, Linux system, AIX system, and unknown. Grouping and IDs of such DPG/PGR processes and their descendants can change. For example, if there is a process A of type Erlang, which has a child process B, which has a child process C, and process B is matched to DPG/PGR rule, then the grouping and IDs of process B will change, and the grouping and IDs of process C can change depending on the process type. (OA-73136)
• Fixed the issue where traces showing child nodes could have a start time that is earlier than their parents' start time. (OA-73097)
• Added z/OS Java module support for Java 25 LTS. If you run z/OS Java against the Java Development Kit version 24 and higher, you should run Java processes with the --sun-misc-unsafe-memory-access=allow Java Virtual Machine argument to disable deprecation logging messages at startup. (OA-73076)
• Fixed an issue where, with tagging enabled, the Go gRPC client sensor could cause a crash by corrupting data. This occurred when an application reused the same context object for multiple concurrent gRPC calls. (OA-73028)
• Changed enrichment directory permissions from 755 to 775 in container deployments that use the OneAgent Cloud Native Image. (OA-72907)
• Fixed possible crash on ARM64 in monitored Go applications that use the CGO framework to invoke Go code from C. This only affects calls made on threads created in C, not in Go. (OA-72728)
• Fixed AddressSpace use-after-free when an ASID re-initialized. (OA-72680)
• {AzureRegion:Name} in service naming rules now returns a consistently lowercase value (for example, canadacentral) on all Azure environments, including Azure App Service and PCF-on-Azure. For details, see Breaking changes. (OA-72373)
• Fixed an issue on Linux where PHP-FPM processes could stop being deeply monitored shortly after a service restart. Affected processes showed Waiting for injection in Dynatrace, and didn't produce traces or metrics. The issue was most likely on hosts running many PHP-FPM workers, especially when the application creates child processes. This fix also resolves an issue where a configuration change made in Dynatrace after PHP-FPM monitoring had started was not applied. Affected processes stayed without deep monitoring until the PHP-FPM service was restarted. (OA-72216)
• Added hostname to AWS Lambda functions exit spans to improve visibility of the origin of outbound calls. (OA-72193)
• Restored file lock on extracted MSI and additional files during installation. A read-only file handle is now explicitly acquired on the MSI and all additional files before installation begins and held until installation completes. (OA-72077)
• Fixed possible performance overhead in Go applications on Linux ARM that use the CGO framework to invoke Go code from C at high frequency. This only affects calls made on threads created in C, not in Go. (OA-72003)
• Fixed an issue where a terminated process group's attributes could linger on a container's log records and be reported to the server after the process was gone. (OA-71405)
• Fixed a bug with parsing the time zone from the /etc/environment file on AIX. (OA-69295)
• Fixed an issue in Spring Boot 4 where OneAgent caching response header handling removed the application’s own ETag header value. (OA-69243)
• Added early validation of command-line parameters, so the installation now fails immediately if a parameter is invalid. (OA-68652)
• Fixed an issue that caused RUM Classic to stop sending data on active pages when cookie opt-in mode was used and a config update happened. (DEM-34608)
• Fixed an issue that would report hard navigation events with a view sequence number greater than 1. (DEM-32534)
• Fixed a regression where the Dynatrace SaaS data from cross-origin iFrames was not reported in Synthetic monitoring. (DEM-32300)
• Fixed a bug where the RUM JavaScript would write dtCFG_ and dtTAB_ persistent values without the user having granted consent. (DEM-31938)
• Fixed an issue where events that started during a user action but were reported after it ended, such as mouse overs and late-arriving resource timings, were missing the user_action.instance_id field. (DEM-31120)
• Vulnerability: Python runtime, Go, and OpenTelemetry Collector used in Extensions Framework are now patched against compromised eMudhra CA keys. (DAQ-30987)
• Fixed an issue where Extensions Framework replaced forward slashes in metric dimension keys with underscores. (DAQ-30563)
• Fixed a crash of monitored processes on Alpine Linux (musl) that could occur when a business event capture rule was changed while requests were being processed. On other Linux distributions the same problem could attach incorrect settings metadata to captured business events. (OA-74380)
• Fixed an issue in ZRemote where the global 10-second keep-alive NoOp timer could close new zLocal connections before the INIT handshake was completed. (OA-74246)
• Fixed repeated log entries on GCE instances whose service account lacks instance label or Resource Manager tag permissions. The agent now logs the permission error once instead of every 3 minutes. (OA-74216)
• Fixed an issue where OneAgent log monitoring could terminate repeatedly when a monitored pod reported Kubernetes namespace annotations that could not be parsed. (OA-73972)
• Fixed an issue with IMS Configurations that caused excessive log messages. (OA-73175)
• Fixed an issue where OneAgent Node.js injection incorrectly handled the errorCodes and LogController exports from fastify. (OA-73113)
• Fixed an issue where server.address was not resolved correctly when using MongoDB 3.x or 4.x–5.5 with the useUnifiedTopology option (as used by the Mongoose connector), causing the MongoDB service to appear without its associated database host details. (OA-72934)
• OS Service monitoring now correctly reports the inactive state when a service is stopped and unloaded by systems on monitored Linux hosts. The service is reported as inactive for the duration it remains stopped, and the availability alert is raised. (OA-72737)
• Fixed an issue where OneAgent Python tracing failed to instrument AWS Lambda handler functions wrapped with a decorator that adds extra parameters beyond the standard (event, context) signature, even when the decorator used functools.wraps. As a result, no service entity was created for the affected Lambda functions. (OA-72629)
• Fixed an issue where OneAgent Python injection unconditionally removed sitecustomize from sys.modules but only restored it when the injected sitedir was the first entry in sys.path. (OA-72627)
• Fixed an issue where application exceptions would appear multiple times. (OA-72624)
• Changed the Java Virtual Machine free memory description so it's more accurate in Full-Stack deployments. (OA-72620)