Dynatrace APM Complete Guide: OneAgent, Smartscape, and Davis AI

Application performance monitoring has evolved far beyond simple uptime checks and response time graphs. Dynatrace sits at the top end of that evolution — a full-stack observability platform that automatically discovers your entire environment, maps service dependencies, and uses AI to pinpoint root causes before your on-call team even opens their laptop. This guide covers everything you need to know to get value out of Dynatrace APM: from installing OneAgent to reading Problem cards in Davis AI.

What Dynatrace APM Actually Does

Dynatrace is not just a metrics collector. The platform combines:

• OneAgent — a single host agent that auto-instruments every process it finds
• Smartscape — a real-time topology map of every entity and its dependencies
• Davis AI — an AI engine that correlates events, detects anomalies, and identifies root causes
• Dashboards and USQL — flexible visualization and query layer

Most APM tools require you to instrument each service manually, configure metric collection, and then build dashboards that stitch it all together. Dynatrace inverts this: deploy OneAgent, wait ten minutes, and you have a live map of your entire stack.

Installing OneAgent

OneAgent installation is intentionally simple. The agent is a single binary that auto-detects and instruments processes — Node.js, Java, .NET, Python, Go, PHP, and more.

Linux installation

Download the installer from your Dynatrace environment:

wget -O Dynatrace-OneAgent.sh \
  "https://<your-env>.live.dynatrace.com/api/v1/deployment/installer/agent/unix/default/latest" \
  --header="Authorization: Api-Token <your-token>"

chmod +x Dynatrace-OneAgent.sh
sudo ./Dynatrace-OneAgent.sh

The installer handles everything: creates the dtuser system user, installs the watchdog process, and starts monitoring within seconds. You don't need to restart your application processes — OneAgent injects into running processes via /proc on Linux.

Docker / containerized environments

For containers, use the OneAgent Operator (covered in the Kubernetes post) or inject OneAgent via an init container:

COPY --from=dynatrace/oneagent /opt/dynatrace/oneagent /opt/dynatrace/oneagent
ENV LD_PRELOAD=/opt/dynatrace/oneagent/agent/lib64/liboneagentproc.so

For Docker Compose, mount the OneAgent volume into each service container. Dynatrace provides a docker-compose snippet in the UI under Deploy Dynatrace > Start monitoring > Docker.

Kubernetes

Use the Dynatrace Operator (Helm-based). Full walkthrough in the Kubernetes observability guide.

Automatic Instrumentation: What Gets Captured

Once OneAgent is running, it automatically instruments:

For Node.js, Dynatrace uses V8 hooks. For Java, it uses a Java agent (-javaagent). OneAgent handles the injection automatically — you don't pass JVM flags manually.

Distributed tracing

Dynatrace uses its own PurePath technology for distributed tracing. Each request gets a trace ID propagated through HTTP headers (x-dynatrace). PurePaths capture every hop in a transaction: the browser request, API gateway, microservices, database calls, and external service calls.

To view a PurePath: Applications > [Your App] > User sessions > [Session] > PurePaths.

Smartscape: Understanding Your Topology

Smartscape is one of Dynatrace's most distinctive features. It's a live, auto-generated topology map that shows every entity (hosts, processes, services, applications) and the relationships between them.

Open Smartscape from the left nav: Observe and explore > Smartscape.

The map has five vertical layers:

1. Data centers / cloud — AWS regions, Azure subscriptions, GCP projects
2. Hosts — physical and virtual machines
3. Processes — running process groups (Node.js cluster, Tomcat instance)
4. Services — logical services auto-detected from process communication
5. Applications — frontend applications tracked via RUM

Click any entity and Smartscape draws the inbound and outbound connections. This is invaluable when you're triaging an incident: you can immediately see which services depend on the one that's degraded, and which downstream dependencies that service calls.

Smartscape updates in near-real-time. Deploy a new service, and it appears within a few minutes. Decommission one, and it fades out after the idle timeout.

Davis AI: From Metrics to Answers

Davis is Dynatrace's AI engine. Unlike alert-based systems where you configure thresholds and get paged on every breach, Davis continuously learns the baseline behavior of every metric and detects deviations automatically.

How Davis works

Davis runs a deterministic causal analysis, not a statistical black box. It:

1. Detects an anomaly (e.g., response time spike on checkout-service)
2. Queries Smartscape to find all entities connected to checkout-service
3. Correlates the anomaly with events on those entities (deployment, config change, infrastructure event)
4. Identifies the root cause entity and the likely trigger

The result is a Problem — a grouped, correlated set of events with a single root cause hypothesis.

Problem cards

Problems appear under Problems in the left nav. A Problem card shows:

• Impact: which services and users were affected
• Root cause: the entity Davis identified as the origin
• Evidence: the specific metric deviations and events that led to the conclusion
• Timeline: when the problem started, how it evolved, when it resolved

A well-formed Problem card often lets you close an incident without ever opening a dashboard. Davis tells you: "Response time on payment-service degraded. Root cause: high GC pause on host prod-app-03. Triggered 4 minutes after deployment v2.3.1."

Tuning Davis

Davis is self-tuning but you can adjust its sensitivity:

• Anomaly detection settings: per-metric thresholds (Settings > Anomaly detection)
• Maintenance windows: suppress alerting during planned deployments
• Problem notifications: route Problems to PagerDuty, Slack, OpsGenie, or any webhook

Dashboards and USQL

Dynatrace includes a dashboard builder and a query language (USQL — User Session Query Language) for custom analytics.

Built-in dashboards

The Digital Experience and Infrastructure presets give you a working dashboard in one click. For services: Services > [Service] > Service overview shows request rate, error rate, and response time as a time series.

Custom dashboards

Build custom dashboards with drag-and-drop tiles. Tile types include:

• Metric — any metric from any entity
• SLO — track service level objectives
• Problems — filtered problem list
• Custom chart — multi-metric overlay
• USQL table — query-driven table or chart

USQL for user session analytics

USQL is SQL-like but operates on user session data:

SELECT useraction.name, avg(useraction.duration), count(*)
FROM usersession
WHERE useraction.application = "eCommerce Frontend"
  AND useraction.duration > 3000
GROUP BY useraction.name
ORDER BY count(*) DESC
LIMIT 20

This query returns the top 20 slow user actions in your frontend app — useful for identifying UX bottlenecks that pure backend APM misses.

Service-Level Objectives (SLOs)

Dynatrace has native SLO support. Define an SLO under Service-level objectives:

• Target: e.g., 99.9% availability, < 500ms p95 response time
• Evaluation window: rolling 7 days, 30 days, or custom
• Burn rate alerts: get alerted when you're burning your error budget too fast

SLOs integrate with Davis — a Problem can be automatically linked to an SLO breach.

Log Management and Correlation

Dynatrace can ingest logs from OneAgent (file tailing), log shippers (Fluentd, Logstash), or direct API push. Logs are automatically correlated with traces and metrics by entity and timestamp.

In practice this means: you're looking at a PurePath for a failed request, and the relevant log lines from every service in that trace appear inline. No cross-referencing log timestamps manually.

Log processing rules let you extract structured fields, mask sensitive data, and set log levels for routing.

Integrating Dynatrace with Your CI/CD Pipeline

Dynatrace has a deployment events API. Push a deployment event when you ship:

curl -X POST \
  "https://<env>.live.dynatrace.com/api/v1/events" \
  -H "Authorization: Api-Token <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "eventType": "CUSTOM_DEPLOYMENT",
    "deploymentName": "checkout-service v2.3.1",
    "deploymentVersion": "2.3.1",
    "entitySelector": "type(SERVICE),tag(checkout-service)",
    "source": "CI/CD"
  }'

Davis will use this event as a candidate root cause when correlating with anomalies. Without deployment events, Davis can still detect anomalies, but it can't confirm the causal link to a code change.

What Dynatrace Doesn't Cover

Dynatrace excels at observability — understanding what's happening inside your systems after code is deployed. It doesn't:

• Run synthetic end-to-end tests from a user's perspective before deployment (Dynatrace Synthetic covers post-deployment monitoring, not pre-release validation)
• Validate user flows in staging as part of a CI gate
• Test API contracts between services before they're merged

This is where tools like HelpMeTest complement Dynatrace well. HelpMeTest runs continuous end-to-end tests that simulate real user journeys — checkout flows, login sequences, form submissions — and can run as a CI gate before you push to production. Dynatrace then monitors what happens after. Together, they cover the full reliability loop: validate before deploy, observe after.

Key Takeaways

Dynatrace APM is worth the investment when:

• You have a distributed microservices architecture and tracing across services manually is painful
• You're spending significant on-call time triaging alerts that turn out to be noise
• You need automatic root cause analysis, not just metric dashboards
• Your team lacks the bandwidth to maintain a hand-rolled Prometheus + Grafana + alertmanager stack

The learning curve is real — Dynatrace has a lot of concepts (Smartscape, PurePaths, Davis, USQL). But the payoff is a system that finds problems before users report them and tells you where to look without a two-hour investigation.

Start with OneAgent on your most critical production hosts. Within an hour, you'll have more visibility into your stack than most teams achieve in months of manual instrumentation.