AI-Powered Root Cause: Correlating File Access with APM via Dynatrace

We built a serverless Lambda pipeline that ships FSx for ONTAP audit logs to Dynatrace via the Log Ingest API v2. The real value: Dynatrace's Davis AI can automatically correlate file access anomalies with application performance degradation — answering "why is the app slow?" with "because 500 users hit the same NFS share simultaneously."

FSx for ONTAP → S3 Access Point → EventBridge Scheduler → Lambda → Dynatrace Log Ingest API v2
                                                                         │
                                                                         ▼
                                                                    Davis AI
                                                              ┌───────────────────┐
                                                              │ Correlates:       │
                                                              │ • File access     │
                                                              │   anomalies       │
                                                              │ • APM metrics     │
                                                              │ • Infrastructure  │
                                                              │   health          │
                                                              │                   │
                                                              │ → Root cause      │
                                                              │   in seconds      │
                                                              └───────────────────┘

Verified on Dynatrace SaaS Trial (Tokyo-equivalent region). Logs visible in Logs Viewer within 1-2 minutes.

This is Part 11 of the Serverless Observability for FSx for ONTAP series.

Most observability tools treat storage logs as isolated data. Dynatrace is different — it builds a topology map of your entire stack and uses Davis AI to find causal relationships through time-window correlation and entity connectivity:

The key differentiator: Davis AI correlates events across entities that share topology connections within overlapping time windows — not just keyword matching or manual dashboard correlation.

┌─────────────────────────────────────────────────────────┐
│ Event Sources                                           │
├─────────────────────────────────────────────────────────┤
│                                                         │
│  EventBridge Scheduler                                  │
│  rate(5 minutes) ──→ Lambda                             │
│                       │ lists new files via             │
│                       │ S3 Access Point                 │
│                       │ (checkpoint in SSM)             │
│                       ▼                                 │
│           Dynatrace Log Ingest API v2                   │
│           (Api-Token auth)                              │
│                       │                                 │
│  EMS Webhook          │                                 │
│  ──→ API GW ──→ Lambda ─────────────┤                   │
│     (ems_handler)                   │                   │
│                                     ▼                   │
│  FPolicy                       Dynatrace                │
│  ──→ ECS Fargate ──→ SQS      (Logs Viewer,             │
│  ──→ Bridge Lambda              Davis AI,               │
│  ──→ EventBridge                DQL,                    │
│  ──→ Lambda (fpolicy_handler)   Dashboards)             │
│  ──────────────────────────────────────────────────────┤│
└─────────────────────────────────────────────────────────┘

When you ship FSx for ONTAP logs to Dynatrace alongside your APM data, Davis AI can detect patterns like:

This works because Dynatrace maps your FSx for ONTAP SVM as a custom device entity in its topology, connecting it to the applications that access it.

logs.ingest

dt0c01.<TOKEN_ID>.<TOKEN_SECRET>

aws secretsmanager create-secret \
  --name "dynatrace/fsxn-api-token" \
  --secret-string '{"api_token":"dt0c01.XXXXXXXX.YYYYYYYY"}' \
  --region ap-northeast-1
aws cloudformation deploy \
  --template-file integrations/dynatrace/template.yaml \
  --stack-name fsxn-dynatrace-integration \
  --parameter-overrides \
    S3AccessPointArn=arn:aws:s3:ap-northeast-1:123456789012:accesspoint/fsxn-audit-ap \
    DynatraceApiTokenSecretArn=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:dynatrace/fsxn-api-token-XXXXXX \
    DynatraceEnvUrl=https://abc12345.live.dynatrace.com \
    S3BucketName=my-fsxn-audit-bucket \
  --capabilities CAPABILITY_NAMED_IAM \
  --region ap-northeast-1

Navigate to Logs → View logs → Run query:

fetch logs
| filter log.source == "fsxn-ontap"

Logs should appear within 1-2 minutes.

Each audit log event is shipped with structured attributes for DQL querying:

{
  "content": "{\"EventID\":\"4663\",\"UserName\":\"admin@corp.local\",...}",
  "log.source": "fsxn-ontap",
  "dt.source_entity": "CUSTOM_DEVICE-fsxn-svm-prod-01",
  "timestamp": "2026-01-15T12:00:00Z",
  "severity": "info",
  "fsxn.svm": "svm-prod-01",
  "fsxn.operation": "ReadData",
  "fsxn.user": "admin@corp.local",
  "fsxn.path": "/vol/data/file.txt",
  "fsxn.s3_key": "audit/2026/01/15/audit-001.json"
}

The dt.source_entity

field links logs to a custom device in Dynatrace's topology, enabling Davis AI correlation.

Dynatrace Query Language (DQL) provides powerful analytics:

// All failed file access attempts (using structured attributes)
fetch logs
| filter log.source == "fsxn-ontap"
| filter fsxn.result == "Failure"
| summarize count(), by: {fsxn.user, fsxn.path}

// Top operations by volume
fetch logs
| filter log.source == "fsxn-ontap"
| summarize count(), by: {fsxn.operation}
| sort count() desc

// Access timeline for a specific SVM
fetch logs
| filter fsxn.svm == "svm-prod-01"
| makeTimeseries count(), interval: 5m
// File access volume vs app response time (side-by-side)
fetch logs
| filter log.source == "fsxn-ontap"
| makeTimeseries file_ops = count(), interval: 5m

// Correlate with service metrics in a dashboard
// (Place this next to a service response time tile)

// Find users causing the most I/O during a performance incident
fetch logs
| filter log.source == "fsxn-ontap"
| filter timestamp >= now() - 1h
| summarize ops = count(), by: {fsxn.user}
| sort ops desc
| limit 10
// Detect potential ransomware (mass file modifications)
fetch logs
| filter log.source == "fsxn-ontap"
| filter fsxn.operation == "WriteData" OR fsxn.operation == "Delete"
| makeTimeseries write_ops = count(), interval: 1m
| filter write_ops > 100

// After-hours access
fetch logs
| filter log.source == "fsxn-ontap"
| filter hour(timestamp) < 7 OR hour(timestamp) > 19
| summarize count(), by: {fsxn.user, fsxn.path}

For data sovereignty requirements, Dynatrace Managed or ActiveGate keeps all data within your infrastructure.

Dynatrace pricing is based on Davis Data Units (DDU):

DDU pricing varies by contract. The 14-day trial includes generous DDU allocation for validation. Check your license terms for production estimates.

To get the most from Davis AI correlation, all three prerequisites must be in place:

dt.source_entity

field setdt.source_entity

) — this creates the storage-side topology node. Use the POST /api/v2/entities/custom

) or Settings API to pre-create the device entity before first log ingestion

Prerequisites for correlation: Davis AI correlation only activates when all three components are connected in the topology. Without OneAgent on the application hosts, Davis AI cannot establish the causal link between file access patterns and application performance. The custom device entity must use a consistent naming convention (e.g.,CUSTOM_DEVICE-fsxn-{svm-name}

) across all log entries.

Application (OneAgent) ──→ NFS/SMB ──→ FSx for ONTAP (SVM)
       │                                      │
       │ APM metrics                          │ Audit logs
       ▼                                      ▼
                    Dynatrace Davis AI
                    (automatic correlation)

This integration follows the project's Production Readiness Levels:

Data classification: Dynatrace receivesfsxn.user

andfsxn.path

fields (PII/sensitive). Dynatrace SaaS environments are region-specific — select a region matching your data residency requirements. For Managed/ActiveGate deployments, data stays in your infrastructure. See[Data Classification Guide].

Full criteria: Pipeline SLO Definitions | DLQ Replay Runbook

Questions about the Dynatrace integration or Davis AI correlation? Drop a comment below.

GitHub: github.com/Yoshiki0705/fsxn-observability-integrations