Dynatrace ActiveGate in Managed: Environment vs Cluster ActiveGate, which one to choose?

In a Dynatrace Managed deployment, the Dynatrace ActiveGate is often installed « because you need one », without anyone really knowing which kind. Yet Managed offers two variants, the Environment ActiveGate and the Cluster ActiveGate, which are not installed in the same place, do not serve the same needs and do not have the same security scope. Hence a recurring question: Environment vs Cluster ActiveGate, which one do you need?

This distinction does not exist in this form outside Managed: it comes from the fact that you operate the cluster and its network exposure. Picking the wrong type leads to agents that cannot connect, unnecessary firewall openings or unavailable features.

This article clarifies the role of each type, offers a decision grid and shows how to install and verify an Environment ActiveGate.

Reminder: what an ActiveGate is for

An ActiveGate is an intermediate component that sits between OneAgents (or remote data sources) and the cluster, as shown in the data flow described in Dynatrace Managed architecture. It can:

• concentrate, compress and forward agent traffic;
• act as a single exit point for an isolated network zone;
• query remote APIs (cloud, virtualisation, Kubernetes);
• run extensions and private synthetic monitors.

By default, it listens on port 9999 for agent traffic.

Environment ActiveGate

An Environment ActiveGate is bound to one specific environment. It is usually installed as close as possible to the monitored hosts: in a remote data centre, a DMZ, a cloud VPC or a Kubernetes cluster. Its main uses:

• Routing: OneAgents in a network segment send their data to it, and it forwards it to the cluster.
• Cloud and platform monitoring: querying AWS, Azure, VMware, Kubernetes APIs… (for Kubernetes, see also Dynatrace Operator with a Managed cluster).
• Extensions: running remote extensions (databases, network devices…).

Its installer is downloaded from the environment and uses a token from that environment.

Cluster ActiveGate

A Cluster ActiveGate is bound to the cluster as a whole and serves every environment. It is typically installed at the edge of the cluster’s network, often in a DMZ. Its uses:

• External access: letting agents outside the internal network (internet, partner sites, browsers for RUM) reach the cluster without exposing the nodes directly.
• Private Synthetic: a Cluster ActiveGate can be installed with the purpose « run synthetic monitors from a private location »; with the routing purpose, it also relays RUM, mobile, public synthetic and REST API traffic.
• A shared entry point for several environments.

It is installed and managed from the CMC (Home, … menu, Add new Cluster ActiveGate). In the connection hierarchy, an Environment ActiveGate sends to a Cluster ActiveGate, which sends to the nodes’ embedded ActiveGate, never the other way round.

Decision grid: Environment vs Cluster ActiveGate

Need	Recommended type
Agents in an isolated internal network, bound to one environment	Environment ActiveGate
AWS, Azure, VMware or Kubernetes monitoring	Environment ActiveGate
Running remote extensions	Environment ActiveGate
Agents or browsers on the internet that must reach the cluster	Cluster ActiveGate
Exposing the cluster without opening the nodes	Cluster ActiveGate
Entry point shared by several environments	Cluster ActiveGate

The two types often coexist: Cluster ActiveGates in the DMZ for external access, and Environment ActiveGates in each internal network zone. The exact feature scope changes between versions: check it for your version.

Step-by-step tutorial: install an Environment ActiveGate

Step 1 — Prepare the server

Plan a dedicated Linux server, with at least a dual-core processor and 2 GB of RAM (4 GB recommended) for simple routing, more for cloud monitoring, extensions or large environments.

nproc; free -g; df -h /opt /var
curl -sI --connect-timeout 5 https://{your-domain}/ | head -1

The server must be able to reach the cluster over HTTPS.

Step 2 — Create a token

In the environment, create a token with the PaaS integration – Installer download scope (InstallerDownload), required by the ActiveGate installer download API. Store it in a vault.

Step 3 — Download the installer

The simplest approach is to copy the command offered by the environment’s ActiveGate deployment wizard. It looks like this:

wget -O Dynatrace-ActiveGate.sh \
  --header="Authorization: Api-Token {token}" \
  "https://{your-domain}/e/{environment-id}/api/v1/deployment/installer/gateway/unix/latest?arch=x86"

Step 4 — Install

sudo /bin/sh Dynatrace-ActiveGate.sh --set-network-zone={network-zone}

Use --help to check the parameters your version accepts, in particular for the network zone and the ActiveGate group.

Step 5 — Check the service

systemctl list-units --type=service | grep -i gateway
ss -tlnp | grep 9999
journalctl -u "dynatracegateway*" --since "15 min ago" --no-pager | tail -20

The ActiveGate should appear in the environment’s ActiveGate list after a few minutes.

Step 6 — Connect the OneAgents

Open port 9999 from the relevant hosts to the ActiveGate, then put the agents in the same network zone:

sudo /opt/dynatrace/oneagent/agent/tools/oneagentctl --set-network-zone={network-zone} --restart-service
sudo /opt/dynatrace/oneagent/agent/tools/oneagentctl --get-server

The endpoint list should now include the ActiveGate. Installing the agent itself is covered in deploying OneAgent on Linux.

What about a Cluster ActiveGate?

The approach is similar, but the installer and the token come from the CMC. Place it in the DMZ, expose only its HTTPS port to the outside and allow flows from it to the cluster nodes. Then check in the CMC that it is registered and operational.

Dynatrace ActiveGate: requirements, ports, groups and logs

Before installing a Dynatrace ActiveGate in Managed, whether an Environment or a Cluster ActiveGate, check these points from the Managed documentation:

• Hardware requirements (routing and monitoring ActiveGate on Linux): a dedicated machine, 2 GB of RAM (4 GB recommended), one dual-core processor and 4 GB of free disk space for installation, configuration and logs. Synthetic-enabled ActiveGates and those running the zRemote module need more and have their own requirement pages.
• Operating systems and versions: the list of supported Linux distributions (Amazon Linux, Oracle Linux, Red Hat Enterprise Linux and others) and their versions changes over time; check it before every installation.
• Ports: both an Environment ActiveGate and a Cluster ActiveGate receive connections on port 9999; the ActiveGate embedded in the Managed cluster receives them on port 443. 9999 is the default value of port-ssl in the [com.compuware.apm.webserver] section.
• Groups: an ActiveGate belongs to exactly one group, default otherwise. Assign it at install time with --set-group=my-group, or later with agctl group set my-group (ActiveGate 1.333+) or the group key in the [collector] section of custom.properties, followed by a restart. An ActiveGate running a remote extension must belong to a group.
• Configuration and logs: custom settings go in custom.properties, which overrides config.properties and is kept across updates; on Linux, logs live in /var/log/dynatrace/gateway (1.2 GB budgeted).

Best practices

• Deploy ActiveGates in pairs in each zone to avoid a single point of failure.
• Use network zones to control routing rather than manual per-host configuration.
• Separate roles: a busy routing ActiveGate should not also carry heavy extensions.
• Never expose cluster nodes directly to the internet: go through Cluster ActiveGates.
• Keep ActiveGates up to date with the cluster (see planning updates) and monitor their load like any critical server.

Frequently asked questions

Can both ActiveGate types be used at the same time?

Yes, and it is common: Cluster ActiveGates in the DMZ for external access and Environment ActiveGates in each internal network zone.

Which ActiveGate should monitor AWS, Azure or VMware?

An Environment ActiveGate: it is bound to the relevant environment and queries the cloud and virtualisation platform APIs.

How can agents on the internet reach the cluster?

Through a Cluster ActiveGate in the DMZ that exposes only its HTTPS port. Cluster nodes should never be exposed directly to the internet.

Conclusion

Remember one simple rule: the Environment ActiveGate serves one environment and brings the cluster closer to the monitored hosts; the Cluster ActiveGate serves the whole cluster and controls its exposure to the outside. By choosing the right type for each need and combining the two thoughtfully, you get a clear, secure and resilient topology.

span.observer is an independent community blog, not affiliated with Dynatrace LLC. Dynatrace is a trademark of Dynatrace LLC. Always check values (ports, versions, sizes) in the official documentation for your version of Managed.

---

Originally published on span.observer. French version: https://span.observer/fr/activegate-environnement-vs-cluster/.