Interesting Log Entry

[CFT6Server]

I am seeing a few "future" log entries which created an index of Dec 30 2016, so I looked at the data that's there. Looks like it is the log server that's generating it. I've checked the date/time on the server and it seems right, so not sure why these are coming up... compared to other CRON jobs and they seem to be ok.

crond.JPG

Code: Select all

# date
Wed Feb  3 09:46:47 PST 2016

I see come up once in a while and I have to go and remove the index.

[jolson]

Do you know if rsyslog/logstash have been restarted on all of your nodes since the turn of the year? There was a bug that caused Logstash to stick logs into the far future, and maybe it's affecting you in some weird way.

I'd also give rsyslog a restart since it's responsible for generating the timestamps. How many instances do you have - just the one? It'd be worth checking the date on all of them since they all log locally, though I'd expect to see other problems if your time was out of sync across nodes.

Let us know, thanks!

[CFT6Server]

We have multiple nodes in this cluster. but seems to only affect certain messages, as not ALL messages show that time stamp either. I will restart the service and keep an eye on it. I might do a rolling restart of the cluster sometime this weekend, as it has been a while since last reboot.

[hsmith]

Let us know if it comes back. Thanks!