• Support
  • Forums
  • Blogs
A New Community Experience is Coming! For more information, please see our announcement.

Events from the future

PeaktweakPeaktweak

New Life Form
Does anybody see any events from the future in different plugins?
This happen from time to time, not always.

Thanks, 
PT
Tagged:

Share post:

Answers

  • hi, we notice that just in case that device or sensor has a wrong time. have you check that?


  • Yes, I did.
    The problem is that these events from the future come only sometimes, not all the time.
    Most of them are coming from ESXi and windns.
    The time of events in the future is also irregular.
  • Hello @peaktweak,

       In the event that you are seeing some events (and not all) from the future, I would be sure to check the raw_log data within the log itself. It is possible that the timestamp is not successfully being parsed for a datasource. Albeit, if you are not seeing this for all Events on the Sensor, it would appear as though the intermittent issue may be related to the host(s) sending logs to the Sensor. Can you check the timezone on the devices sending to the Sensor? Can you provide a screenshot of the log, showing the header and timestamp information? 

       Regards,

    - kratos 
  • kratos, 
    Thank you for your comment. 
    Let me grab more examples, but here is one of them

    Aug  9 04:36:44 VMHost01.XYZ Vpxa: verbose vpxa[936AB70]

    [[email protected] sub=VpxaHalCnxHostagent opID=WFU-79dd0c65] Applying updates

    from 35968352 to

    35968353 (at 35968352)

    Aug  9 04:36:44 VMHost01.XYZ Vpxa: verbose vpxa[936AB70]

    [[email protected] sub=VpxaHalCnxHostagent opID=WFU-79dd0c65] Starting next

    WaitForUpdates() cal

    l to hostd

    Aug  9 04:36:44 VMHost01.XYZ Vpxa: verbose vpxa[936AB70]

    [[email protected] sub=VpxaHalCnxHostagent opID=WFU-79dd0c65] Completed

    WaitForUpdatesDone callb

    ack

    Oct  7 02:28:11 VMHost01.XYZ Rhttpproxy: Section for VMware ESX,

    pid=67814, version=6.5.0, build=6765664, option=Release

    Aug  9 04:36:44 VMHost01.XYZ Vpxa: verbose vpxa[9307B70]

    [[email protected] sub=vpxaMoVm opID=SWI-41a7] [VpxaMoVm::CheckMoVm] did not

    find a VM with ID 411 in the vmList

    Aug  9 04:36:44 VMHost01.XYZ Vpxa: verbose vpxa[9307B70]

    [[email protected] sub=Alarm opID=SWI-41a7] [VpxaAlarm] VM with vmid = 411 not

    found

    Aug  9 04:36:44 VMHost01.XYZ Vpxa: verbose vpxa[9283B70]

    [[email protected] sub=VpxaHalCnxHostagent opID=WFU-1f58f964] Received

    WaitForUpdatesDone callback



  • Just recently I found another problem with events in the future.
    Looks like dns-nxlog is not interpreting correctly events between midnight and 1AM.
    All events during this hour are shifted to 12:xx PM.
    Does anybody has solution for this?

    Thnx,
    PT
Sign In or Register to comment.