The File Log Monitor agent is configured to scan last 1 hour backlog but when the Foglight Agent Manager (FglAM) restarts, the agent scans the log from the beginning and sends alarms from previous years.
The File Log Monitor Agent fails to monitor some logs (such as PostgreSQL) because the time stamp of the records are in a different time zone than the server; for example the log record uses GMT time zone while the server itself is setup for MST time zone.
From the agent logs it can be confirmed that log records are discarded:
VERBOSE [ActivityService-218-0[149]-7] com.dell.foglight.infrastructure.actions.logmonitor.file.FileLogTopologyCreationAction - Discarding 1 record(s) in [host]/example/path/postgres.log timestamped at Thu Jun 16 00:37:00 EST YYYY or older, because they are too old and will be rejected anyway.
WORKAROUND
Align the time zones for the monitored environment:
Set the target server time zone to match the log file time zone.
or
Set the log time zone to match the target server time zone.
STATUS
Waiting for fix in a future release of Foglight.
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center