-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Negative numbers for gl2_processing_duration_ms #19696
Comments
@damianharouff @drewmiranda-gl Can you post the full message (ideally from OpenSearch) for an affected message so we can see all the timestamp and timing-related fields? |
@damianharouff Thank you! 🙏 That helped! Looking at the first message. 👀
|
I was wondering about that, and thought it was maybe due to incorrect time on one of the nodes, but GL and OSearch nodes are all showing a plausible time:
Slight seconds skew is due to ansible running serially. |
Yeah, I think it does. Damian's messages are also ingested via the Forwarder. Thanks, folks! I think we provided enough context and info so the team can start debugging. |
The statement about Forwarders prompted me to look at my forwarder box, and.... ...turns out my forwarder box was 12 seconds in the future. I installed and activated ntp on it, and no more messages with a negative processing duration timestamp. It does make me wonder why only some of my messages were negative and not all, since all of my ingest is through this one forwarder. |
While reviewing
gl2_processing_duration_ms
, it was noted that some messages have a negative processing time associated with them:Doesn't seem to have any specific case or reason, also happens across multiple sources, some processed by Illuminate, some not:
Happy to give Graylogger access to my cluster for further troubleshooting if not able to replicate in a dev environment.
Your Environment
The text was updated successfully, but these errors were encountered: