I have noticed that at random times my indexer is indexing old data logs from days, and sometimes even months in the past. I have no clue as to why this is happening. The logs are formatted like this:
1452006410 January 5, 2016 9:06:50 AM CST NOTIFICATION-Proview_A1827-2100_ATM_20-_20A1827-2100_20-_20SERVICEMODE_20ENTERED Proview A1827-2100 ATM - A1827-2100 - SERVICEMODE ENTERED 11 DXA CLEAR Server: INCHARGE-OI
1452006410 January 5, 2016 9:06:50 AM CST NOTIFICATION-Proview_A1827-2100_ATM_20-_20A1827-2100_20-_20SERVICEMODE_20ENTERED Proview A1827-2100 ATM - A1827-2100 - SERVICEMODE ENTERED 12 SYSTEM ESCALATION MATCHED: Proview2/ArchiveInActiveTraps
1452006410 January 5, 2016 9:06:50 AM CST NOTIFICATION-Proview_A1827-2100_ATM_20-_20A1827-2100_20-_20SERVICEMODE_20ENTERED Proview A1827-2100 ATM - A1827-2100 - SERVICEMODE ENTERED 13 SYSTEM ESCALATION MATCHED: Notification Clear/Archive - InActive/Archive Inactive Resolved Notifications
1452006410 January 5, 2016 9:06:50 AM CST NOTIFICATION-Proview_A1827-2100_ATM_20-_20A1827-2100_20-_20SERVICEMODE_20ENTERED Proview A1827-2100 ATM - A1827-2100 - SERVICEMODE ENTERED 14 SYSTEM ESCALATION REACHED: Proview2/ArchiveInActiveTraps, Level-0
At times, I see in the searched logs the date from the indexer will say, this:
**1/5/16
9:06:50.000 AM**
1448550410 **November 26, 2015 9:06:50 AM** CST NOTIFICATION-CPU__Performance__CiscoSystem_I-CPU__Performance__CiscoSystem-PSR-ALBMDSP301/0_HighUtilization CPU_Performance_CiscoSystem I-CPU_Performance_CiscoSystem-PSR-ALBMDSP301/0 HighUtilization 8 SYSTEM ESCALATION SCHEDULED: Resources/ResoursesClearEvent for Level-1 due at November 26, 2015 9:11:51 AM CST
1448550416 November 26, 2015 9:06:56 AM CST NOTIFICATION-Memory__Performance__HostResources_I-Memory__Performance__HostResources-MEM-ALVPHASE3UI/6_InsufficientFreeMemory Memory_Performance_HostResources I-Memory_Performance_HostResources-MEM-ALVPHASE3UI/6 InsufficientFreeMemory 22 SYSTEM ESCALATION REACHED: Resources/ResoursesClearEvent, Level-1
1448550416 November 26, 2015 9:06:56 AM CST NOTIFICATION-Memory__Performance__HostResources_I-Memory__Performance__HostResources-MEM-ALVPHASE3UI/6_InsufficientFreeMemory Memory_Performance_HostResources I-Memory_Performance_HostResources-MEM-ALVPHASE3UI/6 InsufficientFreeMemory 23 SYSTEM Action invoked... ClearEvent
1448550417 November 26, 2015 9:06:57 AM CST NOTIFICATION-Memory__Performance__HostResources_I-Memory__Performance__HostResources-MEM-ALVPHASE3UI/6_InsufficientFreeMemory Memory_Performance_HostResources I-Memory_Performance_HostResources-MEM-ALVPHASE3UI/6 InsufficientFreeMemory 24 SYSTEM Action completed successfully... ClearEvent
1448550417 November 26, 2015 9:06:57 AM CST NOTIFICATION-Memory__Performance__HostResources_I-Memory__Performance__HostResources-MEM-ALVPHASE3UI/6_InsufficientFreeMemory Memory_Performance_HostResources I-Memory_Performance_HostResources-MEM-ALVPHASE3UI/6 InsufficientFreeMemory 25 SYSTEM Action invoked... zArchiveEvent
Show all 257 lines
ClassName = CPU_Performance_CiscoSystem Escalations = SCHEDULED: Resources/ResoursesClearEvent for Level-1 due at November 26 EventName = HighUtilization InstanceName = I-CPU_Performance_CiscoSystem-PSR-ALBMDSP301/0 SourceEsc = Server: INCHARGE-AM-PM-GA-FL eventtype = ActionSuccess eventtype = Escalations Scheduled eventtype = Notification Clear eventtype = Notification Notify host = ALVIONIX01 source = \\ALVIONIX01\d\InCharge\SAM\smarts\local\logs\INCHARGE-SA.audit sourcetype = SAM_Audit
So as you can see, the indexer is picking up older log entries and indexing them as a group as one date.
What can be done?
Any help would be appreciated.
↧