awslogs 所有日志都被跳过

Question

我已经设置了 awslogs，它会将日志发送到 cloudwatch。它可以正常工作几个小时，然后突然停止。

这是来自 awslogs.log 的日志

2020-07-06 14:58:27,701 - cwlogs.push.reader - WARNING - 23093 - Thread-6 - Fall back to previous event time: {'timestamp': 1594062573000, 'start_position': 85848600L, 'end_position': 85848777L}, previousEventTime: 1594062573000, reason: timestamp could not be parsed from message.
2020-07-06 14:58:27,701 - cwlogs.push.batch - WARNING - 23093 - Thread-6 - Skip event: {'timestamp': 1594062573000, 'start_position': 85848600L, 'end_position': 85848777L}, reason: timestamp is more than 2 hours in future.
2020-07-06 14:58:27,701 - cwlogs.push.reader - WARNING - 23093 - Thread-6 - Fall back to previous event time: {'timestamp': 1594062573000, 'start_position': 85848777L, 'end_position': 85848952L}, previousEventTime: 1594062573000, reason: timestamp could not be parsed from message.
2020-07-06 14:58:27,701 - cwlogs.push.batch - WARNING - 23093 - Thread-6 - Skip event: {'timestamp': 1594062573000, 'start_position': 85848777L, 'end_position': 85848952L}, reason: timestamp is more than 2 hours in future.

这是我在 /var/awslogs/etc/config/api.conf 中的配置

[/var/log/app.js/api.log]
datetime_format = %Y-%m-%d %H:%M:%S
buffer_duration = 5000
log_stream_name = {hostname}
initial_position = end_of_file
log_group_name = app-js-logs-prod
file = /var/log/app.js/api.log

[/root/.pm2/pm2.log]
datetime_format = %Y-%m-%d %H:%M:%S
buffer_duration = 5000
log_stream_name = {hostname}
initial_position = end_of_file
log_group_name = pm2-logs-prod

我无法找出跳过日志的原因。任何帮助将不胜感激。

编辑：

timedatectl 输出：

root@ip-10-0-5-68:/home/ubuntu# timedatectl
                      Local time: Mon 2020-07-06 15:18:42 UTC
                  Universal time: Mon 2020-07-06 15:18:42 UTC
                        RTC time: Mon 2020-07-06 15:18:43
                       Time zone: Etc/UTC (UTC, +0000)
       System clock synchronized: yes
systemd-timesyncd.service active: yes

我的当地时间应该是 IST。我的系统有问题吗？

Answer 1

在将请求发送到 CloudWatch 之前，系统会根据代理认为的时间对您的日志文件中的已解析日志执行检查。

您应首先验证系统时间是否正确（在其当前时区中）并确保日志日期时区与本地时区匹配（这是默认时区）。

如果这些匹配，则重启 cloudwatch 代理。

如果仍然无法解决，请遵循previous post 上的一些建议