This document provides information on the reference time of the log time stamp in the processing stage of the log monitoring process.
Changing the reference time of the timestamp
The reference time of the log time stamp has been changed from WhaTap agent's collection time to WhaTap collection server's log handling time.
Under normal circumstances, you can search logs the same as before without much difference. After the change, the log monitoring can be used consistently without modification even in the following cases:
When using NTP, the server time of the monitoring target is set to a time earlier or later than the standard time.
Without using NTP, the server times in multiple monitoring targets are different.
Details of the changes
Setting the search range of the time selector
By a change of the timestamp's reference time, the time selector also operates based on the WhaTap collection server time. As a result, there may be a difference between agent collection time and WhaTap collection server time, resulting in the logs that are not included in the search range. In this case, searching is possible by specifying the search range wider.
The X axis of the Log trend chart displays at least 1-minute increments. Even if the log reference time has been changed, it does not affect the overall trend of the chart.
agenttime index has been added that indicates the log creation time in the log message. Check the agent collection time through the
WhaTap collection server time that follows the UTC time zone, is converted according to the user's browser time for display.
For example, the UTC+9 time appears in Korea.
Reference time for each step
Logs are collected through the following 3 steps: Different reference times may be used for each step.
Log creation time
Deviations may occur depending on the time or logging policy of the monitoring target.
Agent collection time
Deviations may occur depending on how the product or agent in use collects logs and which logs are generated.
Depending on your settings, logs are collected in near real-time from the log library or log files.
The log library is only supported for Java products.
Collect near real-time logs from log files.
Logs are collected in semi-real time or every few minutes depending on AWS Resource policies.
WhaTap collection server time
Regardless of what you monitor or how you generate logs, we use the time stored on the collection server.
There is a big difference between WhaTap agent collection time and WhaTap collection server time. Check the server time of the monitoring target. If the monitored server time is set to a time earlier or later than the server time, this affects the agent collection time.