Log Analytics agent for Linux + Collectd, misaligned TimeGenerated timestamps in Azure

%3CLINGO-SUB%20id%3D%22lingo-sub-1670448%22%20slang%3D%22en-US%22%3ELog%20Analytics%20agent%20for%20Linux%20%2B%20Collectd%2C%20misaligned%20TimeGenerated%20timestamps%20in%20Azure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1670448%22%20slang%3D%22en-US%22%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EHello%2C%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EI%20have%20both%20the%20Log%20Analytics%20(OMS)%20agent%20for%20Linux%20and%20collectd%20installed%20on%20a%20on-prem%20Ubuntu%20VM.%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EI'm%20sending%20various%20on-prem%20metrics%2C%20mostly%20ping%20and%20snmp%2C%20to%20Azure.%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3ECollectd%20sends%20its%20data%20to%20the%20OMS%20agent%20on%20port%2026000%20(write_http)%2C%20as%20explained%20in%20this%20page%3A%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-collectd%22%20target%3D%22_blank%22%20rel%3D%22noopener%20ugc%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-collectd%3C%2FA%3E%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EI%20noticed%20that%20the%20TimeGenerated%20timestamps%20of%20my%20metrics%20in%20Azure%20do%20not%20match%20those%20generated%20by%20collectd.%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EFor%20ex.%20with%20ping.%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3ECollectd%20is%20configured%20to%20ping%20a%20host%20every%2010%20sec.%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EThe%20TimeGenerated%20timestamps%20in%20collectd%20go%20like%3A%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E10%3A34%3A57%2C%20value%200.182%3CBR%20%2F%3E10%3A34%3A47%2C%20value%200.266%3CBR%20%2F%3E10%3A34%3A37%2C%20value%200.181%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EAnd%20when%20the%20metrics%20are%20in%20Azure%2C%20this%20is%20what%20I%20see%3A%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22same_timestamps.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218437i0093D56E7D4F1571%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22same_timestamps.png%22%20alt%3D%22same_timestamps.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EMultiple%20metrics%20have%20the%20same%20timestamps%2C%2010%3A35%3A06%20in%20this%20example.%3C%2FP%3E%3CP%20class%3D%22_1qeIAgB0cPwnLhDF9XSiJM%22%3EI%20don't%20understand%20why%20the%20TimeGenerated%20timestamps%20get%20modified%20on%20the%20way%20to%20Azure...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

Hello,

I have both the Log Analytics (OMS) agent for Linux and collectd installed on a on-prem Ubuntu VM.

I'm sending various on-prem metrics, mostly ping and snmp, to Azure.

Collectd sends its data to the OMS agent on port 26000 (write_http), as explained in this page:

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-collectd

I noticed that the TimeGenerated timestamps of my metrics in Azure do not match those generated by collectd.

 

For ex. with ping.

Collectd is configured to ping a host every 10 sec.

The TimeGenerated timestamps in collectd go like:

 

10:34:57, value 0.182
10:34:47, value 0.266
10:34:37, value 0.181

 

And when the metrics are in Azure, this is what I see:

same_timestamps.png

 

Multiple metrics have the same timestamps, 10:35:06 in this example.

I don't understand why the TimeGenerated timestamps get modified on the way to Azure...

0 Replies