Universal forwarder:
02-08-2012 12:40:27.293 +0000 INFO ArchiveProcessor - Finished processing file '/var/log/hadoop-0.20/hadoop-hadoop-tasktracker-worker1.inrdb1.out.gz', removing from stats
02-08-2012 12:40:27.293 +0000 INFO ArchiveProcessor - handling file=/var/log/hadoop-0.20/hadoop-hadoop-tasktracker-worker1.inrdb1.log.2011-12-23.gz
02-08-2012 12:40:27.294 +0000 INFO ArchiveProcessor - reading path=/var/log/hadoop-0.20/hadoop-hadoop-tasktracker-worker1.inrdb1.log.2011-12-23.gz (seek=0 len=184652)
Indexer:
02-08-2012 12:37:32.850 +0000 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event. Context="source::/var/log/hadoop-0.20/hadoop-hadoop-tasktracker-worker1.inrdb1..log.2012-02-01.gz|host::worker1.inrdb1.|hadoop-hadoop-tasktracker-worker1.inrdb1..log-2|remoteport::35680" Text="Thread 575469 (994217244@qtp-593352976-3819):\n State: TIMED_WAITING\n Blocked count: 8141\n Waited ..."
02-08-2012 12:37:32.852 +0000 WARN DateParserVerbose - Time parsed (Wed Feb 1 13:31:40 2012) is too far away from the previous event's time (Fri Apr 29 14:11:19 2011) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive. Context="source::/var/log/hadoop-0.20/hadoop-hadoop-tasktracker-worker1.inrdb1..log.2012-02-01.gz|host::worker1.inrdb1.|hadoop-hadoop-tasktracker-worker1.inrdb1..log-2|remoteport::35680"