AWS CloudWatch Log Being Hammered with 'multilineStarter is missing in logevent'

Question

I have installed AWS CloudWatch Agent on one of my instances (windows) and I get in the agent log file this message:

2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true

And it is HAMMERING the log file - I get around 700 lines of this repeated PER SECOND!

I searched google for "multilineStarter" and get 0 results. How can I be the only one to have this in my log file? LoL.

Some details:

Windows Server 2016 CloudWatch Agent: "version": "1.210825.0" My Config:

{
"logs": {
    "logs_collected": {
        "windows_events": {
            "collect_list": [
                {
                    "event_format": "xml",
                    "event_levels": [
                        "WARNING",
                        "ERROR",
                        "CRITICAL"
                    ],
                    "event_name": "System",
                    "log_group_name": "System",
                    "log_stream_name": "{instance_id}"
                },
                {
                    "event_format": "xml",
                    "event_levels": [
                        "WARNING",
                        "ERROR",
                        "CRITICAL"
                    ],
                    "event_name": "Application",
                    "log_group_name": "Application",
                    "log_stream_name": "{instance_id}"
                }
            ]
        }
    }
},
"metrics": {
    "append_dimensions": {
        "AutoScalingGroupName": "${aws:AutoScalingGroupName}",
        "ImageId": "${aws:ImageId}",
        "InstanceId": "${aws:InstanceId}",
        "InstanceType": "${aws:InstanceType}"
    },
    "metrics_collected": {
        "LogicalDisk": {
            "measurement": [
                "% Free Space"
            ],
            "metrics_collection_interval": 60,
            "resources": [
                "*"
            ]
        },
        "Memory": {
            "measurement": [
                "% Committed Bytes In Use"
            ],
            "metrics_collection_interval": 60
        },
        "Paging File": {
            "measurement": [
                "% Usage"
            ],
            "metrics_collection_interval": 60,
            "resources": [
                "*"
            ]
        },
        "PhysicalDisk": {
            "measurement": [
                "% Disk Time"
            ],
            "metrics_collection_interval": 60,
            "resources": [
                "*"
            ]
        },
        "Processor": {
            "measurement": [
                "% User Time",
                "% Idle Time",
                "% Interrupt Time"
            ],
            "metrics_collection_interval": 60,
            "resources": [
                "_Total"
            ]
        },
        "statsd": {
            "metrics_aggregation_interval": 60,
            "metrics_collection_interval": 30,
            "service_address": ":8125"
        }
    }
}

}

When the service starts I have this in log:

    2019/04/14 12:10:52 I! Config has been translated into TOML C:\ProgramData\Amazon\AmazonCloudWatchAgent\\amazon-cloudwatch-agent.toml 
2019-04-14T16:10:53Z I! cloudwatch: get unique roll up list []
2019-04-14T16:10:53Z I! Starting AmazonCloudWatchAgent (version 1.210825.0)
2019-04-14T16:10:53Z I! Loaded outputs: cloudwatch cloudwatchlogs
2019-04-14T16:10:53Z I! cloudwatch: publish with ForceFlushInterval: 1m0s, Publish Jitter: 22s
2019-04-14T16:10:53Z I! Loaded inputs: win_perf_counters windows_event_log statsd
2019-04-14T16:10:53Z I! Tags enabled: host=XXXXXX
2019-04-14T16:10:53Z I! Agent Config: Interval:1m0s, Quiet:false, Hostname:"XXXXXX", Flush Interval:1s 
2019-04-14T16:10:53Z I! Started the statsd service on :8125
2019-04-14T16:10:53Z I! Reading from offset 56351 in Amazon_CloudWatch_WindowsEventLog_Application
2019-04-14T16:10:53Z I! Reading from offset 62594 in Amazon_CloudWatch_WindowsEventLog_System
2019-04-14T16:10:53Z I! Statsd listener listening on:  [::]:8125
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true
2019-04-14T16:10:53Z W! multilineStarter is missing in logevent. multilineStarter: true

Anyone have any thoughts on this?

Thanks

I think it might have to do with: multi_line_start_pattern. I removed statsd section from my config and that entry no longer appears. I have not yet setup any specific logs to be collected, so I have not even defined that parameter for any logs. The wizard asks to use statsd and then asks later if I want to setup any logs to collect. I said no because I wasnt ready for that yet. I'll update if I still get this after I setup logs to collect. — Matthew Lanteigne, Apr 14 '19 at 16:31

AWS CloudWatch Log Being Hammered with 'multilineStarter is missing in logevent'

0 Answers0