add future time filter for log watchers when time across the year

[smileusd]

This pr is to fix this specail case:

1. kernel log file:

root@:~# tail -n 1 /var/log/messages
Jan  6 02:06:53 kubelet[8137]: E0106 02:06:53.560506    8137 summary_sys_containers.go:89] "Failed to get system container stats" err="failed to get cgroup stats for \"/systemd/system.slice\": failed to get container info for \"/systemd/system.slice\": unknown container \"/systemd/system.slice\"" containerName="/systemd/system.slice"

2. journal log:

root@:~# journalctl -u kubelet -n 1
Jan 06 02:07:53 kubelet[8137]: E0106 02:07:53.698973    8137 summary_sys_containers.go:89] "Failed to get system container stats" err="failed to get cgroup stats for \"/systemd/system.slice\": failed to get co>

These logs are not record "year" of time, so when the time from 2025 to 2026, the NPD will think that the log in 2025-12-31 is after than 2026-01-01, so the logs from 2025 will be captured into 2026.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: smileusd
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[SergeyKanzhelev]

These logs are not record "year" of time, so when the time from 2025 to 2026, the NPD will think that the log in 2025-12-31 is after than 2026-01-01, so the logs from 2025 will be captured into 2026.

Can you please clarify what happens? Does NPD think that those Jan logs are from 2025 or that Dec logs are for 2026? Simply discarding events as a solution sounds wrong if we need to process logs - we may loose something interesting there.

[smileusd]

These logs are not record "year" of time, so when the time from 2025 to 2026, the NPD will think that the log in 2025-12-31 is after than 2026-01-01, so the logs from 2025 will be captured into 2026.

Can you please clarify what happens? Does NPD think that those Jan logs are from 2025 or that Dec logs are for 2026? Simply discarding events as a solution sounds wrong if we need to process logs - we may loose something interesting there.

Yes, the kernel and journal log not record the year, NPD can not decide the 1.1.2026 is later than 12.31.2025. For example if we set the log loopback is only 3 mintnues, we will recived exceed 3 mintnues ago logs from year of 2025 if we restart NPD after 1.1.2026.

We have a case is that, we set a pattern, one log at 30.12.2025 match this pattern, we recived the event again at 7.1.2026 because restart NPD.