zeek-agent-v2
zeek-agent-v2 copied to clipboard
Issue with ISO8601 dates breaking communication with Zeek
At startup I get this error message, and then it disconnects from the websocket:
[2023-12-01 11:15:21.050] [Zeek Agent] [warning] WebSocket error for localhost:9997: deserialization_failed (input #1 contained invalid data -> caf::pec::unexpected_character("caf::pec::unexpected_character at line 1, column 20 for input \"2023-12-01T11:15:21-0700.000\""))
I can fix this by removing the "%z" from here: https://github.com/zeek/zeek-agent-v2/blob/a263825c86508cf04e0332555f998c00a50c76ef/src/util/helpers.h#L106
but that removes the time zone information we pass through to zeek. I added some debugging and the string we're actually creating there is 2023-12-01T11:15:21-0700, which is a valid ISO8601 timestsamp. It's also different from the string in the error message we're getting in that it doesn't have the decimals at the end.
Possibly related: https://github.com/zeek/broker/issues/346