zeek-agent-v2 icon indicating copy to clipboard operation
zeek-agent-v2 copied to clipboard

Issue with ISO8601 dates breaking communication with Zeek

Open timwoj opened this issue 2 years ago • 1 comments

At startup I get this error message, and then it disconnects from the websocket:

[2023-12-01 11:15:21.050] [Zeek Agent] [warning] WebSocket error for localhost:9997: deserialization_failed (input #1 contained invalid data -> caf::pec::unexpected_character("caf::pec::unexpected_character at line 1, column 20 for input \"2023-12-01T11:15:21-0700.000\""))

I can fix this by removing the "%z" from here: https://github.com/zeek/zeek-agent-v2/blob/a263825c86508cf04e0332555f998c00a50c76ef/src/util/helpers.h#L106

but that removes the time zone information we pass through to zeek. I added some debugging and the string we're actually creating there is 2023-12-01T11:15:21-0700, which is a valid ISO8601 timestsamp. It's also different from the string in the error message we're getting in that it doesn't have the decimals at the end.

timwoj avatar Dec 01 '23 18:12 timwoj

Possibly related: https://github.com/zeek/broker/issues/346

awelzel avatar Dec 01 '23 18:12 awelzel