Issue with ISO8601 dates breaking communication with Zeek
Opened this issue · 1 comments
timwoj commented
At startup I get this error message, and then it disconnects from the websocket:
[2023-12-01 11:15:21.050] [Zeek Agent] [warning] WebSocket error for localhost:9997: deserialization_failed (input #1 contained invalid data -> caf::pec::unexpected_character("caf::pec::unexpected_character at line 1, column 20 for input \"2023-12-01T11:15:21-0700.000\""))
I can fix this by removing the "%z" from here:
zeek-agent-v2/src/util/helpers.h
Line 106 in a263825
but that removes the time zone information we pass through to zeek. I added some debugging and the string we're actually creating there is 2023-12-01T11:15:21-0700
, which is a valid ISO8601 timestsamp. It's also different from the string in the error message we're getting in that it doesn't have the decimals at the end.
awelzel commented
Possibly related: zeek/broker#346