zeek/zeek-agent-v2

Issue with ISO8601 dates breaking communication with Zeek

Opened this issue · 1 comments

At startup I get this error message, and then it disconnects from the websocket:

[2023-12-01 11:15:21.050] [Zeek Agent] [warning] WebSocket error for localhost:9997: deserialization_failed (input #1 contained invalid data -> caf::pec::unexpected_character("caf::pec::unexpected_character at line 1, column 20 for input \"2023-12-01T11:15:21-0700.000\""))

I can fix this by removing the "%z" from here:

b << std::put_time(tm, "%FT%T%z");

but that removes the time zone information we pass through to zeek. I added some debugging and the string we're actually creating there is 2023-12-01T11:15:21-0700, which is a valid ISO8601 timestsamp. It's also different from the string in the error message we're getting in that it doesn't have the decimals at the end.

Possibly related: zeek/broker#346