Project

General

Profile

Actions

Bug #3690

closed

eve.json windows timestamp field has "Eastern Daylight Time" appended to timestamp

Added by Bryan Jones over 1 year ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport, Needs backport to 4.1, Needs backport to 5.0

Description

I am running Suricata-5.0.2-1-64bit.exe suricata install on windows. When I try to import the json data into mysql using this tool, https://github.com/beave/meer, it fails on windows because the timestamp looks like this "2020-05-04T01:08:06.39502Eastern Daylight Time" In linux it looks like this. "2020-05-04T01:08:06.3950273-0400.

Note I am typing these out because the systems are not on this machine and I can't copy paste between them easily. So ignore minor time error details in case I misstyped

Is this something I can adjust in a config file, if not, can you point me to the code where this is handled so that I can strip out the "Eastern Daylight Time" string from the timestamp?

thanks


Related issues

Copied to Bug #3723: eve.json windows timestamp field has "Eastern Daylight Time" appended to timestampClosedVictor JulienActions
Copied to Bug #3724: eve.json windows timestamp field has "Eastern Daylight Time" appended to timestampClosedShivani BhardwajActions
Actions #1

Updated by Bryan Jones over 1 year ago

This looks like the relevant commit.
https://github.com/OISF/suricata/commit/b12c53cd51ca1b24039c248f1eab6808d9686e4b

Bryan Jones wrote:

I am running Suricata-5.0.2-1-64bit.exe suricata install on windows. When I try to import the json data into mysql using this tool, https://github.com/beave/meer, it fails on windows because the timestamp looks like this "2020-05-04T01:08:06.39502Eastern Daylight Time" In linux it looks like this. "2020-05-04T01:08:06.3950273-0400.

Note I am typing these out because the systems are not on this machine and I can't copy paste between them easily. So ignore minor time error details in case I misstyped

Is this something I can adjust in a config file, if not, can you point me to the code where this is handled so that I can strip out the "Eastern Daylight Time" string from the timestamp?

thanks

Actions #2

Updated by Victor Julien over 1 year ago

Some discussion about this here on the MinGW mailinglist: https://sourceforge.net/p/mingw/mailman/message/16286257/
Includes a workaround suggestion.

Actions #3

Updated by Victor Julien over 1 year ago

  • Tracker changed from Support to Bug
  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Target version set to 6.0.0beta1
  • Label Needs backport added
Actions #4

Updated by Victor Julien over 1 year ago

  • Label Needs backport to 4.1, Needs backport to 5.0 added
Actions #6

Updated by Victor Julien over 1 year ago

  • Status changed from Assigned to Closed
Actions #7

Updated by Jeff Lucovsky over 1 year ago

  • Copied to Bug #3723: eve.json windows timestamp field has "Eastern Daylight Time" appended to timestamp added
Actions #8

Updated by Jeff Lucovsky over 1 year ago

  • Copied to Bug #3724: eve.json windows timestamp field has "Eastern Daylight Time" appended to timestamp added
Actions

Also available in: Atom PDF