Skip to content
This repository has been archived by the owner on Apr 1, 2024. It is now read-only.

Eliminate Zeek warning: calc_next_rotate(): can't parse rotation base time #28

Closed
philrz opened this issue May 26, 2020 · 1 comment · Fixed by #29
Closed

Eliminate Zeek warning: calc_next_rotate(): can't parse rotation base time #28

philrz opened this issue May 26, 2020 · 1 comment · Fixed by #29
Assignees
Milestone

Comments

@philrz
Copy link

philrz commented May 26, 2020

While the new Zeek artifacts starting with v3.2.0-dev-brim1 are generating logs ok, we've noticed a warning that shows up fairly often when processing pcaps:

1521835102.636608 warning in <command line>, line 7: calc_next_rotate(): can't parse rotation base time

We've observed that these generate events in the reporter.log which causes an integration test failure and may also confuse users. Rather than just filter them out, @nwt has confirmed we should be able to fix this instead.

@philrz philrz transferred this issue from brimdata/zui May 27, 2020
@philrz philrz added this to the Brim v0.10.0 milestone May 27, 2020
@nwt nwt closed this as completed in #29 May 28, 2020
@philrz
Copy link
Author

philrz commented May 28, 2020

Verified via the Windows artifact produced via Actions run https://github.com/brimsec/zeek/actions/runs/117364694. A reporter.log still gets generated, but the calc_next_rotate() events that were sassing our integration tests are no longer present. After having turned a pcap into Zeek logs using the artifact, the only reporter events are ones from a separate/known/benign issue:

C:\Users\Phil\Desktop\windows-2019\zeek-4002883.windows-amd64\zeek>cat reporter.log | zq -t "count() by message" -
#0:record[message:bstring,count:uint64]
0:[can't issue DNS request;300;]

Thanks @nwt!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants