-
Notifications
You must be signed in to change notification settings - Fork 35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
JSON logging failing with error: jsonlog: Can't serialize #25
Comments
The JSON log is enabled, but it's failing. Which version of Cowrie are you using? Do you use the Docker image, a |
thank you so much for your response, I am using the below yaml file on K8s 1.21 to deploy Cowrie, Can you please tell me where to provide
|
I am using Cowrie Version 2.2.0. I like this version because of below output but only problem is, getting this as a "String"
|
Hi team, can you please help me on this issue, If I have json format, its easy to create kibana dashboard |
I just checked the Docker container at hub.docker.com/cowrie/cowrie and that successfully logs to JSON. If you get persistent errors with JSON serialisation failing, please ensure all your components are up to date and please share which event is causing the serialisation failure. |
thank you so much Michel for your response. I am using the cowrie 2.2 version and Only for login even I am getting error
on new cowrie, I am not seeing the error, but the problem is, In the new version, I am not getting src_ip and username and password fields like the above output, that's the reason I am using cowrie 2.2
I am looking for Old cowrie logs format. |
I'm very confused by what version you are using. If you are running on k8s, you are using Changing k8s versions is not going to change a single thing, it's only responsible for starting your container. Your root cause will be somewhere inside the container. Cowrie has 2 log files. |
10 days before cowrie/cowrie:latest was having a different image, the same image I pushed to my local repository and using the same |
can you please help me to get the below kind of output in cowrie/cowrie:latest eventid': 'cowrie.login.success', 'username': b'root', 'password': b'deva', 'message': "login attempt [b'root'/b'deva'] succeeded", 'sensor': 'cowrie-app-5bcb76dd6b-8s7wn', 'timestamp': '2021-05-22T07:12:08.262918Z', 'src_ip': '10.144.0.2', 'session': '92fcfba6d9b2'}' |
Asking the same question over and over will not give different results. |
So I think you are not looking at the file output, you are looking at standard output from the container? |
The same format its coming in elastic search also, because the below logs is considering a string, if I use parsers and filter in fluent bit, its not working. log": [ |
Please share your configuration. What you are looking at is an error message. This is not the message you want to parse. It's the error message it can't write that data to JSON. Please share your exact configuration, how you are sending to Elastic, etc. |
Thank you Michel for your response. This is my fluentbit Configuration file.
|
I just checked the You can use environment variables.
|
Hi @micheloosterhof, nice to meet you! I experience the same issue with broken authentication records using the cowrie/cowrie:latest image. The issue persists for at least 1 month (when I deployed it the first time) and up until now.
Here is an example stdout log snippet with 2 errors (the first and the last lines):
And here are a few of the many broken JSON entries in the cowrie.json. As you can see, they don't follow the JSON format and the username and password values are not available:
|
This is really strange, like it's mixing 2 events together. In both cases it's the username field containing another event. |
@micheloosterhof, sure! Here we go: #28. Originally, I put it here because I saw that the topic starter had the same jsonlog serialization error message in logs when parsing cowrie.login.success records. |
@devamtech are you still experiencing issues or did this work for you? |
Hi All,
need your help
I have deployed cowrie honeypot, I am getting logs in the below format, can you please me to get logs in json format instead of a string.
one latest VC, I am not getting Src_ip and user name and password fields only getting direct user details and password, old cowries has above logs but its in string format.
Can you please help me to get it in json format
Many thanks in advance.
The text was updated successfully, but these errors were encountered: