Unit test for ISO 8601 output

A unit test for ISO 8601 output ensures that both the log and event time
is in ISO 8601 format.

test/falco_test.py

@@ -159,6 +159,8 @@ def setUp(self):
         if self.run_tags == '':
             self.run_tags=[]
 
+        self.time_iso_8601 = self.params.get('time_iso_8601', '*', default=False)
+
     def tearDown(self):
         if self.package != 'None':
             self.uninstall_package()
@@ -385,6 +387,9 @@ def test(self):
         if self.all_events:
             cmd += ' -A'
 
+        if self.time_iso_8601:
+            cmd += ' -o time_format_iso_8601=true'
+
         self.falco_proc = process.SubProcess(cmd)
 
         res = self.falco_proc.run(timeout=180, sig=9)

test/falco_tests.yaml

@@ -770,4 +770,14 @@ trace_files: !mux
     stderr_contains: Rules require engine version 9999999, but engine version is
     rules_file:
       - rules/engine_version_mismatch.yaml
-    trace_file: trace_files/cat_write.scap
+    trace_file: trace_files/cat_write.scap
+
+  time_iso_8601:
+    time_iso_8601: true
+    detect: True
+    detect_level: WARNING
+    rules_file:
+      - rules/single_rule.yaml
+    trace_file: trace_files/cat_write.scap
+    stdout_contains: "2016-08-04T16:17:57.882054739\\+0000: Warning An open was seen"
+    stderr_contains: "^\\d\\d\\d\\d-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\+0000"