Eliminate Zeek warning: calc_next_rotate(): can't parse rotation base time
philrz opened this issue · comments
While the new Zeek artifacts starting with v3.2.0-dev-brim1 are generating logs ok, we've noticed a warning that shows up fairly often when processing pcaps:
1521835102.636608 warning in <command line>, line 7: calc_next_rotate(): can't parse rotation base time
We've observed that these generate events in the reporter.log which causes an integration test failure and may also confuse users. Rather than just filter them out, @nwt has confirmed we should be able to fix this instead.
Verified via the Windows artifact produced via Actions run https://github.com/brimsec/zeek/actions/runs/117364694. A reporter.log still gets generated, but the calc_next_rotate() events that were sassing our integration tests are no longer present. After having turned a pcap into Zeek logs using the artifact, the only reporter events are ones from a separate/known/benign issue:
C:\Users\Phil\Desktop\windows-2019\zeek-4002883.windows-amd64\zeek>cat reporter.log | zq -t "count() by message" -
#0:record[message:bstring,count:uint64]
0:[can't issue DNS request;300;]
Thanks @nwt!