Incorrect timestamp

Question

Incorrect timestamp

dougburks opened this issue 12 years ago · comments

Hello PRADS developers!

I'm running prads as follows:
prads -i eth1 -c prads.conf -u sguil -g sguil -L /nsm/sensor_data/dir/sancp/ -f /nsm/sensor_data/dir/pads.fifo

When I look at pads events in Sguil, they have the wrong timestamp.

For example, I have a pads event for a new web client with a timestamp of 2012-10-18 23:51:26. If I try to pivot from that event to full pcap, no matching tcp stream is found. If I search for HTTP events for the destination IP I find that the actual HTTP transaction occurred on 2012-10-19 23:01:41. I can pivot to pcap on this HTTP event and confirm that this matches the User Agent that the prads_client event was for. I can also search the sancp table for the destination IP and find the same timestamp of 2012-10-19 23:01:41 (so the sancp output plugin is sending the correct timestamp, but the pads output plugin is not).

Looking at the pads events, they appear to come in batches with the same exact timestamp. So perhaps prads is flushing a buffer only periodically and/or somehow grabbing the timestamp of the first pads event in a series of events?

Any ideas?

Thanks!

Kacper Why · Answer 1 · Sat Oct 27 2012 09:25:38 GMT+0800 (China Standard Time)

this is possible & would be real easy to debug if you had a pcap to reproduce the issue

Kacper Why · Answer 2 · Mon Oct 29 2012 22:41:09 GMT+0800 (China Standard Time)

please verify ;-)

Doug Burks · Answer 3 · Mon Oct 29 2012 23:03:21 GMT+0800 (China Standard Time)

Sending off to build farm now. Will test later today or tomorrow and let you know. Thanks so much!

Doug Burks · Answer 4 · Tue Oct 30 2012 04:44:28 GMT+0800 (China Standard Time)

Looking good so far! Thanks!