I started to test this amazing tool and I'm having an issue when parsedmarc tries to process an email with a dmarc report.
Steps to reproduce:
Set system timezone set to anything else than UTC (I have it on CEST)
Start parsedmarc and send a dmarc report to the email address used in the configuration file
Expected result:
Process the report and send it to splunk without errors
Actual result: Traceback (most recent call last): File "/usr/local/bin/parsedmarc", line 11, in <module> load_entry_point('parsedmarc==6.6.1', 'console_scripts', 'parsedmarc')() File "/usr/local/lib/python3.7/site-packages/parsedmarc/cli.py", line 656, in _main strip_attachment_payloads=sa) File "/usr/local/lib/python3.7/site-packages/parsedmarc/__init__.py", line 1214, in watch_inbox idle_timeout=idle_timeout) File "/usr/local/lib/python3.7/site-packages/mailsuite/imap.py", line 192, in __init__ self._start_idle(idle_callback, idle_timeout=idle_timeout) File "/usr/local/lib/python3.7/site-packages/mailsuite/imap.py", line 83, in _start_idle idle_callback(self) File "/usr/local/lib/python3.7/site-packages/parsedmarc/__init__.py", line 1208, in idle_callback callback(res) File "/usr/local/lib/python3.7/site-packages/parsedmarc/cli.py", line 112, in process_reports aggregate_reports_) File "/usr/local/lib/python3.7/site-packages/parsedmarc/splunk.py", line 109, in save_aggregate_reports_to_splunk new_report["begin_date"]) File "/usr/local/lib/python3.7/site-packages/parsedmarc/utils.py", line 258, in human_timestamp_to_timestamp return human_timestamp_to_datetime(human_timestamp).timestamp() File "/usr/local/lib/python3.7/site-packages/parsedmarc/utils.py", line 244, in human_timestamp_to_datetime return dateparser.parse(human_timestamp, settings=settings) File "/usr/local/lib/python3.7/site-packages/dateparser/conf.py", line 83, in wrapper return f(*args, **kwargs) File "/usr/local/lib/python3.7/site-packages/dateparser/__init__.py", line 53, in parse data = parser.get_date_data(date_string, date_formats) File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 417, in get_date_data locale, date_string, date_formats, settings=self._settings) File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 189, in parse return instance._parse() File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 199, in _parse date_obj = parser() File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 212, in _try_freshness_parser return freshness_date_parser.get_date_data(self._get_translated_date(), self._settings) File "/usr/local/lib/python3.7/site-packages/dateparser/freshness_date_parser.py", line 147, in get_date_data date, period = self.parse(date_string, settings) File "/usr/local/lib/python3.7/site-packages/dateparser/freshness_date_parser.py", line 94, in parse self.now = datetime.now(self.get_local_tz()) File "/usr/local/lib/python3.7/site-packages/dateparser/freshness_date_parser.py", line 46, in get_local_tz return get_localzone() File "/usr/local/lib/python3.7/site-packages/tzlocal/unix.py", line 165, in get_localzone _cache_tz = _get_localzone() File "/usr/local/lib/python3.7/site-packages/tzlocal/unix.py", line 128, in _get_localzone utils.assert_tz_offset(tz) File "/usr/local/lib/python3.7/site-packages/tzlocal/utils.py", line 38, in assert_tz_offset raise ValueError(msg) ValueError: Timezone offset does not match system offset: 0 != 7200. Please, check your config files.
If I change the system timezone to UTC the issue is fixed, but unfortunately this is not a long term option for me
Here is my config file for parsedmarc:
[general]
save_aggregate = True
save_forensic = True
log_file = /opt/dmarc/output.log
[imap]
host = \<mail host>
user = \<mail user>
password = \<mail password>
watch = True
[splunk_hec]
url = https://localhost:8001
skip_certificate_verification = True
token = \<some token here>
index = email
Hello,
I started to test this amazing tool and I'm having an issue when parsedmarc tries to process an email with a dmarc report.
Steps to reproduce: Set system timezone set to anything else than UTC (I have it on CEST) Start parsedmarc and send a dmarc report to the email address used in the configuration file Expected result: Process the report and send it to splunk without errors Actual result:
Traceback (most recent call last): File "/usr/local/bin/parsedmarc", line 11, in <module> load_entry_point('parsedmarc==6.6.1', 'console_scripts', 'parsedmarc')() File "/usr/local/lib/python3.7/site-packages/parsedmarc/cli.py", line 656, in _main strip_attachment_payloads=sa) File "/usr/local/lib/python3.7/site-packages/parsedmarc/__init__.py", line 1214, in watch_inbox idle_timeout=idle_timeout) File "/usr/local/lib/python3.7/site-packages/mailsuite/imap.py", line 192, in __init__ self._start_idle(idle_callback, idle_timeout=idle_timeout) File "/usr/local/lib/python3.7/site-packages/mailsuite/imap.py", line 83, in _start_idle idle_callback(self) File "/usr/local/lib/python3.7/site-packages/parsedmarc/__init__.py", line 1208, in idle_callback callback(res) File "/usr/local/lib/python3.7/site-packages/parsedmarc/cli.py", line 112, in process_reports aggregate_reports_) File "/usr/local/lib/python3.7/site-packages/parsedmarc/splunk.py", line 109, in save_aggregate_reports_to_splunk new_report["begin_date"]) File "/usr/local/lib/python3.7/site-packages/parsedmarc/utils.py", line 258, in human_timestamp_to_timestamp return human_timestamp_to_datetime(human_timestamp).timestamp() File "/usr/local/lib/python3.7/site-packages/parsedmarc/utils.py", line 244, in human_timestamp_to_datetime return dateparser.parse(human_timestamp, settings=settings) File "/usr/local/lib/python3.7/site-packages/dateparser/conf.py", line 83, in wrapper return f(*args, **kwargs) File "/usr/local/lib/python3.7/site-packages/dateparser/__init__.py", line 53, in parse data = parser.get_date_data(date_string, date_formats) File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 417, in get_date_data locale, date_string, date_formats, settings=self._settings) File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 189, in parse return instance._parse() File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 199, in _parse date_obj = parser() File "/usr/local/lib/python3.7/site-packages/dateparser/date.py", line 212, in _try_freshness_parser return freshness_date_parser.get_date_data(self._get_translated_date(), self._settings) File "/usr/local/lib/python3.7/site-packages/dateparser/freshness_date_parser.py", line 147, in get_date_data date, period = self.parse(date_string, settings) File "/usr/local/lib/python3.7/site-packages/dateparser/freshness_date_parser.py", line 94, in parse self.now = datetime.now(self.get_local_tz()) File "/usr/local/lib/python3.7/site-packages/dateparser/freshness_date_parser.py", line 46, in get_local_tz return get_localzone() File "/usr/local/lib/python3.7/site-packages/tzlocal/unix.py", line 165, in get_localzone _cache_tz = _get_localzone() File "/usr/local/lib/python3.7/site-packages/tzlocal/unix.py", line 128, in _get_localzone utils.assert_tz_offset(tz) File "/usr/local/lib/python3.7/site-packages/tzlocal/utils.py", line 38, in assert_tz_offset raise ValueError(msg) ValueError: Timezone offset does not match system offset: 0 != 7200. Please, check your config files.
If I change the system timezone to UTC the issue is fixed, but unfortunately this is not a long term option for me
Here is my config file for parsedmarc: [general] save_aggregate = True save_forensic = True log_file = /opt/dmarc/output.log [imap] host = \<mail host> user = \<mail user> password = \<mail password> watch = True [splunk_hec] url = https://localhost:8001 skip_certificate_verification = True token = \<some token here> index = email
Thank you in advance!