spohara79 / estreamer

SourceFire eStreamer python client libraries
Apache License 2.0
9 stars 4 forks source link

'Error' object has no attribute 'timestamp' #12

Open Phelms215 opened 5 years ago

Phelms215 commented 5 years ago

I am attempting to use this application as a stepping stone to collect connection events. When I run the cilent.py script I get the error message below. Any help would be greatly appreciated.

Error Message

Traceback (most recent call last):
  File "./client.py", line 79, in <module>
    sys.exit(main())
  File "./client.py", line 73, in main
    setLastStamp(mh.data.timestamp)
AttributeError: 'Error' object has no attribute 'timestamp'

estreamer.config

event_types=INTRUSION_EVENTS, MALWARE, USER, FILE, IMPACT, CONNECTION
[flags]
packets=1
metadata=1
ids=0
discovery=0
correlation=0
impact=0
ids_1=0
discovery_v2=0
connection=1
correlation_v2=0
discovery_v3=0
disable_events=0
connection_v3=1
correlation_v3=0
metadata_v2=0
metadata_v3=0
reserved=0
discovery_v4=0
connection_v4=0
correlation_v4=0
metadata_v4=0
user=0
correlation_v5=0
timestamp=1
discovery_v5=0
discovery_v6=0
connection_v5=0
extra_data=1
discovery_v7=0
correlation_v6=0
extended_request=1
spohara79 commented 5 years ago

Can you insert into line 72 of that script: print repr(mh) and tell me what that object looks like?

Phelms215 commented 5 years ago

Thanks for the quick reply - see the message below. I'm a novious in Python, but I spect the issue is it cannot process RUA user metadata.

<MessageHeader(ver=1, type=1, length=41, data=<Error(code=-1, length=35, error_msg=Could not process RUA user metadata)>)>
Traceback (most recent call last):
  File "./client.py", line 80, in <module>
    sys.exit(main())
  File "./client.py", line 74, in main
    setLastStamp(mh.data.timestamp)
AttributeError: 'Error' object has no attribute 'timestamp'
spohara79 commented 5 years ago

Ah. Are you using RUA in your environment?

Phelms215 commented 5 years ago

We do use the user agent in our environment - Is there a way to just ignore that data?

spohara79 commented 5 years ago

I'll try to dig in over the weekend.