Suricata PHP Error Line: 183, Message: Uncaught ValueError: date_create_from_format():

4o4rh

PHP ERROR: Type: 1, File: /usr/local/www/widgets/widgets/suricata_alerts.widget.php, Line: 183, Message: Uncaught ValueError: date_create_from_format(): Argument #2 ($datetime) must not contain any null bytes in /usr/local/www/widgets/widgets/suricata_alerts.widget.php:183
Stack trace:
#0 /usr/local/www/widgets/widgets/suricata_alerts.widget.php(183): date_create_from_format('m/d/Y-H:i:s.u', '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00...')
#1 /usr/local/www/widgets/widgets/suricata_alerts.widget.php(78): suricata_widget_get_alerts()
#2 {main}
thrown @ 2023-12-22 16:00:

4o4rh

@gwaitsi i am suddely getting this on mass after changing from legacy to inline.

bmeeks

I think I may have forgotten to port some fixes I did for that error on the ALERTS and BLOCKS tabs into the Dashboard Widget as well.

Let me check on that. The error is caused by either a blank line in the alerts.log file or an invalid timestamp entry. Usually it's a blank line that should be skipped.

If you want an instant fix, search through the active alerts.log file in /var/log/suricata/suricata_xxxyyyy/ to find and delete any blank lines.

PF_User

@bmeeks Thank you for the information I just started having the same problem I also shrunk the file size so its getting rotated more often.

bmeeks

This bug will be fixed in the next Suricata package update which is posted for the Netgate developer team to review and merge. The new package version with the fix will be 7.03. Look for it to post in the near future.