Suricata causing crashes - Uncaught ValueError: date_create_from_format():

[4o4rh]

PHP errors

PHP ERROR: Type: 1, File: /usr/local/www/widgets/widgets/suricata_alerts.widget.php, Line: 183, Message: Uncaught ValueError: date_create_from_format(): Argument #2 ($datetime) must not contain any null bytes in /usr/local/www/widgets/widgets/suricata_alerts.widget.php:183
Stack trace:
#0 /usr/local/www/widgets/widgets/suricata_alerts.widget.php(183): date_create_from_format('m/d/Y-H:i:s.u', '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00...')
#1 /usr/local/www/widgets/widgets/suricata_alerts.widget.php(78): suricata_widget_get_alerts()
#2 {main}
thrown @ 2023-03-12 21:08:16
PHP ERROR: Type: 1, File: /usr/local/www/widgets/widgets/suricata_alerts.widget.php, Line: 183, Message: Uncaught ValueError: date_create_from_format(): Argument #2 ($datetime) must not contain any null bytes in /usr/local/www/widgets/widgets/suricata_alerts.widget.php:183
Stack trace:
#0 /usr/local/www/widgets/widgets/suricata_alerts.widget.php(183): date_create_from_format('m/d/Y-H:i:s.u', '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00...')
#1 /usr/local/www/widgets/widgets/suricata_alerts.widget.php(78): suricata_widget_get_alerts()
#2 {main}
thrown @ 2023-03-12 22:53:08

[bmeeks]

That looks like an unexpected error in the data parsed from your alerts log file. Could that file have been corrupted? The date field should never be null in a properly formatted alerts log entry.

[4o4rh]

@bmeeks might explain it. the was a crash the other day for another reason

[bmeeks]

@gwaitsi said in Suricata causing crashes - Uncaught ValueError: date_create_from_format()::

@bmeeks might explain it. the was a crash the other day for another reason

I would delete the alerts log file and let it repopulate with new data. You can try clearing the alerts using the control on the ALERTS tab. But it's entirely possible the code in that tab might crash or complain about the corrupt file since the dashboard widget and the ALERTS tab both read the same alerts log file.

If that happens, you will need to manually delete the file from a shell prompt. You can find it in a subdirectory under /var/log/suricata/ named with the interface name and a UUID.