Zeek Error.

ThomasDr

Hello,
I have installed zeek v3.0.6_4 on pfsense 2.7.2-RELEASE (amd64) .
And I got this Mails:

User-Agent: ZeekControl 2.5.0-24

Traceback (most recent call last):
  File "/usr/local/bin/trace-summary", line 1115, in <module>
    readConnSummaries(file)
  File "/usr/local/bin/trace-summary", line 508, in readConnSummaries
    parseConnLine(line, field_sep, unset_field, idx, max_idx_1, is_json, scope_separator)
  File "/usr/local/bin/trace-summary", line 844, in parseConnLine
    LocalNetsIntervals[iupdate.src_ip].update(iupdate)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
  File "/usr/local/lib/zeek/python/SubnetTree.py", line 103, in __getitem__
    return _SubnetTree.SubnetTree___getitem__(self, cidr)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xc1 in position 1: invalid start byte
        1.39 real         0.13 user         0.02 sys

regards
ThomasD

7queue

@ThomasDr I'm getting this as well, was there ever a resolution found? I've been trying to track this issue down without luck.

melvinlusk

It looks like a bug was entered recently:
https://redmine.pfsense.org/issues/15709

I'm having the same issue, except the bug states that this only happens when you've selected "Check to mail connection summary reports each log rotation interval" in the ZeekControl settings; however, I don't have that enabled and still receive the notification.

pfSense 2.7.2
Zeek 3.0.6_4