Logs use tab delimiter yet do not remove tabs from logged data
Description
The attached pcap processed with bro -r pcapname will demonstrate the issue. View the http.log after processing and note that the field delimiter appears within a field.
I tried searching the official github mirror but don't know bro well enough to find the spot to look. I'd be happy to work on fixing this if you point me to the problem area (that's the hard part, right?)
Environment
ubuntu 12.04LTS server
Activity
Show:
Seth Hall
December 6, 2013, 2:45 AM
Which line in http.log are you specifically referring to? I don't see any problems with this log. We specifically handle the case of field separators within fields by hex escaping.
Seth Hall
February 10, 2014, 4:07 PM
Could not reproduce the problem.
