# Interesting intel.log issue

**URL:** <https://community.zeek.org/t/interesting-intel-log-issue/3309>\
**Category:** Zeek\
**Created:** [October 13, 2014, 8:19pm UTC](https://community.zeek.org/t/interesting-intel-log-issue/3309 "2014-10-13T20:19:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [October 13, 2014, 8:19pm UTC](https://community.zeek.org/t/interesting-intel-log-issue/3309/1 "2014-10-13T20:19:29Z")

</div>

Topic says it...for the most part most of my intel.log looks like:

1413230008.288997 CV0p4G1epvXb4Cagma x.x.x.x 41918 50.63.40.1 80 - - - 50.63.40.1 Intel::ADDR Conn::IN\_RESP alienvault  
1413230008.357789 CR6AUc3tAVZKpxue2c x.x.x.x 38068 50.63.40.1 80 - - - 50.63.40.1 Intel::ADDR Conn::IN\_RESP alienvault  
1413230267.919296 C4AHVH2Y7UUpTBbl2 x.x.x.x 49880 208.109.181.58 80 - - - 208.109.181.58 Intel::ADDR Conn::IN\_RESP alienvault  
1413230268.588344 CkxyU02h5MNCvSl4jc x.x.x.x 59045 208.109.181.58 80 - - - 208.109.181.58 Intel::ADDR Conn::IN\_RESP alienvault

But sometimes I see:  
1413230008.288997 CV0p4G1epvXb4Cagma x.x.x.x 41918 50.63.40.1 80 - - - 50.63.40.1 Intel::ADDR Conn::IN\_RESP alienvault  
1413230008.357789 CR6AUc3tAVZKpxue2c x.x.x.x 38068 50.63.40.1 80 - - - 50.63.40.1 Intel::ADDR Conn::IN\_RESP alienvaul1413230267.919296 C4AHVH2Y7UUpTBbl2 x.x.x.x 49880 208.109.181.58 80 - - - 208.109.181.58 Intel::ADDR Conn::IN\_RESP alienvault  
1411413230268.588344 CkxyU02h5MNCvSl4jc x.x.x.x 59045 208.109.181.58 80 - - - 208.109.181.58 Intel::ADDR Conn::IN\_RESP alienvault

where the timestamp has been tagged on to the end of the previous line..in this case it nukes the 't' in alienvault in the second line. Weird....currently I'm tailing this file and while it's a mild issue, if I was going to generate a report with grep/sed/awk as I do with some of the others this would be a problem. Thank you.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/interesting-intel-log-issue/3309/2 "2022-05-06T15:42:08Z")

</div>


