[BUG] Replay mode timeline bug #440
Description
Describe the bug
Replay mode appears to have a bug whereby the first two events are replayed at the same time, and for each event thereafter the time offset applied from one event to the next is off by 1 event.
To Reproduce
Steps to reproduce the behavior:
- Create a basic replay config (see below)
- Create a simple list of events (see example below)
- Note that the first two events are replayed at the same time, and every subsequent events offset is incorrect.
Expected behavior
Each log should be replayed 5 seconds apart, except the 5th log entry should be replayed 5 minutes after the previous
Jan 17 00:00:00 TEST 1
Jan 17 00:00:05 TEST 2
Jan 17 00:00:10 TEST 3
Jan 17 00:00:15 TEST 4
Jan 17 00:05:15 TEST 5
Actual behavior
The first two logs are replayed with the same time, all subsequent logs are offset by the previous logs offset.
Jan 17 00:00:00 TEST 1
Jan 17 00:00:00 TEST 2
Jan 17 00:00:05 TEST 3
Jan 17 00:00:10 TEST 4
Jan 17 00:00:15 TEST 5
Jan 17 00:05:15 TEST 6
Sample files and eventgen.conf file
eventgen.conf
[test.log]
mode = replay
outputMode = stdout
token.0.token = \w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}
token.0.replacementType = replaytimestamp
token.0.replacement = %b %d %H:%M:%S
test.log
Jan 17 00:00:00 TEST 1
Jan 17 00:00:05 TEST 2
Jan 17 00:00:10 TEST 3
Jan 17 00:00:15 TEST 4
Jan 17 00:05:15 TEST 5
Do you run eventgen with SA-eventgen?
No
If you are using eventgen with pip module mode (please complete the following information):
- python version: 3.8
- OS: Ubuntu 20.04 & Alpine 3.13
- Virtual Env is used: Yes
- Eventgen Version 7.2.1