Repository: cowrie/cowrie

Issue:
builtins.KeyError: 'log_time' Python error
**Describe the bug**
Cowrie won't log properly, due that output plugins are not working -> output_splunk
Following error occurs:
```
2021-04-28T07:00:17.796991Z [twisted.logger._observer#critical] Temporarily disabling observer LegacyLogObserverWrapper(<bound method Output.emit of <cowrie.output.virustotal.Output object at 0x7f3a13c9c550>>) due to exception: [Failure instance: Traceback: <class 'KeyError'>: 'log_time'
        /home/cowrie/cowrie/src/cowrie/ssh/transport.py:246:connectionLost
        /home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/python/threadable.py:51:sync
        /home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/python/log.py:281:msg
        /home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/logger/_legacy.py:147:publishToNewObserver
        --- <exception caught here> ---
        /home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/logger/_observer.py:82:__call__
        /home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/logger/_legacy.py:55:__call__
        ]
        Traceback (most recent call last):
          File "/home/cowrie/cowrie/src/cowrie/ssh/transport.py", line 246, in connectionLost
            log.msg(
          File "/home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/python/threadable.py", line 51, in sync
            return function(self, *args, **kwargs)
          File "/home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/python/log.py", line 281, in msg
            _publishNew(self._publishPublisher, actualEventDict, textFromEventDict)
          File "/home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/logger/_legacy.py", line 147, in publishToNewObserver
            observer(eventDict)
        --- <exception caught here> ---
          File "/home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/logger/_observer.py", line 82, in __call__
            observer(event)
          File "/home/cowrie/cowrie/cowrie-env/lib/python3.8/site-packages/twisted/logger/_legacy.py", line 55, in __call__
            event["time"] = event["log_time"]
        builtins.KeyError: 'log_time'
```

**To Reproduce**
Steps to reproduce the behavior:
1. git clone cowrie
2. setup venv
3. setup cowrie.cfg
4. include splunk output
5. run cowrie
6. run honeypot session

**Expected behavior**
Cowrie should properly log.

**Server (please complete the following information):**
 - OS: `Linux cowrie-1 5.4.103-1-pve #1 SMP PVE 5.4.103-1 (Sun, 07 Mar 2021 15:55:09 +0100) x86_64 x86_64 x86_64 GNU/Linux`
 - Python: Python 3.8.6



Discussion:
Thanks for reporting this, I'm running into the same error with other output such as textlog, MySQL and SQLite as well.
Steps to reproduce are the same, with the difference of setting up those output methods in the cowrie.cfg file.


Thanks for notifying about this! Maybe something has changed upstream in Twisted. I'll investigate.
I'm trying to replicate this, but I can't seem to, which makes me think it might be something in your environment.
Which version of Twisted are you using? and which version of Cowrie (downloaded version or git pull)
The output of pip show twisted:
```
Name: Twisted
Version: 21.2.0
Summary: An asynchronous networking framework written in Python
Home-page: https://twistedmatrix.com/
Author: Twisted Matrix Laboratories
Author-email: twisted-python@twistedmatrix.com
License: MIT
Location: /home/cowrie/cowrie/cowrie-env/lib/python3.7/site-packages
Requires: constantly, hyperlink, attrs, incremental, Automat, zope.interface
Required-by: treq
```

I set up Cowrie according to the documentation and cloned the repo.
(sorry if this double posts, I sent a reply earlier via email but it doesn't seem to add to thread)
Okay, I can reproduce it now. Thanks for the info! I tried with the virustotal plugin earlier, but now I get the error with `textlog`.

Resolving patch:
diff --git a/src/cowrie/core/output.py b/src/cowrie/core/output.py
--- a/src/cowrie/core/output.py
+++ b/src/cowrie/core/output.py
@@ -158,7 +158,7 @@ def emit(self, event: dict) -> None:
         if "message" not in event and "format" not in event:
             return
 
-        ev: Dict[str, any] = event  # type: ignore
+        ev: Dict[str, any] = event.copy()  # type: ignore
         ev["sensor"] = self.sensor
 
         if "isError" in ev:


Test patch: