Repository: cowrie/cowrie

Issue:
output_localsyslog exceptions.KeyError: 'isError'
After pulling the most recent version of cowrie to some of my honeypots, I get this error when a new connection I enabled [output_localsyslog] with configuration below:
```
[output_localsyslog]
enabled = true
facility = LOCAL5
format = text
```
The log error shows this:
```
2018-10-11T18:29:01.778300+0000 [twisted.logger._observer#critical] Temporarily disabling observer LegacyLogObserverWrapper(<bound method Output.emit of <cowrie.output.localsyslog.Output object at 0xb55ae7b0>>) due to exception: [Failure instance: Traceback: <type 'exceptions.KeyError'>: 'isError'
	/opt/cowrie/src/cowrie/core/checkers.py:110:checkUserPass
	/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/threadable.py:53:sync
	/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/log.py:286:msg
	/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py:154:publishToNewObserver
	--- <exception caught here> ---
	/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_observer.py:131:__call__
	/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py:93:__call__
	/opt/cowrie/src/cowrie/core/output.py:209:emit
	/opt/cowrie/src/cowrie/output/localsyslog.py:65:write
	/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/syslog.py:76:emit
	]
	Traceback (most recent call last):
	  File "/opt/cowrie/src/cowrie/core/checkers.py", line 110, in checkUserPass
	    password=thepassword)
	  File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/threadable.py", line 53, in sync
	    return function(self, *args, **kwargs)
	  File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/log.py", line 286, in msg
	    _publishNew(self._publishPublisher, actualEventDict, textFromEventDict)
	  File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py", line 154, in publishToNewObserver
	    observer(eventDict)
	--- <exception caught here> ---
	  File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_observer.py", line 131, in __call__
	    observer(event)
	  File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py", line 93, in __call__
	    self.legacyObserver(event)
	  File "/opt/cowrie/src/cowrie/core/output.py", line 209, in emit
	    self.write(ev)
	  File "/opt/cowrie/src/cowrie/output/localsyslog.py", line 65, in write
	    self.syslog.emit(logentry)
	  File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/syslog.py", line 76, in emit
	    if eventDict['isError']:
	exceptions.KeyError: 'isError'
```


Discussion:
an other error releated:
```
2018-10-11T18:52:00.840372+0000 [twisted.logger._observer#critical] Temporarily disabling observer LegacyLogObserverWrapper(<bound method Output.emit of <cowrie.output.localsyslog.Output object at 0xb559fed0>>) due to exception: [Failure instance: Traceback: <type 'exceptions.KeyError'>: 'isError'
        /opt/cowrie/src/cowrie/telnet/transport.py:244:connectionLost
        /opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/threadable.py:53:sync
        /opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/log.py:286:msg
        /opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py:154:publishToNewObserver
        --- <exception caught here> ---
        /opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_observer.py:131:__call__
        /opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py:93:__call__
        /opt/cowrie/src/cowrie/core/output.py:209:emit
        /opt/cowrie/src/cowrie/output/localsyslog.py:65:write
        /opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/syslog.py:76:emit
        ]
        Traceback (most recent call last):
          File "/opt/cowrie/src/cowrie/telnet/transport.py", line 244, in connectionLost
            duration=duration)
          File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/threadable.py", line 53, in sync
            return function(self, *args, **kwargs)
          File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/log.py", line 286, in msg
            _publishNew(self._publishPublisher, actualEventDict, textFromEventDict)
          File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py", line 154, in publishToNewObserver
            observer(eventDict)
        --- <exception caught here> ---
          File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_observer.py", line 131, in __call__
            observer(event)
          File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/logger/_legacy.py", line 93, in __call__
            self.legacyObserver(event)
          File "/opt/cowrie/src/cowrie/core/output.py", line 209, in emit
            self.write(ev)
          File "/opt/cowrie/src/cowrie/output/localsyslog.py", line 65, in write
            self.syslog.emit(logentry)
          File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/syslog.py", line 76, in emit
            if eventDict['isError']:
        exceptions.KeyError: 'isError'
```
hi! you're using text output, I assume?
Try modifying 
`src/cowrie/output/localsyslog.py` so the last lines look like this:

```
            # message appears with additional spaces if message key is defined
            logentry['message'] = [logentry['message']]
            if 'isError' not in logentry:
                logentry['isError'] = False
            self.syslog.emit(logentry)
```

If that works, please let me know!
Hi @micheloosterhof, sorry for my bad redaction.

Thanks for your help, apparently it's works well.  
Ok! I'll put that in the main code then.

Resolving patch:
diff --git a/src/cowrie/output/localsyslog.py b/src/cowrie/output/localsyslog.py
--- a/src/cowrie/output/localsyslog.py
+++ b/src/cowrie/output/localsyslog.py
@@ -53,6 +53,9 @@ def stop(self):
         pass
 
     def write(self, logentry):
+        if 'isError' not in logentry:
+            logentry['isError'] = False
+
         if self.format == 'cef':
             self.syslog.emit({
                 'message': cowrie.core.cef.formatCef(logentry),


Test patch: