get_host_uptime.py

[cyberbeach33]

When trying to run "get_host_uptime.py" (samples/rtr/get_host_uptime.py), I get an error that when I search it seems that there is an issue with how the script is parsing the time/date format. Does anyone know what needs to be tweaked in the code to make the script work? The error is below... The "-48" is the final part of the %f value (it is a bunch of numbers followed by a "-" and then several more numbers. It seems like the code doesn't account for the non numerical content? Any help is appreciated.

Traceback (most recent call last):
File "C:\tools\Scripts\python\falconpy\get_host_uptime.py", line 192, in
display_results(retrieve_uptimes(retrieve_hosts(cmd_line.hostname, hosts, cmd_line.last_seen),
File "C:\tools\Scripts\python\falconpy\get_host_uptime.py", line 157, in display_results
output = convert_windows_time(output.replace("LastBootUpTime", "").strip())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\tools\Scripts\python\falconpy\get_host_uptime.py", line 146, in convert_windows_time
incoming = datetime.strptime(incoming[:incoming.find("+")], "%Y%m%d%H%M%S.%f")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Python312\Lib_strptime.py", line 555, in _strptime_datetime
tt, fraction, gmtoff_fraction = _strptime(data_string, format)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Python312\Lib_strptime.py", line 336, in _strptime
raise ValueError("unconverted data remains: %s" %
ValueError: unconverted data remains: -48

[jshcodes]

Hi @cyberbeach33 -

I can't recreate this issue directly which has me wondering if it may be a date format or regional setting on the host. (That's just a guess.) Let's try removing the problematic part altogether.

If you replace line 147 with the following, does the code execute without error when you target a Windows host?

incoming = datetime.strptime(incoming[:incoming.find("+")][:incoming.find(".")], "%Y%m%d%H%M%S")

[cyberbeach33]

Yes, It works perfectly when we remove the %f
Thanks!