Rudder

This is the error message in the webapp logs:

[2017-02-06 10:05:14] WARN  com.normation.inventory.provisioning.fusion.FusionReportUnmarshaller - Error when parsing date for last user loggin. Awaited format is EEE MMM dd HH:mm, found: Feb  6 09:52:17 2017

Note: "loggin" is mispelled.

This is the inventory snippet that is not being parsed correctly.
Note the date format and "wtmp" as the user.

    <HARDWARE>
      <ARCHNAME>x86_64-linux-thread-multi</ARCHNAME>
      <CHECKSUM>131071</CHECKSUM>
      <DATELASTLOGGEDUSER>Feb  6 09:52:17 2017</DATELASTLOGGEDUSER>
      <DEFAULTGATEWAY>xxx.xxx.xxx.xxx</DEFAULTGATEWAY>
      <DNS>xxx.xxx.xxx.xxx</DNS>
      <ETIME>1</ETIME>
      <IPADDR>xxx.xxx.xxx.xxx</IPADDR>
      <LASTLOGGEDUSER>wtmp</LASTLOGGEDUSER>
      <MEMORY>8209</MEMORY>
      <NAME>xxxx</NAME>
      <OSCOMMENTS>#1 SMP Thu Sep 18 13:09:38 UTC 2014 (44b8c95)</OSCOMMENTS>
      <OSNAME>SUSE Linux Enterprise Server 11 (x86_64)</OSNAME>
      <OSVERSION>3.0.101-0.40-xen</OSVERSION>
      <PROCESSORN>2</PROCESSORN>
      <PROCESSORS>2400</PROCESSORS>
      <PROCESSORT>Intel(R) Xeon(R) CPU E5-2680 v4 @ 2.40GHz</PROCESSORT>
      <SWAP>1027</SWAP>
      <UUID>4f70573b-b9aa-4e8d-938a-b980a3b21aed</UUID>
      <VMSYSTEM>Xen</VMSYSTEM>
      <WORKGROUP>fqdn</WORKGROUP>
    </HARDWARE>

Here is the output that is responsible, note the last line:

# last
USER     pts/0        host.fqdn         Mon Feb  6 10:25   still logged in
reboot   system boot  3.0.101-0.47.90.  Mon Feb  6 10:15          (00:12)
reboot   system boot  3.0.101-0.47.90.  Mon Feb  6 10:13          (00:01)
USER     pts/0        host.fqdn         Mon Feb  6 10:08 - 10:08  (00:00)
reboot   system boot  3.0.101-0.40-xen  Mon Feb  6 09:52          (00:19)

wtmp begins Mon Feb  6 09:52:17 2017

This patch solved the issue for us:

--- /opt/rudder/lib/perl5/FusionInventory/Agent/Task/Inventory/Generic/Users.pm.orig    2017-02-06 10:35:26.000000000 +0100
+++ /opt/rudder/lib/perl5/FusionInventory/Agent/Task/Inventory/Generic/Users.pm 2017-02-06 10:36:00.000000000 +0100
@@ -157,6 +157,7 @@

     while (my $line = <$handle>) {
         next if $line =~ /^reboot.*system boot/;
+        next if $line =~ /^wtmp begins/;
         next unless $line =~ /^(\S+) \s+ \S+ \s+ \S+ \s+ (\S+ \s+ \S+ \s+ \S+ \s+ \S+)/x;

         $last = {