Problems running log2timeline on a base install

[karlvanderschyff]

Hi there
I have just done a base install of the SIFT appliance and when I run log2timeline from the command line I get the following error:

$ log2timeline.py
Traceback (most recent call last):
File "/usr/bin/log2timeline.py", line 11, in
from plaso.cli import log2timeline_tool
File "/usr/lib/python3/dist-packages/plaso/cli/log2timeline_tool.py", line 14, in
from plaso.cli import extraction_tool
File "/usr/lib/python3/dist-packages/plaso/cli/extraction_tool.py", line 20, in
from plaso import parsers # pylint: disable=unused-import
File "/usr/lib/python3/dist-packages/plaso/parsers/init.py", line 63, in
from plaso.parsers import text_plugins
File "/usr/lib/python3/dist-packages/plaso/parsers/text_plugins/init.py", line 4, in
from plaso.parsers.text_plugins import android_logcat
File "/usr/lib/python3/dist-packages/plaso/parsers/text_plugins/android_logcat.py", line 78, in
class AndroidLogcatTextPlugin(
File "/usr/lib/python3/dist-packages/plaso/parsers/text_plugins/android_logcat.py", line 87, in AndroidLogcatTextPlugin
_INTEGER = pyparsing.Word(pyparsing.nums).set_parse_action(
AttributeError: '_WordRegex' object has no attribute 'set_parse_action'. Did you mean: 'setParseAction'?

I tried to perform an update and upgrade to see if it helps and it stays the same. I have confirmed this on another install as well.

Any advice where I can start trying to solve this one?

[digitalsleuth]

Hi @karlvanderschyff , for the current issue you're experiencing you can run the following:
sudo python3 -m pip install "pyparsing>=3.0.0"

Once done, it should work again. We have a PR issued which will fix this for existing installs, but clean installs in the future won't have this issue.

Cheers!

[karlvanderschyff]

Thank very much @digitalsleuth. Worked 100%.

[joachimmetz]

Duplicate of #617

[bmmojo]

@digitalsleuth

Unfortunately, that fix doesn't work for me. I am currently using v0.14.30 (2024-05-06).

I've also tried upgrading pip like the output said but I get the same error when running psteal.py or log2timeline.py

$ sudo python3 -m pip install "pyparsing>=3.0.0"
[sudo] password for ######:
Requirement already satisfied: pyparsing>=3.0.0 in /usr/lib/python3/dist-packages (3.0.9)
WARNING: Keyring is skipped due to an exception: Failed to unlock the item!
WARNING: You are using pip version 21.0.1; however, version 24.0 is available.
You should consider upgrading via the '/usr/bin/python3 -m pip install --upgrade pip' command.

[digitalsleuth]

@bmmojo Were you running the base install using cast, or using the SIFT appliance?

[bmmojo]

@digitalsleuth cast install.