We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CEF spaces between each character
I followed the 7 steps https://cowrie.readthedocs.io/en/latest/INSTALL.html#step-1-install-dependencies

I set up cef in the config file 
`
[output_localsyslog]
enabled = true
facility = USER
format = cef`

But the output I'm getting has a bunch of spaces it seems to have a space between each character below 

`
Nov 26 04:42:45 cowrie cowrie: [cowrie] C E F : 0 | C o w r i e | C o w r i e | 1 . 0 | c o w r i e . s e s s i o n . c o n n e c t | c o w r i e . s e s s i o n . c o n n e c t | 5 | a p p = S S H v 2   d e s t i n a t i o n S e r v i c e n a m e = s s h d   d e v i c e E x t e r n a l I d = c o w r i e   m s g = N e w   c o n n e c t i o n :   1 9 2 . 1 6 8 . 2 . 5 7 : 3 3 6 2 6   ( 1 9 2 . 1 6 8 . 2 . 6 4 : 2 2 2 2 )   [ s e s s i o n :   8 a 9 0 7 9 8 c 8 9 f d ]   s r c = 1 9 2 . 1 6 8 . 2 . 5 7   p r o t o = t c p   s p t = 3 3 6 2 6   d p t = 2 2 2 2   d s t = 1 9 2 . 1 6 8 . 2 . 6 4

Nov 26 04:42:46 cowrie cowrie: [cowrie] C E F : 0 | C o w r i e | C o w r i e | 1 . 0 | c o w r i e . c l i e n t . v e r s i o n | c o w r i e . c l i e n t . v e r s i o n | 5 | a p p = S S H v 2   d e s t i n a t i o n S e r v i c e n a m e = s s h d   d e v i c e E x t e r n a l I d = c o w r i e   m s g = R e m o t e   S S H   v e r s i o n :   b ' S S H - 2 . 0 - O p e n S S H _ 8 . 2 p 1   U b u n t u - 4 u b u n t u 0 . 1 '   s r c = 1 9 2 . 1 6 8 . 2 . 5 7   p r o t o = t c p

Nov 26 04:42:46 cowrie cowrie: [cowrie] C E F : 0 | C o w r i e | C o w r i e | 1 . 0 | c o w r i e . c l i e n t . k e x | c o w r i e . c l i e n t . k e x | 5 | a p p = S S H v 2   d e s t i n a t i o n S e r v i c e n a m e = s s h d   d e v i c e E x t e r n a l I d = c o w r i e   m s g = S S H   c l i e n t   h a s s h   f i n g e r p r i n t :   a e 8 b d 7 d d 0 9 9 7 0 5 5 5 a a 4 c 6 e d 2 2 a d b b f 5 6   s r c = 1 9 2 . 1 6 8 . 2 . 5 7   p r o t o = t c p
`

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cowrie/output/localsyslog.py`
Content:
```
1 # Copyright (c) 2015 Michel Oosterhof <michel@oosterhof.net>
2 # All rights reserved.
3 #
4 # Redistribution and use in source and binary forms, with or without
5 # modification, are permitted provided that the following conditions
6 # are met:
7 #
8 # 1. Redistributions of source code must retain the above copyright
9 #    notice, this list of conditions and the following disclaimer.
10 # 2. Redistributions in binary form must reproduce the above copyright
11 #    notice, this list of conditions and the following disclaimer in the
12 #    documentation and/or other materials provided with the distribution.
13 # 3. The names of the author(s) may not be used to endorse or promote
14 #    products derived from this software without specific prior written
15 #    permission.
16 #
17 # THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
18 # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 # IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21 # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
22 # BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 # LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
24 # AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
25 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 # SUCH DAMAGE.
28 
29 from __future__ import absolute_import, division
30 
31 import syslog
32 
33 import twisted.python.syslog
34 
35 import cowrie.core.cef
36 import cowrie.core.output
37 from cowrie.core.config import CowrieConfig
38 
39 
40 class Output(cowrie.core.output.Output):
41     """
42     localsyslog output
43     """
44 
45     def start(self):
46         self.format = CowrieConfig().get('output_localsyslog', 'format')
47         facilityString = CowrieConfig().get('output_localsyslog', 'facility')
48         self.facility = vars(syslog)['LOG_' + facilityString]
49         self.syslog = twisted.python.syslog.SyslogObserver(prefix='cowrie', facility=self.facility)
50 
51     def stop(self):
52         pass
53 
54     def write(self, logentry):
55         if 'isError' not in logentry:
56             logentry['isError'] = False
57 
58         if self.format == 'cef':
59             self.syslog.emit({
60                 'message': cowrie.core.cef.formatCef(logentry),
61                 'isError': False,
62                 'system': 'cowrie'
63             })
64         else:
65             # message appears with additional spaces if message key is defined
66             logentry['message'] = [logentry['message']]
67             self.syslog.emit(logentry)
68
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cowrie/output/localsyslog.py b/src/cowrie/output/localsyslog.py
--- a/src/cowrie/output/localsyslog.py
+++ b/src/cowrie/output/localsyslog.py
@@ -45,6 +45,7 @@
     def start(self):
         self.format = CowrieConfig().get('output_localsyslog', 'format')
         facilityString = CowrieConfig().get('output_localsyslog', 'facility')
+        levelString = CowrieConfig().get('output_localsyslog', 'level')
         self.facility = vars(syslog)['LOG_' + facilityString]
         self.syslog = twisted.python.syslog.SyslogObserver(prefix='cowrie', facility=self.facility)
 
@@ -57,7 +58,7 @@
 
         if self.format == 'cef':
             self.syslog.emit({
-                'message': cowrie.core.cef.formatCef(logentry),
+                'message': [cowrie.core.cef.formatCef(logentry)],
                 'isError': False,
                 'system': 'cowrie'
             })

{"golden_diff": "diff --git a/src/cowrie/output/localsyslog.py b/src/cowrie/output/localsyslog.py\n--- a/src/cowrie/output/localsyslog.py\n+++ b/src/cowrie/output/localsyslog.py\n@@ -45,6 +45,7 @@\n     def start(self):\n         self.format = CowrieConfig().get('output_localsyslog', 'format')\n         facilityString = CowrieConfig().get('output_localsyslog', 'facility')\n+        levelString = CowrieConfig().get('output_localsyslog', 'level')\n         self.facility = vars(syslog)['LOG_' + facilityString]\n         self.syslog = twisted.python.syslog.SyslogObserver(prefix='cowrie', facility=self.facility)\n \n@@ -57,7 +58,7 @@\n \n         if self.format == 'cef':\n             self.syslog.emit({\n-                'message': cowrie.core.cef.formatCef(logentry),\n+                'message': [cowrie.core.cef.formatCef(logentry)],\n                 'isError': False,\n                 'system': 'cowrie'\n             })\n", "issue": "CEF spaces between each character\nI followed the 7 steps https://cowrie.readthedocs.io/en/latest/INSTALL.html#step-1-install-dependencies\r\n\r\nI set up cef in the config file \r\n`\r\n[output_localsyslog]\r\nenabled = true\r\nfacility = USER\r\nformat = cef`\r\n\r\nBut the output I'm getting has a bunch of spaces it seems to have a space between each character below \r\n\r\n`\r\nNov 26 04:42:45 cowrie cowrie: [cowrie] C E F : 0 | C o w r i e | C o w r i e | 1 . 0 | c o w r i e . s e s s i o n . c o n n e c t | c o w r i e . s e s s i o n . c o n n e c t | 5 | a p p = S S H v 2   d e s t i n a t i o n S e r v i c e n a m e = s s h d   d e v i c e E x t e r n a l I d = c o w r i e   m s g = N e w   c o n n e c t i o n :   1 9 2 . 1 6 8 . 2 . 5 7 : 3 3 6 2 6   ( 1 9 2 . 1 6 8 . 2 . 6 4 : 2 2 2 2 )   [ s e s s i o n :   8 a 9 0 7 9 8 c 8 9 f d ]   s r c = 1 9 2 . 1 6 8 . 2 . 5 7   p r o t o = t c p   s p t = 3 3 6 2 6   d p t = 2 2 2 2   d s t = 1 9 2 . 1 6 8 . 2 . 6 4\r\n\r\nNov 26 04:42:46 cowrie cowrie: [cowrie] C E F : 0 | C o w r i e | C o w r i e | 1 . 0 | c o w r i e . c l i e n t . v e r s i o n | c o w r i e . c l i e n t . v e r s i o n | 5 | a p p = S S H v 2   d e s t i n a t i o n S e r v i c e n a m e = s s h d   d e v i c e E x t e r n a l I d = c o w r i e   m s g = R e m o t e   S S H   v e r s i o n :   b ' S S H - 2 . 0 - O p e n S S H _ 8 . 2 p 1   U b u n t u - 4 u b u n t u 0 . 1 '   s r c = 1 9 2 . 1 6 8 . 2 . 5 7   p r o t o = t c p\r\n\r\nNov 26 04:42:46 cowrie cowrie: [cowrie] C E F : 0 | C o w r i e | C o w r i e | 1 . 0 | c o w r i e . c l i e n t . k e x | c o w r i e . c l i e n t . k e x | 5 | a p p = S S H v 2   d e s t i n a t i o n S e r v i c e n a m e = s s h d   d e v i c e E x t e r n a l I d = c o w r i e   m s g = S S H   c l i e n t   h a s s h   f i n g e r p r i n t :   a e 8 b d 7 d d 0 9 9 7 0 5 5 5 a a 4 c 6 e d 2 2 a d b b f 5 6   s r c = 1 9 2 . 1 6 8 . 2 . 5 7   p r o t o = t c p\r\n`\n", "before_files": [{"content": "# Copyright (c) 2015 Michel Oosterhof <michel@oosterhof.net>\n# All rights reserved.\n#\n# Redistribution and use in source and binary forms, with or without\n# modification, are permitted provided that the following conditions\n# are met:\n#\n# 1. Redistributions of source code must retain the above copyright\n#    notice, this list of conditions and the following disclaimer.\n# 2. Redistributions in binary form must reproduce the above copyright\n#    notice, this list of conditions and the following disclaimer in the\n#    documentation and/or other materials provided with the distribution.\n# 3. The names of the author(s) may not be used to endorse or promote\n#    products derived from this software without specific prior written\n#    permission.\n#\n# THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR\n# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\n# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\n# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,\n# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,\n# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED\n# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\n# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\n# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF\n# SUCH DAMAGE.\n\nfrom __future__ import absolute_import, division\n\nimport syslog\n\nimport twisted.python.syslog\n\nimport cowrie.core.cef\nimport cowrie.core.output\nfrom cowrie.core.config import CowrieConfig\n\n\nclass Output(cowrie.core.output.Output):\n    \"\"\"\n    localsyslog output\n    \"\"\"\n\n    def start(self):\n        self.format = CowrieConfig().get('output_localsyslog', 'format')\n        facilityString = CowrieConfig().get('output_localsyslog', 'facility')\n        self.facility = vars(syslog)['LOG_' + facilityString]\n        self.syslog = twisted.python.syslog.SyslogObserver(prefix='cowrie', facility=self.facility)\n\n    def stop(self):\n        pass\n\n    def write(self, logentry):\n        if 'isError' not in logentry:\n            logentry['isError'] = False\n\n        if self.format == 'cef':\n            self.syslog.emit({\n                'message': cowrie.core.cef.formatCef(logentry),\n                'isError': False,\n                'system': 'cowrie'\n            })\n        else:\n            # message appears with additional spaces if message key is defined\n            logentry['message'] = [logentry['message']]\n            self.syslog.emit(logentry)\n", "path": "src/cowrie/output/localsyslog.py"}], "after_files": [{"content": "# Copyright (c) 2015 Michel Oosterhof <michel@oosterhof.net>\n# All rights reserved.\n#\n# Redistribution and use in source and binary forms, with or without\n# modification, are permitted provided that the following conditions\n# are met:\n#\n# 1. Redistributions of source code must retain the above copyright\n#    notice, this list of conditions and the following disclaimer.\n# 2. Redistributions in binary form must reproduce the above copyright\n#    notice, this list of conditions and the following disclaimer in the\n#    documentation and/or other materials provided with the distribution.\n# 3. The names of the author(s) may not be used to endorse or promote\n#    products derived from this software without specific prior written\n#    permission.\n#\n# THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR\n# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\n# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\n# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,\n# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,\n# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED\n# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\n# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\n# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF\n# SUCH DAMAGE.\n\nfrom __future__ import absolute_import, division\n\nimport syslog\n\nimport twisted.python.syslog\n\nimport cowrie.core.cef\nimport cowrie.core.output\nfrom cowrie.core.config import CowrieConfig\n\n\nclass Output(cowrie.core.output.Output):\n    \"\"\"\n    localsyslog output\n    \"\"\"\n\n    def start(self):\n        self.format = CowrieConfig().get('output_localsyslog', 'format')\n        facilityString = CowrieConfig().get('output_localsyslog', 'facility')\n        levelString = CowrieConfig().get('output_localsyslog', 'level')\n        self.facility = vars(syslog)['LOG_' + facilityString]\n        self.syslog = twisted.python.syslog.SyslogObserver(prefix='cowrie', facility=self.facility)\n\n    def stop(self):\n        pass\n\n    def write(self, logentry):\n        if 'isError' not in logentry:\n            logentry['isError'] = False\n\n        if self.format == 'cef':\n            self.syslog.emit({\n                'message': [cowrie.core.cef.formatCef(logentry)],\n                'isError': False,\n                'system': 'cowrie'\n            })\n        else:\n            # message appears with additional spaces if message key is defined\n            logentry['message'] = [logentry['message']]\n            self.syslog.emit(logentry)\n", "path": "src/cowrie/output/localsyslog.py"}]}