aquasecurity / aquasecurity/tracee

Captured files IO space optimization

Open
#3,420 0 comments 0 reactions 0 assignees View on GitHub
area/capture kind/feature
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

When capturing files in IO operations, we receive specific range of offsets in the file which are written or read.
Sometimes, only a small fraction of the file is accessed.
However, our current capturing uses seek to write the artifact in the correct offsets, resulting huge amount of NULL bytes in all the offsets which are not captured before the operation offset.

I think that we should maybe think about generating a compressed files, which tells what information is in which offset of the file, without saving the unknown parts of the files as well.
WDYT?

Contributor guide

Open the contributing guide

Research direction

No file, test, or entry point is named. Start by locating the IO file-capture implementation that uses seek and examine how captured offsets are stored. Done should be a defined and tested representation that preserves file offsets without allocating NULL-filled gaps.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, performance
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.