aquasecurity / aquasecurity/tracee
Captured files IO space optimization
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
When capturing files in IO operations, we receive specific range of offsets in the file which are written or read.
Sometimes, only a small fraction of the file is accessed.
However, our current capturing uses seek to write the artifact in the correct offsets, resulting huge amount of NULL bytes in all the offsets which are not captured before the operation offset.
I think that we should maybe think about generating a compressed files, which tells what information is in which offset of the file, without saving the unknown parts of the files as well.
WDYT?
Contributor guide
Research direction
No file, test, or entry point is named. Start by locating the IO file-capture implementation that uses seek and examine how captured offsets are stored. Done should be a defined and tested representation that preserves file offsets without allocating NULL-filled gaps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, performance
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100