mandiant / mandiant/macos-UnifiedLogs
Research way to expose time filtering for UnifiedLogs
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 376
- Forks
- 43
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 8
Description
Currently this library does not support native time based filtering. Right now in order to filter by time the user would need to import the library and parse each log entry and filter on each entry.
It should be possible to make time filtering faster. Based on my current notes the `tracev3` header and `timesync` files should expose enough info to implement faster time filtering.
It may be possible to implement faster time filtering by just updating the example binary and adding the feature.
Otherwise the library may need to be updated a bit to ensure enough info is exposed to implement time filtering for users who import the library
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the `tracev3` header and `timesync` files, then inspect the example binary to determine what time information is already available. Establish whether faster time filtering can be added there or whether the library must expose more information; done means documenting a concrete implementation path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- observability
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100