mandiant / mandiant/macos-UnifiedLogs
Review LogData default values
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 376
- Forks
- 43
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 8
Description
Currently the log data returned by this library is a `LogData` structure as shown below
```
#[derive(Debug, Serialize)]
pub struct LogData {
pub subsystem: String,
pub thread_id: u64,
pub pid: u64,
pub euid: u32,
pub library: String,
pub library_uuid: String,
pub activity_id: u64,
pub parent_activity_id: u64,
pub time: f64,
pub category: String,
pub event_type: EventType,
pub log_type: LogType,
pub process: String,
pub process_uuid: String,
pub message: String,
pub raw_message: String,
pub boot_uuid: String,
pub timezone_name: String,
pub message_entries: Vec,
pub timestamp: String,
pub message_flags: Vec,
pub evidence: String,
}
```
@ReturnRei has mention a few good points that some of default values can be misleading. For example, by default `euid` is set to 0. Which on macOS is the root account.
Some of these values should be replaced with an `Option type` that is set to `None` if the value is not set when parsing the log entry
Some values that should probably be Option include
- euid
- parent_activity_id
- activity_id
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the LogData structure shown in the issue and trace the parser that constructs it for unset values. Review whether euid, parent_activity_id, and activity_id can be represented as None without misleading defaults, then check the affected parsing behavior and public API expectations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend-api-design
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100