mandiant / mandiant/macos-UnifiedLogs
Sorted by time output in unifiedlogs_* scripts
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 376
- Forks
- 43
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 8
Description
I'm struggling a bit with the output of the `unifiedlog_*` example scripts.
The output is currently not time-sorted, which makes post-processing data in some cases not possible.
Considering the size of a logarchive sorting afterwards can be memory and cpu intensive.
I'm wondering if there would be a way to output the data in a sorted way as the native apple tool also exports sorted by time.
With the current logic of iterating over the `archive_path` types I guess that will not work.
Not being that familiar with the true datastructure behind (and thank you for that, as that's the beauty of your library) I'm not sure if it is really feasible. Same with the trick of handling oversized entries.
Do you think there is a clean way to do so?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the unifiedlog_* example scripts and trace how archive_path types are iterated and how oversized entries are handled. Determine whether records can be emitted in time order without memory-heavy post-processing; done means the scripts produce time-sorted output while preserving current oversized-entry handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli, operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100