[Bug]: plaso jobs fail when plaso >6 months old - Githubissues

google / turbinia

Automation and Scaling of Digital Forensics Tools

Apache License 2.0

731 stars 160 forks source link

[Bug]: plaso jobs fail when plaso >6 months old #1417

Closed hacktobeer closed 7 months ago

hacktobeer commented 7 months ago

What steps will reproduce the bug?

Use a plaso version > 6 months old
Run a plaso job
pinfo.py will output warnings that are not json format so evidence.py will error
request never completes

What is the expected behavior?

requests to end... pinfo.py output to only contain json and/or we verify

What do you see instead?

output of pinfo.py

>>> print(t.splitlines())
['WARNING: the version of plaso you are using is more than 6 months old. We', 'strongly recommend to update it.', '', '{"storage_counters": {"parsers": {"filestat": 897, "total": 897}, "event_labels": {}}}']
So the relevant line is always the last line which is the json we need.

Additional information

No response