search

log2timeline / plaso

Super timeline all the things
https://plaso.readthedocs.io
Apache License 2.0
1.66k stars 327 forks source link

Add TeamViewer parser #4847

Closed hur closed 3 months ago

hur commented 3 months ago

One line description of pull request

Adds a text parser plugin for log files generated by TeamViewer.

Description:

Related issue (if applicable): fixes #4834

Parses the following log files:

Test data was created by me for the express purpose of testing the implemented feature.

Notes:

All contributions to Plaso undergo code review. This makes sure that the code has appropriate test coverage and conforms to the Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in order, and then a maintainer will review your code.

Checklist:

codecov[bot] commented 3 months ago

Codecov Report

Attention: Patch coverage is 93.78238% with 12 lines in your changes are missing coverage. Please review.

:exclamation: No coverage uploaded for pull request base (main@dab1e79). Click here to learn what that means.

:exclamation: Current head bd62a66 differs from pull request most recent head 14480b6. Consider uploading reports for the commit 14480b6 to get more accurate results

Files Patch % Lines
plaso/parsers/text_plugins/teamviewer.py 93.78% 12 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #4847 +/- ## ======================================= Coverage ? 85.23% ======================================= Files ? 428 Lines ? 38772 Branches ? 0 ======================================= Hits ? 33046 Misses ? 5726 Partials ? 0 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

joachimmetz commented 3 months ago

@hur thanks for the proposed changes, I'll make some changes to align the code with the style guide. I'll leave some comment for educational purposes.

joachimmetz commented 3 months ago

@hur can you change your feature branch so that changes can be pushed to it or otherwise please rebase with upstream and git apply cleanup.log the attached patch manually. cleanup.log

joachimmetz commented 3 months ago

Both connection log parser plugins can be likely optimized by using a regex and copy form date string methods of dfDateTime, for an example see https://github.com/log2timeline/plaso/blob/main/plaso/parsers/text_plugins/dpkg.py#L63