search

objective-see / BlockBlock

BlockBlock provides continual protection by monitoring persistence locations.
GNU General Public License v3.0
619 stars 38 forks source link

Memory consumption by extending the log file #74

Closed proton1k closed 3 months ago

proton1k commented 4 months ago

Hi, I have noticed there's a huge BlockBlock.log file in the Library folder. Above 38 GB used. Makes sense to implement a time-based rolling logs cleanup.

P.S. Thank you for an amazing BlockBlock tool !

0xmachos commented 4 months ago

Confirming this on my machine as well, BlockBlock.log is 69GB.

mikey ~/Documents/Projects
$ ll /Library/Objective-See/BlockBlock/BlockBlock.log
-rw-r--r--@ 1 root  wheel    69G 15 Mar 19:21 /Library/Objective-See/BlockBlock/BlockBlock.log
mikey ~/Documents/Projects
$ wc -l /Library/Objective-See/BlockBlock/BlockBlock.log
526158586 /Library/Objective-See/BlockBlock/BlockBlock.log
mikey  ~/Documents/Projects
objective-see commented 3 months ago

🫣 yikes!

Just switched over all logging to use macOS's os_log_* APIs. Which, yes, will mean the system now handles log sizes, etc. etc. 🙌🏼

...also, on upgrade the installer will remove the old log file, to free up that space.

Doing a bit more testing, as this change touched a ton of files, but expect a new version soon!

0xmachos commented 3 months ago

Updated to 2.2.2

 ll /Library/Objective-See/BlockBlock/BlockBlock.log           
-rw-r--r--@ 1 root  wheel    74G 21 Mar 22:49 /Library/Objective-See/BlockBlock/BlockBlock.log
mikey  ~/Documents/Projects
$ ll /Library/Objective-See/BlockBlock/BlockBlock.log
ls: /Library/Objective-See/BlockBlock/BlockBlock.log: No such file or directory

on upgrade the installer will remove the old log file, to free up that space.

Working for me.

Cheers for the quick turn around mate.