search

philhagen / sof-elk

Configuration files for the SOF-ELK VM
GNU General Public License v3.0
1.46k stars 272 forks source link

Wrong command line options in Wiki/log2timeline and Plaso #312

Closed BrianMer closed 6 months ago

BrianMer commented 6 months ago

Hi,

The command lines in the Wiki/log2timeline and Plaso given in example are partially wrong.

Here are the command lines fixed:

log2timeline.py -z UTC --parsers "<parsers>" --storage-file <output_file>.plaso <mount_point or disk_image>

psort.py --output-time-zone "UTC" -o l2tcsv -w <output_file>.csv <log2timeline_file>.plaso "date > '<YYYY-MM-dd> <HH:mm:ss>' AND date < '<YYYY-MM-dd> <HH:mm:ss>'"

Thanks!

philhagen commented 6 months ago

another appreciated find. thank you!

updated now. I adjusted the variable syntax to match some of the other docs, but all should be g2g.