startbootstrap
startbootstrap copied to clipboard
Create a dateless helper for logs with date-less timestamps
Describe the problem:
Some log files do not have the date in their timestamp. This is the case for ps.txt log files in MacOS/iOS for example. I wish to create a dateless_helper modeled on the yearless helper.
@rick-slin given several short-comings in https://github.com/log2timeline/plaso/pull/4699 working on an alternative
- [x] ~~changed year less log helper to date less log helper - https://github.com/log2timeline/plaso/pull/4851~~
- [x] ~~change dtDateTime to support delta date - https://github.com/log2timeline/dfdatetime/pull/280~~
- [x] ~~change timeliner to handle a full date instead of just year - https://github.com/log2timeline/plaso/pull/4854~~
- [ ] change date less helper interface to be used by ps.txt log file parser
- ~~
_SetEstimatedDate
to estimate the date based on the file entry, will set the granularity to no-date - https://github.com/log2timeline/plaso/pull/4859~~ -
_UpdateDate
to update the date based on the time observed in the log format
- ~~
@rick-slin let me know when you have a draft PR for the ps.txt log parser, this will help finalize adding _UpdateDate
to the date less helper interface
I should have time later this week.
@rick-slin thanks no hurry, mostly a heads up that most of the "plumbing" should be there now
@joachimmetz I've created a draft for the ps.txt parser. It includes two different uses of the DateLessLogFormatHelper. See #4861
@rick-slin thanks, I'll try to take a look over the weekend.
Interesting format, so what are the cases here (STARTED TIME):
- 23Feb22 192:14.05 (date)
- Fri11AM 0:00.37 (date-less, relative day)
- 9:14AM 0:00.09 (date-less, today)