drakvuf-sandbox
drakvuf-sandbox copied to clipboard
compress parsed logs (e.g. syscall.log)
Right now we could end up in syscall.log
being produced having ~500 MB of data for some analyses. This is JSON-text which could be gzipped to about 26 MB.
I think we should start gzipping this to avoid huge transfer across drakrun and S3 server.
/cc @BonusPlay @chivay @kscieslinski
Right now syscall.log
, sysret.log
and regmon.log
are the (only?) ones to generate huge outputs.
IMO this should be handled by Minio, both during transmission and for storage.
hmm https://docs.min.io/docs/minio-compression-guide.html