dftimewolf
dftimewolf copied to clipboard
gcp_logging_collect recipe broken
Possible GCP logging API change (libcloudforensics?) breaking gcp-logging_collect recipe.
$ dftimewolf gcp_logging_collect glassbro-production 'resource.type="gce_instance" resource.labels.instance_id="5406509864760928785" log_name="projects/glassbro-production/logs/cloudaudit.googleapis.com%2Factivity" timestamp>="2023-09-25" timestamp<="2023-10-06"' --backoff
[2024-06-07 10:08:51,995] [dftimewolf.state ] INFO Module GCPLogsCollector finished execution
[2024-06-07 10:08:51,995] [dftimewolf.state ] ERROR dfTimewolf encountered one or more errors:
[2024-06-07 10:08:51,995] [dftimewolf.state ] ERROR 1: error from dftimewolf: An unknown error occurred in module GCPLogsCollector: 'generator' object has no attribute 'pages'
[2024-06-07 10:08:51,995] [dftimewolf.state ] ERROR Traceback (most recent call last):
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR File "/home/hanze_workshop_50/dftimewolf/dftimewolf/lib/state.py", line 483, in _RunModuleThread
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR self._RunModuleProcess(module)
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR File "/home/hanze_workshop_50/dftimewolf/dftimewolf/lib/state.py", line 365, in _RunModuleProcess
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR module.Process()
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR File "/home/hanze_workshop_50/dftimewolf/dftimewolf/lib/collectors/gcp_logging.py", line 172, in Process
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR pages = self.ListPages(logging_client)
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR File "/home/hanze_workshop_50/dftimewolf/dftimewolf/lib/collectors/gcp_logging.py", line 81, in ListPages
[2024-06-07 10:08:51,996] [dftimewolf.state ] ERROR return results.pages
[2024-06-07 10:08:51,997] [dftimewolf.state ] ERROR ^^^^^^^^^^^^^
[2024-06-07 10:08:51,997] [dftimewolf.state ] ERROR AttributeError: 'generator' object has no attribute 'pages'