[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16375015#comment-16375015
 ] 

ASF GitHub Bot commented on NIFI-4735:
--------------------------------------

GitHub user askene opened a pull request:

    https://github.com/apache/nifi/pull/2489

    NIFI-4735: ParseEVTX only outputs one event per chunk

    Updated the EVTX FileHeader class to correctly check if there are more 
chunks in the file. Previously this would not process the last chunk.
    
    Updated the EVTX ChunkHeader class to correctly check if there are 
additional records in the chunk. Previously this would only process the first 
record of each chunk. It was using the fileLastRecordNumber where it should 
have been using the logLastRecordNumber value.
    
    Updated the EVTX unit tests to have the correct expected number of events 
and use the logLastRecordNumber.
    
    Thank you for submitting a contribution to Apache NiFi.
    
    In order to streamline the review of the contribution we ask you
    to ensure the following steps have been taken:
    
    ### For all changes:
    - [ ] Is there a JIRA ticket associated with this PR? Is it referenced 
         in the commit message?
    
    - [ ] Does your PR title start with NIFI-XXXX where XXXX is the JIRA number 
you are trying to resolve? Pay particular attention to the hyphen "-" character.
    
    - [ ] Has your PR been rebased against the latest commit within the target 
branch (typically master)?
    
    - [ ] Is your initial contribution a single, squashed commit?
    
    ### For code changes:
    - [ ] Have you ensured that the full suite of tests is executed via mvn 
-Pcontrib-check clean install at the root nifi folder?
    - [ ] Have you written or updated unit tests to verify your changes?
    - [ ] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)? 
    - [ ] If applicable, have you updated the LICENSE file, including the main 
LICENSE file under nifi-assembly?
    - [ ] If applicable, have you updated the NOTICE file, including the main 
NOTICE file found under nifi-assembly?
    - [ ] If adding new Properties, have you added .displayName in addition to 
.name (programmatic access) for each of the new properties?
    
    ### For documentation related changes:
    - [ ] Have you ensured that format looks appropriate for the output in 
which it is rendered?
    
    ### Note:
    Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.


You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/askene/nifi NIFI-4735

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/nifi/pull/2489.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #2489
    
----
commit c04042095006760456e20f0c2e074ea996ae62a6
Author: Andrew Skene <andrewskene@...>
Date:   2018-02-23T21:58:53Z

    Updated the EVTX FileHeader class to correctly check if there are more 
chunks in the file. Previously this would not process the last chunk.
    Updated the EVTX ChunkHeader class to correctly check if there are 
additional records in the chunk. Previously this would only process the first 
record of each chunk. It was using the fileLastRecordNumber where it should 
have been using the logLastRecordNumber value.
    Updated the EVTX unit tests to have the correct expected number of events 
and use the logLastRecordNumber.

----


> ParseEVTX only outputs one event per chunk
> ------------------------------------------
>
>                 Key: NIFI-4735
>                 URL: https://issues.apache.org/jira/browse/NIFI-4735
>             Project: Apache NiFi
>          Issue Type: Bug
>          Components: Extensions
>    Affects Versions: 1.4.0
>            Reporter: Terry Brugger
>            Priority: Major
>         Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was based on) and it 
> produced 395,757 events -- on par with what I would expect. It also took much 
> longer than NiFi -- like 30 minutes versus a few seconds -- which I also 
> expect is consistent with processing the entire file.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to