[jira] [Commented] (NIFI-4735) ParseEVTX only outputs one event per chunk

[ASF subversion and git services (JIRA)]

[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16812600#comment-16812600
 ] 

ASF subversion and git services commented on NIFI-4735:
---

Commit e63a9d1e37244219e7685698796680e85a413bd4 in nifi's branch 
refs/heads/support/nifi-1.9.x from Ferenc Szabó
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=e63a9d1 ]

NIFI-4735: ParseEVTX only outputs one event per chunk

This change is based on https://github.com/apache/nifi/pull/2489

I have reproduced the issue with some additional test cases and test files then 
applied the original fix.

commit message from the original change:
Updated the EVTX FileHeader class to correctly check if there are more chunks 
in the file. Previously this would not process the last chunk.

Updated the EVTX ChunkHeader class to correctly check if there are additional 
records in the chunk. Previously this would only process the first record of 
each chunk. It was using the fileLastRecordNumber where it should have been 
using the logLastRecordNumber value.

Updated the EVTX unit tests to have the correct expected number of events and 
use the logLastRecordNumber.

refactoring duplicated code and magic numbers

Signed-off-by: Matthew Burgess 

This closes #2489
This closes #3379


> ParseEVTX only outputs one event per chunk
> --
>
> Key: NIFI-4735
> URL: https://issues.apache.org/jira/browse/NIFI-4735
> Project: Apache NiFi
>  Issue Type: Bug
>  Components: Extensions
>Reporter: Terry Brugger
>Priority: Major
> Fix For: 1.10.0, 1.9.2
>
> Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>  Time Spent: 50m
>  Remaining Estimate: 0h
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was based on) and it 
> produced 395,757 events -- on par with what I would expect. It also took much 
> longer than NiFi -- like 30 minutes versus a few seconds -- which I also 
> expect is consistent with processing the entire file.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (NIFI-4735) ParseEVTX only outputs one event per chunk

[ASF subversion and git services (JIRA)]

[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16809195#comment-16809195
 ] 

ASF subversion and git services commented on NIFI-4735:
---

Commit e63a9d1e37244219e7685698796680e85a413bd4 in nifi's branch 
refs/heads/NIFI-6169-RC2 from Ferenc Szabó
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=e63a9d1 ]

NIFI-4735: ParseEVTX only outputs one event per chunk

This change is based on https://github.com/apache/nifi/pull/2489

I have reproduced the issue with some additional test cases and test files then 
applied the original fix.

commit message from the original change:
Updated the EVTX FileHeader class to correctly check if there are more chunks 
in the file. Previously this would not process the last chunk.

Updated the EVTX ChunkHeader class to correctly check if there are additional 
records in the chunk. Previously this would only process the first record of 
each chunk. It was using the fileLastRecordNumber where it should have been 
using the logLastRecordNumber value.

Updated the EVTX unit tests to have the correct expected number of events and 
use the logLastRecordNumber.

refactoring duplicated code and magic numbers

Signed-off-by: Matthew Burgess 

This closes #2489
This closes #3379


> ParseEVTX only outputs one event per chunk
> --
>
> Key: NIFI-4735
> URL: https://issues.apache.org/jira/browse/NIFI-4735
> Project: Apache NiFi
>  Issue Type: Bug
>  Components: Extensions
>Reporter: Terry Brugger
>Priority: Major
> Fix For: 1.10.0, 1.9.2
>
> Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>  Time Spent: 50m
>  Remaining Estimate: 0h
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was based on) and it 
> produced 395,757 events -- on par with what I would expect. It also took much 
> longer than NiFi -- like 30 minutes versus a few seconds -- which I also 
> expect is consistent with processing the entire file.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (NIFI-4735) ParseEVTX only outputs one event per chunk

[ASF subversion and git services (JIRA)]

[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16807163#comment-16807163
 ] 

ASF subversion and git services commented on NIFI-4735:
---

Commit 772368dd15a1482233e69eca7f2e4f34ad640639 in nifi's branch 
refs/heads/NIFI-6169-RC1 from Ferenc Szabó
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=772368d ]

NIFI-4735: ParseEVTX only outputs one event per chunk

This change is based on https://github.com/apache/nifi/pull/2489

I have reproduced the issue with some additional test cases and test files then 
applied the original fix.

commit message from the original change:
Updated the EVTX FileHeader class to correctly check if there are more chunks 
in the file. Previously this would not process the last chunk.

Updated the EVTX ChunkHeader class to correctly check if there are additional 
records in the chunk. Previously this would only process the first record of 
each chunk. It was using the fileLastRecordNumber where it should have been 
using the logLastRecordNumber value.

Updated the EVTX unit tests to have the correct expected number of events and 
use the logLastRecordNumber.

refactoring duplicated code and magic numbers

Signed-off-by: Matthew Burgess 

This closes #2489
This closes #3379


> ParseEVTX only outputs one event per chunk
> --
>
> Key: NIFI-4735
> URL: https://issues.apache.org/jira/browse/NIFI-4735
> Project: Apache NiFi
>  Issue Type: Bug
>  Components: Extensions
>Reporter: Terry Brugger
>Priority: Major
> Fix For: 1.10.0, 1.9.2
>
> Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>  Time Spent: 50m
>  Remaining Estimate: 0h
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was based on) and it 
> produced 395,757 events -- on par with what I would expect. It also took much 
> longer than NiFi -- like 30 minutes versus a few seconds -- which I also 
> expect is consistent with processing the entire file.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (NIFI-4735) ParseEVTX only outputs one event per chunk

[ASF subversion and git services (JIRA)]

[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16797418#comment-16797418
 ] 

ASF subversion and git services commented on NIFI-4735:
---

Commit 48a6c81fa261339c645773a3124ce0ee351346c4 in nifi's branch 
refs/heads/master from Ferenc Szabó
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=48a6c81 ]

NIFI-4735: ParseEVTX only outputs one event per chunk

This change is based on https://github.com/apache/nifi/pull/2489

I have reproduced the issue with some additional test cases and test files then 
applied the original fix.

commit message from the original change:
Updated the EVTX FileHeader class to correctly check if there are more chunks 
in the file. Previously this would not process the last chunk.

Updated the EVTX ChunkHeader class to correctly check if there are additional 
records in the chunk. Previously this would only process the first record of 
each chunk. It was using the fileLastRecordNumber where it should have been 
using the logLastRecordNumber value.

Updated the EVTX unit tests to have the correct expected number of events and 
use the logLastRecordNumber.

refactoring duplicated code and magic numbers

Signed-off-by: Matthew Burgess 

This closes #2489
This closes #3379


> ParseEVTX only outputs one event per chunk
> --
>
> Key: NIFI-4735
> URL: https://issues.apache.org/jira/browse/NIFI-4735
> Project: Apache NiFi
>  Issue Type: Bug
>  Components: Extensions
>Reporter: Terry Brugger
>Priority: Major
> Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>  Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was based on) and it 
> produced 395,757 events -- on par with what I would expect. It also took much 
> longer than NiFi -- like 30 minutes versus a few seconds -- which I also 
> expect is consistent with processing the entire file.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (NIFI-4735) ParseEVTX only outputs one event per chunk

[J Andrew Skene (JIRA)]

[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16375023#comment-16375023
 ] 

J Andrew Skene commented on NIFI-4735:
--

I hit this issue a few months and fixed it in a local fork. The NiFi code also 
skips the last chunk of any EVTX file. The above MR fixes both issues.

> ParseEVTX only outputs one event per chunk
> --
>
> Key: NIFI-4735
> URL: https://issues.apache.org/jira/browse/NIFI-4735
> Project: Apache NiFi
>  Issue Type: Bug
>  Components: Extensions
>Affects Versions: 1.4.0
>Reporter: Terry Brugger
>Priority: Major
> Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was based on) and it 
> produced 395,757 events -- on par with what I would expect. It also took much 
> longer than NiFi -- like 30 minutes versus a few seconds -- which I also 
> expect is consistent with processing the entire file.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

[jira] [Commented] (NIFI-4735) ParseEVTX only outputs one event per chunk

[ASF GitHub Bot (JIRA)]

[ 
https://issues.apache.org/jira/browse/NIFI-4735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16375015#comment-16375015
 ] 

ASF GitHub Bot commented on NIFI-4735:
--

GitHub user askene opened a pull request:

https://github.com/apache/nifi/pull/2489

NIFI-4735: ParseEVTX only outputs one event per chunk

Updated the EVTX FileHeader class to correctly check if there are more 
chunks in the file. Previously this would not process the last chunk.

Updated the EVTX ChunkHeader class to correctly check if there are 
additional records in the chunk. Previously this would only process the first 
record of each chunk. It was using the fileLastRecordNumber where it should 
have been using the logLastRecordNumber value.

Updated the EVTX unit tests to have the correct expected number of events 
and use the logLastRecordNumber.

Thank you for submitting a contribution to Apache NiFi.

In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:

### For all changes:
- [ ] Is there a JIRA ticket associated with this PR? Is it referenced 
 in the commit message?

- [ ] Does your PR title start with NIFI- where  is the JIRA number 
you are trying to resolve? Pay particular attention to the hyphen "-" character.

- [ ] Has your PR been rebased against the latest commit within the target 
branch (typically master)?

- [ ] Is your initial contribution a single, squashed commit?

### For code changes:
- [ ] Have you ensured that the full suite of tests is executed via mvn 
-Pcontrib-check clean install at the root nifi folder?
- [ ] Have you written or updated unit tests to verify your changes?
- [ ] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)? 
- [ ] If applicable, have you updated the LICENSE file, including the main 
LICENSE file under nifi-assembly?
- [ ] If applicable, have you updated the NOTICE file, including the main 
NOTICE file found under nifi-assembly?
- [ ] If adding new Properties, have you added .displayName in addition to 
.name (programmatic access) for each of the new properties?

### For documentation related changes:
- [ ] Have you ensured that format looks appropriate for the output in 
which it is rendered?

### Note:
Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.


You can merge this pull request into a Git repository by running:

$ git pull https://github.com/askene/nifi NIFI-4735

Alternatively you can review and apply these changes as the patch at:

https://github.com/apache/nifi/pull/2489.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

This closes #2489


commit c04042095006760456e20f0c2e074ea996ae62a6
Author: Andrew Skene 
Date:   2018-02-23T21:58:53Z

Updated the EVTX FileHeader class to correctly check if there are more 
chunks in the file. Previously this would not process the last chunk.
Updated the EVTX ChunkHeader class to correctly check if there are 
additional records in the chunk. Previously this would only process the first 
record of each chunk. It was using the fileLastRecordNumber where it should 
have been using the logLastRecordNumber value.
Updated the EVTX unit tests to have the correct expected number of events 
and use the logLastRecordNumber.




> ParseEVTX only outputs one event per chunk
> --
>
> Key: NIFI-4735
> URL: https://issues.apache.org/jira/browse/NIFI-4735
> Project: Apache NiFi
>  Issue Type: Bug
>  Components: Extensions
>Affects Versions: 1.4.0
>Reporter: Terry Brugger
>Priority: Major
> Attachments: EVTX2XML.xml, Screen Shot 2018-01-03 at 15.06.24.png
>
>
> I have constructed a simple pipeline that reads a Windows EVTX binary file, 
> runs it through ParseEvtx, and writes out the result (template attached). As 
> a sample I fed it a 192MiB file and it only output 3.3MiB (see screenshot). 
> The output file contains 3071 events. Not coincidentally, I am sure, 
> 192MiB/64KiB = 3072, which would indicate that it only wrote out one event 
> from each chunk. If I configure the processor to output by the chunk or event 
> I get 3071 separate files with one event each. Unfortunately, I have no way 
> to sanitize binary EVTX so I cannot provide the actual file used.
> By way of comparison, I ran the same EVTX file through evtx_dump.py from the 
> python-evtx package (which I understand ParseEvtx was