Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Layer debug info to show file size #1011

Merged
merged 2 commits into from
Nov 15, 2023

Conversation

eve-mem
Copy link
Contributor

@eve-mem eve-mem commented Oct 3, 2023

Hello!

This adds an extra line to debug logs when the stacker shows the layers it has managed to stack.

It simply shows the file size of the file in the debug log. I've found that knowing the file size of the file has been very helpful when debugging issues where plugins aren't working as expected, or the stacker fails. For example when the stacker says it was only able to stack a FileLayer for a memory dump of a VM with 8GB, but the file is only 1GB in size it's obvious that either the sample is wrong or it is compressed in some way.

I was worried this might slow things down, particularly when dealing with very large files, but in my tests that didn't seem to be true. I think that maximum_address has already been set as it's needed by some of the scanners. However I'm very happy to be shown that I'm wrong about that!

Thanks!

Copy link
Member

@ikelos ikelos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, looks fine. Be aware that there are lower levels of debugging than vollog.debug. If the information is useful but only very occasionally then you can use vollog.log(constants.LOGLEVEL_V, .... The levels go up to LOGLEVEL_VVVV which equates to -vvvvvvv I believe. I think debug is probably ok for this information but in general it's better to prioritize information based on how important/necessary it is. Given this is information we need from users to triage bugs, putting it under the -vvv level we ask for makes perfect sense. 5:)

@ikelos ikelos merged commit c616c0b into volatilityfoundation:develop Nov 15, 2023
@eve-mem
Copy link
Contributor Author

eve-mem commented Nov 15, 2023

Yes - thank you for the reminder re log levels. I need to make better use of those.

@eve-mem eve-mem deleted the layer_debug_info branch December 1, 2023 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants