WolfLauncher: Add archive creation time and file size in external log

DFIR-ORC · Jun 10, 2020 · 1ea5b3d · 1ea5b3d
1 parent 4b636a5
commit 1ea5b3d
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 1 deletion.
diff --git a/src/OrcCommand/WolfExecution.h b/src/OrcCommand/WolfExecution.h
@@ -120,6 +120,7 @@ class WolfExecution
 
     FILETIME m_StartTime;
     FILETIME m_FinishTime;
+    FILETIME m_ArchiveFinishTime;
 
     std::shared_ptr<TableOutput::IWriter> m_JobStatisticsWriter;
     OutputSpec m_JobStatisticsOutput;

diff --git a/src/OrcCommand/WolfExecution_Execute.cpp b/src/OrcCommand/WolfExecution_Execute.cpp
@@ -40,6 +40,7 @@
 #include "EncodeMessageStream.h"
 
 #include "WolfTask.h"
+#include "Convert.h"
 
 using namespace std;
 using namespace std::chrono;
@@ -548,8 +549,20 @@ HRESULT WolfExecution::CreateCommandAgent(
                         break;
                     case CommandNotification::Done:
                         GetSystemTimeAsFileTime(&m_FinishTime);
+                        {
+                            auto start = Orc::ConvertTo(m_StartTime);
+                            auto end = Orc::ConvertTo(m_FinishTime);
+                            auto duration = end - start;
+
+                            log::Info(
+                                _L_,
+                                L"%*s: Complete! (commands took %I64d seconds)\r\n",
+                                m_dwLongerTaskKeyword + 20,
+                                m_strKeyword.c_str(),
+                                duration.count() / 10000000);
+                        }
+
                         AddJobStatistics(m_JobStatisticsWriter->GetTableOutput(), item);
-                        log::Info(_L_, L"%*s: Complete!\r\n", m_dwLongerTaskKeyword + 20, L"JOB");
                         break;
                 }
                 NotifyTask(item);
@@ -773,6 +786,31 @@ HRESULT WolfExecution::CompleteArchive(UploadMessage::ITarget* pUploadMessageQue
         m_pTermination.reset();
     }
 
+    auto archiveSize = [&]() {
+        FileStream fs (_L_);
+
+        if (FAILED(fs.ReadFrom(m_strOutputFullPath.c_str())))
+            return 0LLU;
+
+        return fs.GetSize();
+    };
+
+    GetSystemTimeAsFileTime(&m_ArchiveFinishTime);
+    {
+        auto start = Orc::ConvertTo(m_StartTime);
+        auto end = Orc::ConvertTo(m_ArchiveFinishTime);
+        auto duration = end - start;
+
+        log::Info(
+            _L_,
+            L"%*s: %s (took %I64d seconds, size %I64d bytes)\r\n",
+            m_dwLongerTaskKeyword + 20,
+            m_strKeyword.c_str(),
+            m_strArchiveFileName.c_str(),
+            duration.count() / 10000000,
+            archiveSize());
+    }
+
     if (pUploadMessageQueue && m_Output.UploadOutput)
     {
         if (m_Output.UploadOutput->IsFileUploaded(_L_, m_strOutputFileName))