Gfs/#331 (#334)

* Minor fixes. * Fix filters. Collection on OS X was being slowed down by crawling the /dev folder for unknown reasons. By excluding the dev folder again correctly (the platform specifier had changed) collection is again working.
microsoft · Dec 20, 2019 · b475814 · b475814
1 parent 08ee961
commit b475814
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 4 deletions.
diff --git a/Lib/Collectors/FileSystemCollector.cs b/Lib/Collectors/FileSystemCollector.cs
@@ -120,7 +120,7 @@ public override void ExecuteInternal()
                                 e is System.Security.Cryptography.CryptographicException
                                 || e is ArgumentException)
                             {
-                                Log.Debug($"Could not parse certificate from file: {fileInfo.FullName}");
+                                Log.Verbose($"Could not parse certificate from file: {fileInfo.FullName}");
                             }
                         }
                     }

diff --git a/Lib/Collectors/WindowsFileSystemUtils.cs b/Lib/Collectors/WindowsFileSystemUtils.cs
@@ -74,6 +74,10 @@ public static List<string> GetDllCharacteristics(string Path)
                 {
                     Log.Verbose($"Failed to get PE Headers for {Path} {e.GetType().ToString()}");
                 }
+                catch (Exception e)
+                {
+                    Log.Debug(e, $"Failed to get PE Headers for {Path}");
+                }
             }
 
             return output;

diff --git a/filters.json b/filters.json
@@ -86,7 +86,7 @@
       }
     }
   },
-  "OSX": {
+  "MACOS": {
     "Monitor": {
       "File": {
         "Path": {
@@ -102,7 +102,7 @@
         "Path": {
           "Exclude": [
             "^/private/var/db/uuidtext",
-            "^/dev/",
+            "^/dev",
             "^/.Spotlight-V100"
           ]
         }
@@ -119,7 +119,8 @@
             "^/usr/src/",
             "^/snap/",
             "^/run/systemd/",
-            "^/run/udev/"
+            "^/run/udev/",
+            "^/dev"
           ]
         }
       }