Usn reason timestamp

[patrickdalla]

Closes #1503 .

[lfcnassif]

Thanks @patrickdalla!

I think there are failing tests in UsnJrnlParserTest, could you update them?

[patrickdalla]

sure

[lfcnassif]

Hi @patrickdalla, thanks for the Unit test fixes.

Could you implement the ParserConfig.xml config files merging idea? So we would be able to turn records extraction on in forensic and pedo profiles without duplicating ParserConfig.xml into them.

[patrickdalla]

Yes. I will. Em seg., 27 de mai. de 2024, 08:09, Luis Filipe Nassif < ***@***.***> escreveu:

…

Hi @patrickdalla <https://github.com/patrickdalla>, thanks for the Unit test fixes. Could you implement the ParserConfig.xml config files merging idea? So we would be able to turn records extraction on in forensic and pedo profiles without duplicating ParserConfig.xml into them. — Reply to this email directly, view it on GitHub <#2231 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AG247S4R6YHIHCU3X35M7X3ZEMO55AVCNFSM6AAAAABIH7HBC6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZTGM2DKMZTGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[lfcnassif]

There is already the ParsersConfig class in iped.engine.config package, it may be used for that.

[patrickdalla]

Hi @lfcnassif . I have created the merging code for ParserConfig.xml from profile. It replaces completely all the parser tag with the same class attribute from default config with the configured in profile. As it was implemented, only changes and additions can be done (no removal).

It works in master and can be merged, but maybe I have to make some changes to avoid conflict in UI config, in which branch i will start working now. There, as the the user can use the UI to select which Parsers to use (including removing some), I replace completely the ParserConfig. So, I will make some distinctions to inform if the config is to be merged ou replaced completely. Maybe a simple attribute in parsers tag. But I will change it in UI config branch, right?

[patrickdalla]

I remembered that the additional profiles created through UI config are saved in binary form. So, maybe, no conflicts will exists. But I will test it.

[lfcnassif]

Thanks @patrickdalla! Parser removal while merging multiple ParserConfig.xml files is not needed for this feature, it is fine. When it is needed, I think a new enabled attribute in xml parser element would be enough to flag the merging code it should be removed.

[lfcnassif]

@patrickdalla, I think you enabled a wrong parser in forensic and pedo profiles. It should be UsnJrnlParser with an enabled extractEntries param right?

[patrickdalla]

Sorry. It is correct now.

[lfcnassif]

Thanks @patrickdalla! I did minor changes and updated the properties prefix to a shorter one.