def ProduceEventWithEventData(self, event, event_data):
"""Produces an event.
Args:
event (EventObject): event.
event_data (EventData): event data.
Raises:
InvalidEvent: if the event timestamp value is not set or out of bounds or
if the event data (attribute container) values cannot be hashed.
"""
if event.timestamp is None:
raise errors.InvalidEvent('Event timestamp value not set.')
if event.timestamp < self._INT64_MIN or event.timestamp > self._INT64_MAX:
raise errors.InvalidEvent('Event timestamp value out of bounds.')
try:
event_data_hash = event_data.GetAttributeValuesHash()
except TypeError as exception:
raise errors.InvalidEvent(
'Unable to hash event data values with error: {0!s}'.format(
exception))
if event_data_hash != self._last_event_data_hash:
# Make a copy of the event data before adding additional values.
event_data = copy.deepcopy(event_data)
self.ProcessEventData(event_data,
parser_chain=self.GetParserChain(),
file_entry=self._file_entry)
if self._event_data_stream_identifier:
event_data.SetEventDataStreamIdentifier(
self._event_data_stream_identifier)
self._storage_writer.AddEventData(event_data)
self._last_event_data_hash = event_data_hash
self._last_event_data_identifier = event_data.GetIdentifier()
if self._last_event_data_identifier:
event.SetEventDataIdentifier(self._last_event_data_identifier)
# TODO: remove this after structural fix is in place
# https://github.com/log2timeline/plaso/issues/1691
event.parser = self.GetParserChain()
self._storage_writer.AddEvent(event)
self._number_of_events += 1
self.last_activity_timestamp = time.time()
def ProduceEventWithEventData(self, event, event_data):
"""Produces an event.
Args:
event (EventObject): event.
event_data (EventData): event data.
Raises:
InvalidEvent: if the event has no timestamp set.
"""
if event.timestamp is None:
raise errors_lib.InvalidEvent('Event must have a timestamp set.')
event_data_hash = event_data.GetAttributeValuesHash()
if event_data_hash != self._last_event_data_hash:
# Make a copy of the event data before adding additional values.
event_data = copy.deepcopy(event_data)
# TODO: refactor to ProcessEventData.
self.ProcessEvent(event_data,
parser_chain=self.GetParserChain(),
file_entry=self._file_entry)
self._storage_writer.AddEventData(event_data)
self._last_event_data_hash = event_data_hash
self._last_event_data_identifier = event_data.GetIdentifier()
if self._last_event_data_identifier:
event.SetEventDataIdentifier(self._last_event_data_identifier)
# TODO: remove this after structural fix is in place
# https://github.com/log2timeline/plaso/issues/1691
event.parser = self.GetParserChain()
self._storage_writer.AddEvent(event)
self._number_of_events += 1
self.last_activity_timestamp = time.time()
def ProduceEventWithEventData(self, event, event_data):
"""Produces an event.
Args:
event (EventObject): event.
event_data (EventData): event data.
Raises:
InvalidEvent: if the event date_time or timestamp value is not set, or
the timestamp value is out of bounds, or if the event data (attribute
container) values cannot be hashed.
"""
parser_chain = self.GetParserChain()
if event.date_time is None:
raise errors.InvalidEvent(
'Date time value not set in event produced by: {0:s}.'.format(
parser_chain))
if event.timestamp is None:
raise errors.InvalidEvent(
'Timestamp value not set in event produced by: {0:s}.'.format(
parser_chain))
if event.timestamp < self._INT64_MIN or event.timestamp > self._INT64_MAX:
raise errors.InvalidEvent(
'Timestamp value out of bounds in event produced by: {0:s}.'.
format(parser_chain))
# TODO: rename this to event_data.parser_chain or equivalent.
event_data.parser = parser_chain
try:
event_data_hash = event_data.GetAttributeValuesHash()
except TypeError as exception:
raise errors.InvalidEvent((
'Unable to hash event data values produced by: {0:s} with error: '
'{1!s}').format(parser_chain, exception))
if event_data_hash != self._last_event_data_hash:
if self._event_data_stream_identifier:
event_data.SetEventDataStreamIdentifier(
self._event_data_stream_identifier)
self._storage_writer.AddAttributeContainer(event_data)
self._last_event_data_hash = event_data_hash
self._last_event_data_identifier = event_data.GetIdentifier()
if self._last_event_data_identifier:
event.SetEventDataIdentifier(self._last_event_data_identifier)
self._storage_writer.AddAttributeContainer(event)
if self._parser_chain_components:
parser_name = self._parser_chain_components[-1]
self._session.parsers_counter[parser_name] += 1
self._session.parsers_counter['total'] += 1
self._number_of_events += 1
self.last_activity_timestamp = time.time()