easy-to-use logging method added to the examples

This commit is contained in:
sidheshenator
2015-06-05 11:29:59 -04:00
parent cc8120a660
commit 30054474c6
3 changed files with 56 additions and 29 deletions
+28 -8
View File
@@ -32,6 +32,7 @@
# See http://sleuthkit.org/autopsy/docs/api-docs/3.1/index.html for documentation
import jarray
import inspect
from java.lang import System
from java.util.logging import Level
from org.sleuthkit.datamodel import SleuthkitCase
@@ -58,7 +59,7 @@ class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
# TODO: give it a unique name. Will be shown in module list, logs, etc.
moduleName = "Sample file ingest Module"
def getModuleDisplayName(self):
return self.moduleName
@@ -83,11 +84,15 @@ class SampleJythonFileIngestModuleFactory(IngestModuleFactoryAdapter):
# Looks at the attributes of the passed in file.
class SampleJythonFileIngestModule(FileIngestModule):
_logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
def log(self, level, msg):
self._logger.logp(level, self.__class__.__name__, inspect.stack()[1][3], msg)
# Where any setup and configuration is done
# TODO: Add any setup code that you need here.
def startUp(self, context):
self.logger = Logger.getLogger(SampleJythonFileIngestModuleFactory.moduleName)
self.filesFound = 0
self.filesFound = 0
# Throw an IngestModule.IngestModuleException exception if there was a problem setting up
# raise IngestModuleException(IngestModule(), "Oh No!")
@@ -96,13 +101,13 @@ class SampleJythonFileIngestModule(FileIngestModule):
# Where the analysis is done. Each file will be passed into here.
# TODO: Add your analysis code in here.
def process(self, file):
# For an example, we will flag files with .txt in the name and make a blackboard artifact.
if file.getName().find(".txt") != -1:
self.logger.logp(Level.INFO, SampleJythonFileIngestModule.__name__, "process", "Found a text file: " + file.getName())
self.log(Level.INFO, "Found a text file: " + file.getName())
self.filesFound+=1
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of
# artfiact. Refer to the developer docs for other examples.
art = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
@@ -110,6 +115,21 @@ class SampleJythonFileIngestModule(FileIngestModule):
art.addAttribute(att)
# For the current file, we get all the artifacts. The artifactList should not be empty since we have added
# a new artifact - TSK_INTERESTING_FILE_HIT - (Line 110).
# We iterate through the artifactList(other modules might have added artifacts for the same file) and get
# attributes for that artifact. Again, the attributeList should not be empty since we have added a new
# attribute - "Text Files" - (Line 111, 112).
# We iterate through the attributeList and log every attribute.
# NOTE: Empty list (which may be returned by getArtifacts()/getAttributes()) is not coerced into non-iterable
# NoneType. Hence null check is not necessary.
artifactList = file.getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)
for artifact in artifactList:
attributeList = artifact.getAttributes();
for attrib in attributeList:
self.log(Level.INFO, attrib.toString())
# To further the example, this code will read the contents of the file and count the number of bytes
inputStream = ReadContentInputStream(file)
buffer = jarray.zeros(1024, "b")
@@ -118,7 +138,7 @@ class SampleJythonFileIngestModule(FileIngestModule):
while (len != -1):
totLen = totLen + len
len = inputStream.read(buffer)
return IngestModule.ProcessResult.OK
# Where any shutdown code is run and resources are freed.