[plaso] Changes for splitting event data from event

[plaso] Changes for splitting event data from event

[Joachim Metz, 2017-11-26 08:10:50]

Code updated.

[onager, 2017-11-29 11:23:21]

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
File plaso/storage/fake_storage.py (right):

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
plaso/storage/fake_storage.py:77: """Reads the event data into the event.
-the first "the"

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
plaso/storage/fake_storage.py:79: This function is intended to offer backwards
event behavior.
Do you mean "backwards compatible"?

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py
File plaso/storage/zip_file.py (right):

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:794: self._attribute_container_cache = {}
Rename to _attribute_container_caches, as this is a dict containing the other
caches, per line 972

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:960: available event
-line break

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:977: lookup_key = u'{0:d}.{1:d}'.format(stream_number,
entry_index)
move out of the conditional, to after attribute_container

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:999: container_cache_lfu.append(lookup_key)
Should be .insert(0, lookup_key), otherwise the pop() on line 990 removes the
most recently used item.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:1876: """Reads the event data into the event.
-the first the

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:1878: This function is intended to offer backwards
event behavior.
I think you mean "backwards compatible"

[Joachim Metz, 2017-11-30 20:19:50]

Thx for flagging the issue, not sure what happened, this code was lying around a
bit.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
File plaso/storage/fake_storage.py (right):

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
plaso/storage/fake_storage.py:77: """Reads the event data into the event.
On 2017/11/29 11:23:21, onager wrote:
> -the first "the"

Done.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
plaso/storage/fake_storage.py:79: This function is intended to offer backwards
event behavior.
I did, though on second thought I might like the "backwards event behavior"
better ;)

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py
File plaso/storage/zip_file.py (right):

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:794: self._attribute_container_cache = {}
On 2017/11/29 11:23:21, onager wrote:
> Rename to _attribute_container_caches, as this is a dict containing the other
> caches, per line 972

Done.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:960: available event
On 2017/11/29 11:23:21, onager wrote:
> -line break

Done.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:977: lookup_key = u'{0:d}.{1:d}'.format(stream_number,
entry_index)
On 2017/11/29 11:23:21, onager wrote:
> move out of the conditional, to after attribute_container

Done.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:999: container_cache_lfu.append(lookup_key)
On 2017/11/29 11:23:21, onager wrote:
> Should be .insert(0, lookup_key), otherwise the pop() on line 990 removes the
> most recently used item.

Done.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:1876: """Reads the event data into the event.
On 2017/11/29 11:23:21, onager wrote:
> -the first the

Done.

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/zip_file.py...
plaso/storage/zip_file.py:1878: This function is intended to offer backwards
event behavior.
On 2017/11/29 11:23:21, onager wrote:
> I think you mean "backwards compatible"

Done.

[Joachim Metz, 2017-11-30 20:24:43]

Code updated.

[onager, 2017-12-02 20:26:16]

LGTM

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
File plaso/storage/fake_storage.py (right):

https://codereview.appspot.com/331350043/diff/20001/plaso/storage/fake_storag...
plaso/storage/fake_storage.py:79: This function is intended to offer backwards
event behavior.
On 2017/11/30 20:19:49, Joachim Metz wrote:
> I did, though on second thought I might like the "backwards event behavior"
> better ;)

I did wonder about that =)

[Joachim Metz, 2017-12-03 05:32:57]

Changes have been merged with master branch. To close the review and clean up
the feature branch you can run: review.py close eventdata