[plaso] Added sessionize analysis plugin

[plaso] Added sessionize analysis plugin

[jberggren, 2017-12-11 13:26:38]

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py
File plaso/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py#...
plaso/analysis/sessionize.py:21: _MINUTES_TO_MICROSECONDS = (60 *
timelib.Timestamp.MICRO_SECONDS_PER_SECOND)
Feels like this could be implemented in timelib to be re-used?
E.g: timelib.Timestamp.MICRO_SECONDS_PER_MINUTE

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py#...
plaso/analysis/sessionize.py:27: self._events_per_session = [0]
This looks like a counter, why is it a list?

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py#...
plaso/analysis/sessionize.py:79: label = 'session_{0:d}'.format(current_session)
What happens if we have 2 different sessions with the same number of events?
Will this produce double labels?

https://codereview.appspot.com/337220043/diff/1/tests/analysis/sessionize.py
File tests/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/1/tests/analysis/sessionize.py#...
tests/analysis/sessionize.py:39: plugin.SetMaxPause(10)
I would do: plugin.SetMaxPause(max_pause_minutes=10) but totally up to you

[onager, 2017-12-27 09:38:41]

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py
File plaso/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py#...
plaso/analysis/sessionize.py:21: _MINUTES_TO_MICROSECONDS = (60 *
timelib.Timestamp.MICRO_SECONDS_PER_SECOND)
On 2017/12/11 13:26:38, jberggren wrote:
> Feels like this could be implemented in timelib to be re-used?
> E.g: timelib.Timestamp.MICRO_SECONDS_PER_MINUTE

Done.

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py#...
plaso/analysis/sessionize.py:27: self._events_per_session = [0]
On 2017/12/11 13:26:38, jberggren wrote:
> This looks like a counter, why is it a list?

It was both a counter and a list. Changed this around to hopefully look a bit
cleaner.

https://codereview.appspot.com/337220043/diff/1/plaso/analysis/sessionize.py#...
plaso/analysis/sessionize.py:79: label = 'session_{0:d}'.format(current_session)
On 2017/12/11 13:26:38, jberggren wrote:
> What happens if we have 2 different sessions with the same number of events?
> Will this produce double labels?

No, but I've changed this anyway.

https://codereview.appspot.com/337220043/diff/1/tests/analysis/sessionize.py
File tests/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/1/tests/analysis/sessionize.py#...
tests/analysis/sessionize.py:39: plugin.SetMaxPause(10)
On 2017/12/11 13:26:38, jberggren wrote:
> I would do: plugin.SetMaxPause(max_pause_minutes=10) but totally up to you

Acknowledged.

[onager, 2017-12-27 10:31:36]

Code updated.

[Joachim Metz, 2017-12-29 13:57:21]

https://codereview.appspot.com/337220043/diff/20001/plaso/analysis/sessionize.py
File plaso/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/20001/plaso/analysis/sessionize...
plaso/analysis/sessionize.py:25: 10 * timelib.Timestamp.MICROSECONDS_PER_MINUTE)
please move this into a class constant

_DEFAULT_PAUSE_TIME = 10 * timelib.Timestamp.MICROSECONDS_PER_MINUTE

https://codereview.appspot.com/337220043/diff/20001/plaso/analysis/sessionize...
plaso/analysis/sessionize.py:36: same session, in minutes.
please use a 4 space continuation indentation

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/__init_...
File plaso/cli/helpers/__init__.py (right):

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/__init_...
plaso/cli/helpers/__init__.py:23: from plaso.cli.helpers import
sessionize_analysis
please use alphabetical order

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
File plaso/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:9: from plaso.analysis import
sessionize
please use alphabetical order

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:10: 
+ 1 white line

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:54:
analysis_plugin.SetMaxPause(maxpause)
raise BadConfigOption if maxpause < 0

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize.py
File tests/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize...
tests/analysis/sessionize.py:9: from plaso.analysis import sessionize
Please use alphabetical order

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize...
tests/analysis/sessionize.py:16: class TestEvent(events.EventObject):
Why not use TestEvent defined in containers test lib ?
https://github.com/log2timeline/plaso/blob/eec90b6f91e4a134a0416de4ed9fdb0387...

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize...
tests/analysis/sessionize.py:19: 
+ 1 white line

https://codereview.appspot.com/337220043/diff/20001/tests/cli/helpers/session...
File tests/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/20001/tests/cli/helpers/session...
tests/cli/helpers/sessionize_analysis.py:11: from plaso.lib import errors
please use alphabetical order

https://codereview.appspot.com/337220043/diff/20001/tests/cli/helpers/session...
tests/cli/helpers/sessionize_analysis.py:58: options, None)
+ test case for invalid max_pause value and max_pause < 0

[onager, 2018-01-02 11:42:30]

Code updated.

[onager, 2018-01-02 13:57:40]

https://codereview.appspot.com/337220043/diff/20001/plaso/analysis/sessionize.py
File plaso/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/20001/plaso/analysis/sessionize...
plaso/analysis/sessionize.py:25: 10 * timelib.Timestamp.MICROSECONDS_PER_MINUTE)
On 2017/12/29 13:57:21, Joachim Metz wrote:
> please move this into a class constant
> 
> _DEFAULT_PAUSE_TIME = 10 * timelib.Timestamp.MICROSECONDS_PER_MINUTE

Done.

https://codereview.appspot.com/337220043/diff/20001/plaso/analysis/sessionize...
plaso/analysis/sessionize.py:36: same session, in minutes.
On 2017/12/29 13:57:21, Joachim Metz wrote:
> please use a 4 space continuation indentation

Done.

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/__init_...
File plaso/cli/helpers/__init__.py (right):

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/__init_...
plaso/cli/helpers/__init__.py:23: from plaso.cli.helpers import
sessionize_analysis
On 2017/12/29 13:57:21, Joachim Metz wrote:
> please use alphabetical order

Done.

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
File plaso/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:9: from plaso.analysis import
sessionize
On 2017/12/29 13:57:21, Joachim Metz wrote:
> please use alphabetical order

Done.

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:10: 
On 2017/12/29 13:57:21, Joachim Metz wrote:
> + 1 white line

Done.

https://codereview.appspot.com/337220043/diff/20001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:54:
analysis_plugin.SetMaxPause(maxpause)
On 2017/12/29 13:57:21, Joachim Metz wrote:
> raise BadConfigOption if maxpause < 0 

Done. Made it <= because a value of zero will just tag every event, which is not
desirable.

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize.py
File tests/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize...
tests/analysis/sessionize.py:9: from plaso.analysis import sessionize
On 2017/12/29 13:57:21, Joachim Metz wrote:
> Please use alphabetical order

Done.

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize...
tests/analysis/sessionize.py:16: class TestEvent(events.EventObject):
On 2017/12/29 13:57:21, Joachim Metz wrote:
> Why not use TestEvent defined in containers test lib ?
>
https://github.com/log2timeline/plaso/blob/eec90b6f91e4a134a0416de4ed9fdb0387...

Done.

https://codereview.appspot.com/337220043/diff/20001/tests/analysis/sessionize...
tests/analysis/sessionize.py:19: 
On 2017/12/29 13:57:21, Joachim Metz wrote:
> + 1 white line

Acknowledged.

https://codereview.appspot.com/337220043/diff/20001/tests/cli/helpers/session...
File tests/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/20001/tests/cli/helpers/session...
tests/cli/helpers/sessionize_analysis.py:11: from plaso.lib import errors
On 2017/12/29 13:57:21, Joachim Metz wrote:
> please use alphabetical order

Done.

https://codereview.appspot.com/337220043/diff/20001/tests/cli/helpers/session...
tests/cli/helpers/sessionize_analysis.py:58: options, None)
On 2017/12/29 13:57:21, Joachim Metz wrote:
> + test case for invalid max_pause value and max_pause < 0

Done.

[Joachim Metz, 2018-01-02 18:18:32]

https://codereview.appspot.com/337220043/diff/40001/plaso/cli/helpers/session...
File plaso/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/40001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:56: if maxpause <= 0:
maxpause -> maximum_pause per
https://github.com/log2timeline/plaso/wiki/Style-guide#naming

https://codereview.appspot.com/337220043/diff/40001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:58: 'Max pause value {0:d} is not
supported. '
Max => Maximum

"Must be greater than 0" is a sentence fragment.

Consider:
Unsupported maximum pause value: {0:d} value must be greater than 0.

https://codereview.appspot.com/337220043/diff/40001/tests/analysis/sessionize.py
File tests/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/40001/tests/analysis/sessionize...
tests/analysis/sessionize.py:19: {'timestamp':
timelib.Timestamp.CopyFromString('2015-05-01 00:00:00'),},
),}, => )},

https://codereview.appspot.com/337220043/diff/40001/tests/cli/helpers/session...
File tests/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/40001/tests/cli/helpers/session...
tests/cli/helpers/sessionize_analysis.py:60: options.sessionize_maxpause = 0
maxpause => maximum_pause

[onager, 2018-01-03 19:16:52]

Code updated.

[onager, 2018-01-03 19:17:47]

https://codereview.appspot.com/337220043/diff/40001/plaso/cli/helpers/session...
File plaso/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/40001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:56: if maxpause <= 0:
On 2018/01/02 18:18:31, Joachim Metz wrote:
> maxpause -> maximum_pause per
> https://github.com/log2timeline/plaso/wiki/Style-guide#naming

Done.

https://codereview.appspot.com/337220043/diff/40001/plaso/cli/helpers/session...
plaso/cli/helpers/sessionize_analysis.py:58: 'Max pause value {0:d} is not
supported. '
On 2018/01/02 18:18:31, Joachim Metz wrote:
> Max => Maximum
> 
> "Must be greater than 0" is a sentence fragment.
> 
> Consider:
> Unsupported maximum pause value: {0:d} value must be greater than 0.
> 

Acknowledged.

https://codereview.appspot.com/337220043/diff/40001/tests/analysis/sessionize.py
File tests/analysis/sessionize.py (right):

https://codereview.appspot.com/337220043/diff/40001/tests/analysis/sessionize...
tests/analysis/sessionize.py:19: {'timestamp':
timelib.Timestamp.CopyFromString('2015-05-01 00:00:00'),},
On 2018/01/02 18:18:32, Joachim Metz wrote:
> ),}, => )},

Done.

https://codereview.appspot.com/337220043/diff/40001/tests/cli/helpers/session...
File tests/cli/helpers/sessionize_analysis.py (right):

https://codereview.appspot.com/337220043/diff/40001/tests/cli/helpers/session...
tests/cli/helpers/sessionize_analysis.py:60: options.sessionize_maxpause = 0
On 2018/01/02 18:18:32, Joachim Metz wrote:
> maxpause => maximum_pause

Done.

[Joachim Metz, 2018-01-03 19:41:27]

LGTM

[onager, 2018-01-04 16:18:03]

Changes have been merged with master branch. To close the review and clean up
the feature branch you can run: review.py close sessionize