Unified Logs: Oversize Data Reference of Log Firehose Tracepoint is 4 bytes

[lukbukkit]

Hi,

Thanks for your awesome documentation for various binary formats. While working with the macos-unifiedlogs library, I encountered an issue with oversize data references from firehose log tracepoints to oversize chunks. You can find more about it at mandiant/macos-UnifiedLogs#13.

In summary, I observed that the field oversize data reference of firehose log tracepoints has a size of 4 and not 2 bytes. This change ensures consistency with the field data reference of oversize chunks, which also has a length of 4 bytes. After this change, the library could assign more log tracepoints to oversize data.

Furthermore, I noticed that if oversize data is present, no data items are stored within the original firehose chunk. Is my notiation for this obersavation acceptable or have you observed something different?

Best
Lukas

[joachimmetz]

thanks for flagging, any test file you can share that contain this format case?

[lukbukkit]

Hi, I shared an example in the related pull request for macos-UnifiedLogs and also noticed that the same issue may exist for Firehose Signpost Tracepoints. However, I haven't seen it appear in real data.

[joachimmetz]

Hi, I shared an example in the related pull request for macos-UnifiedLogs and also noticed that the same issue may exist for Firehose Signpost Tracepoints. However, I haven't seen it appear in real data.

Thanks, I'll have a closer look when time permits, but there are a couple of other priorities on my plate at the moment.