{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/842","labels_url":"https://api.github.com/repos/facebook/osquery/issues/842/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/842/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/842/events","html_url":"https://github.com/facebook/osquery/pull/842","id":60440545,"number":842,"title":"YARA","user":{"login":"wxsBSD","id":1394879,"avatar_url":"https://avatars.githubusercontent.com/u/1394879?v=3","gravatar_id":"","url":"https://api.github.com/users/wxsBSD","html_url":"https://github.com/wxsBSD","followers_url":"https://api.github.com/users/wxsBSD/followers","following_url":"https://api.github.com/users/wxsBSD/following{/other_user}","gists_url":"https://api.github.com/users/wxsBSD/gists{/gist_id}","starred_url":"https://api.github.com/users/wxsBSD/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wxsBSD/subscriptions","organizations_url":"https://api.github.com/users/wxsBSD/orgs","repos_url":"https://api.github.com/users/wxsBSD/repos","events_url":"https://api.github.com/users/wxsBSD/events{/privacy}","received_events_url":"https://api.github.com/users/wxsBSD/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-03-10T02:12:56Z","updated_at":"2015-03-10T12:52:37Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/842","html_url":"https://github.com/facebook/osquery/pull/842","diff_url":"https://github.com/facebook/osquery/pull/842.diff","patch_url":"https://github.com/facebook/osquery/pull/842.patch"},"body":"Implement support for YARA as discussed in #816.\r\n\r\nThis is currently only for OS X, but I will port to Linux as discussion on this continues."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/78046844","html_url":"https://github.com/facebook/osquery/pull/842#issuecomment-78046844","issue_url":"https://api.github.com/repos/facebook/osquery/issues/842","id":78046844,"user":{"login":"wxsBSD","id":1394879,"avatar_url":"https://avatars.githubusercontent.com/u/1394879?v=3","gravatar_id":"","url":"https://api.github.com/users/wxsBSD","html_url":"https://github.com/wxsBSD","followers_url":"https://api.github.com/users/wxsBSD/followers","following_url":"https://api.github.com/users/wxsBSD/following{/other_user}","gists_url":"https://api.github.com/users/wxsBSD/gists{/gist_id}","starred_url":"https://api.github.com/users/wxsBSD/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wxsBSD/subscriptions","organizations_url":"https://api.github.com/users/wxsBSD/orgs","repos_url":"https://api.github.com/users/wxsBSD/repos","events_url":"https://api.github.com/users/wxsBSD/events{/privacy}","received_events_url":"https://api.github.com/users/wxsBSD/received_events","type":"User","site_admin":false},"created_at":"2015-03-10T12:52:37Z","updated_at":"2015-03-10T12:52:37Z","body":"@marpaia Nothing I'm relying on. I thought I would require that work so I merged it into my branch and then did my work. As it turns out I don't need those changes, but when I went to split my work from them my git-fu was not strong enough to do it before I fell asleep. I'll see if I can split my work away and commit it separately when I have time today (might have to wait until tonight).\r\n\r\nI have noticed that occasionally the same event will fire twice. I chalked it up to something in fsevents misbehaving, but never did fully track it down. As for your comment about YARA modifying it's own global state, I'll investigate. I know the stand-alone YARA tool spins off multiple threads when it wants to run in parallel, but I'm not sure what it does with rules in that situation. If it is as simple as each thread getting it's own copy of the rules then I can likely do that for each event that fires. I'll investigate this a bit more today too."}}