{"action":"created","issue":{"url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/75","labels_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/75/labels{/name}","comments_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/75/comments","events_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/75/events","html_url":"https://github.com/brad-accuvant/cuckoo-modified/issues/75","id":85342321,"number":75,"title":"BehaviourAnalysis Error","user":{"login":"mhanne0915","id":7477148,"avatar_url":"https://avatars.githubusercontent.com/u/7477148?v=3","gravatar_id":"","url":"https://api.github.com/users/mhanne0915","html_url":"https://github.com/mhanne0915","followers_url":"https://api.github.com/users/mhanne0915/followers","following_url":"https://api.github.com/users/mhanne0915/following{/other_user}","gists_url":"https://api.github.com/users/mhanne0915/gists{/gist_id}","starred_url":"https://api.github.com/users/mhanne0915/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhanne0915/subscriptions","organizations_url":"https://api.github.com/users/mhanne0915/orgs","repos_url":"https://api.github.com/users/mhanne0915/repos","events_url":"https://api.github.com/users/mhanne0915/events{/privacy}","received_events_url":"https://api.github.com/users/mhanne0915/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-06-05T00:18:18Z","updated_at":"2015-06-05T15:18:13Z","closed_at":null,"body":"I run this sample 13a44a9970c6c311a08cae357a545972, and i found that it failed to process (process.py) the logs because there's something wrong on parsing the data in behaviour.py. \r\n\r\nHere's the error:\r\n\r\nERROR:lib.cuckoo.core.plugins:Failed to run the processing module \"BehaviorAnalysis\":\r\nTraceback (most recent call last):\r\n  File \".../utils/../lib/cuckoo/core/plugins.py\", line 194, in process\r\n    data = current.run()\r\n  File \".../utils/../modules/processing/behavior.py\", line 1088, in run\r\n    behavior[\"processes\"] = Processes(self.logs_path).run()\r\n  File \".../utils/../modules/processing/behavior.py\", line 376, in run\r\n    current_log = ParseProcessLog(file_path)\r\n  File \".../utils/../modules/processing/behavior.py\", line 55, in __init__\r\n    self.parse_first_and_reset()\r\n  File \".../utils/../modules/processing/behavior.py\", line 87, in parse_first_and_reset\r\n    self.parser.read_next_message()\r\n  File \".../utils/../lib/cuckoo/common/netlog.py\", line 79, in read_next_message\r\n    data = self.handler.read(4)\r\n  File \"../utils/../modules/processing/behavior.py\", line 100, in read\r\n    raise EOFError("},"comment":{"url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/comments/109325314","html_url":"https://github.com/brad-accuvant/cuckoo-modified/issues/75#issuecomment-109325314","issue_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/75","id":109325314,"user":{"login":"brad-accuvant","id":8310366,"avatar_url":"https://avatars.githubusercontent.com/u/8310366?v=3","gravatar_id":"","url":"https://api.github.com/users/brad-accuvant","html_url":"https://github.com/brad-accuvant","followers_url":"https://api.github.com/users/brad-accuvant/followers","following_url":"https://api.github.com/users/brad-accuvant/following{/other_user}","gists_url":"https://api.github.com/users/brad-accuvant/gists{/gist_id}","starred_url":"https://api.github.com/users/brad-accuvant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brad-accuvant/subscriptions","organizations_url":"https://api.github.com/users/brad-accuvant/orgs","repos_url":"https://api.github.com/users/brad-accuvant/repos","events_url":"https://api.github.com/users/brad-accuvant/events{/privacy}","received_events_url":"https://api.github.com/users/brad-accuvant/received_events","type":"User","site_admin":false},"created_at":"2015-06-05T15:18:13Z","updated_at":"2015-06-05T15:18:13Z","body":"It seems that one of the logged processes did not report any environment info -- I have an idea of what could potentially cause that -- our initial log flush will hold back on the last log in order to avoid duplicates, but it shouldn't hold back __notification__ logs like new process/thread/environ as those won't ever be duplicated.  I guess no subsequent flush happened in that process, so it missed the environment info despite the loq() call succeeding (it output the format of the to-be-sent environ info into the log).\r\n\r\nI should have a fix shortly, thanks!"}}