Re: [sleuthkit-users] What if a module fails to initialize

[Hoyt H. <hoy...@gm...>]

I'll vote for #2, assuming results from successful modules that completed
prior to the failure were added to the case as normal. I'm also assuming
that a module isn't initialized until after the one before it completes
unless it's the first module in the pipeline. If that's the case and as
long as the user notification tells the user to re-ingest with only the
failed and subsequent modules (including those with output dependencies),
then those modules that successfully ran should be excluded by the user
with no duplication of results.

Hoyt


On Mon, Oct 7, 2013 at 12:22 PM, Brian Carrier <ca...@sl...>wrote:

> There was an error reported last week that the Keyword Search module
> failed to initialize.  We're reviewing how that situation was handled and
> we have two options.  We're looking for feedback.  The scenario is that the
> user has selected the ingest modules that they want to run on the data
> source.  One of the modules fails to initialize (we have a model where each
> module is initialized, it then runs on the entire disk or set of files, and
> then is closed). What should we do when a module does not initialize (for
> the sake of example, let's say it was a hash calculation module).
>
> 1) We log the error, notify the user with a message, and continue to run
> the modules that did initialize. In our current example, a challenge is
> that the later modules in the pipeline may be depending on that module's
> output. For example, the  hash lookup module will need the  hash value so
> that it can use its hash databases.   This approach requires the user to
> then decide to cancel and restart (which may result in duplicate data).
>
> 2) We halt the pipeline and no data is analyzed unless all modules could
> initialize.  The user is notified and can either fix the problem or remove
> the module from the pipeline so that it can continue.
>
> Preferences?
>
> brian
>
>
>
>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>