Duplicate evidence processing running gcp_turbinia_disk_copy_ts
wajihyassine opened this issue · 1 comments
When running the recipe gcp_turbinia_disk_copy_ts
running into an issue where two Turbinia requests are created for the same evidence (one of the original evidence and one of the snapshot of the original evidence). This only seems to be happening when running the recipe with the same project id for source_project_name
and analysis_project_name
Sample of dftw log output (happy to provide more output if needed for debugging)
gcp_turbinia_disk_copy_ts
Preflights:
GCPTokenCheck-analysis: Completed
GCPTokenCheck-source: Completed
Modules:
TimesketchExporter: Setting Up
GCEDiskCopy: Pending
gcp_turbinia_disk_copy_ts
Preflights:
GCPTokenCheck-analysis: Completed
GCPTokenCheck-source: Completed
Modules:
GCEDiskCopy: Completed
GCEForensicsVM: Completed
TurbiniaGCPProcessor: Processing - 0 of 2 containers completed
ThreadPoolExecutor-1_0: Running (pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727)
ThreadPoolExecutor-1_1: Running (evidence-pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727-f688924a-copy)
TimesketchExporter: Pending (TurbiniaGCPProcessor)
ThreadPoolExecutor-1_0: Running (pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727)
Turbinia processing fails due to already being attached to a different resource
ThreadPoolExecutor-1_1: Running (evidence-pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727-f688924a-copy)
runs as intended per it being a snapshot of the original evidence