log2timeline/dftimewolf

Duplicate evidence processing running gcp_turbinia_disk_copy_ts

wajihyassine opened this issue · 1 comments

When running the recipe gcp_turbinia_disk_copy_ts running into an issue where two Turbinia requests are created for the same evidence (one of the original evidence and one of the snapshot of the original evidence). This only seems to be happening when running the recipe with the same project id for source_project_name and analysis_project_name

Sample of dftw log output (happy to provide more output if needed for debugging)

 gcp_turbinia_disk_copy_ts
   Preflights:
     GCPTokenCheck-analysis: Completed
     GCPTokenCheck-source: Completed
   Modules:
     TimesketchExporter: Setting Up
     GCEDiskCopy: Pending
 gcp_turbinia_disk_copy_ts
   Preflights:
     GCPTokenCheck-analysis: Completed
     GCPTokenCheck-source: Completed
   Modules:
     GCEDiskCopy: Completed
     GCEForensicsVM: Completed
     TurbiniaGCPProcessor: Processing - 0 of 2 containers completed
       ThreadPoolExecutor-1_0: Running (pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727)
       ThreadPoolExecutor-1_1: Running (evidence-pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727-f688924a-copy)
     TimesketchExporter: Pending (TurbiniaGCPProcessor)

ThreadPoolExecutor-1_0: Running (pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727) Turbinia processing fails due to already being attached to a different resource

ThreadPoolExecutor-1_1: Running (evidence-pvc-eeb11398-c00d-4d86-a2c9-3cf21d947727-f688924a-copy) runs as intended per it being a snapshot of the original evidence