Timesketch Plaso importer single or multi core? #2944
Unanswered
stijnos1991
asked this question in
Q&A, quick solutions, support
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hello!
I'm trying to import a commonly sized Plaso database of 1,3GB. Currently I'm using the web-gui to start the upload and processing.
I noticed processing the Plaso file takes about an hour on a 16 Core Xeon E-2286M. This seems quite slow to me. Upon further inspection it looks like Plaso is only using a single core to do the import. Total VM CPU usage is around 12%.... It's importing around 1000 event/s.
Is there any way to speed up this process by utilizing all CPU cores?
Beta Was this translation helpful? Give feedback.
All reactions