@@ -0,0 +1,1000 @@
+def RunLog2Timeline(client_id, directories, base_dir='/grrfuse'):%0A  import subprocess%0A  client_id = client_id.Basename()%0A  hostname = console_utils.ClientIdToHostname(client_id)%0A  filename = '/tmp/plaso/%25s.plaso' %25 hostname%0A  #os.makedirs(os.path.dirname(filename))%0A  for dir_path in directories:%0A    path = os.path.join(base_dir, client_id, dir_path)%0A    if os.path.exists(path):%0A      #command = %22/usr/bin/log2timeline.py -p --single_thread %25s %25s%22 %25 (filename, path)%0A      command = %22/usr/bin/log2timeline.py --workers=5 -p %25s %25s%22 %25 (filename, path)%0A      print 'Running: ', command%0A      subprocess.check_call(command.split())%0A  if os.path.exists(filename):%0A    import_command = %22/usr/bin/psort.py -a -o timesketch --name '%25s Timeline' %25s%22 %25 (hostname, filename)%0A    print 'Running: ', import_command%0A    subprocess.check_call(import_command.split())%0ADIRS = %5Br'fs/os/C:/Windows/System32/winevt/Logs'%5D%0A#, r'fs/os/C:/Windows/System32'%5D%0Afor c in SearchClients('.'):%0A  RunLog2Timeline(c%5B0%5D.urn, DIRS)%0A

Create runlog2timeline.py