Background

• insertEvent.js current calls AddEvent, a ODB function to insert a json event line.
• ProcessCreate is the primary event of concern because all other types of Sysmon events are link to it

Goals

1. Using the following test function provided, measure the insertion performance

//shortcut to get ticks in milliseconds since epoch
var s = (new Date())*1

print('start: ' + s)
print(Date())

for(var i=0;i < 10000;i++)
  test_ProcessCreate()

var e = (new Date())*1

print('end: ' + e)
print(Date())

var d = (e - s)/1000

print('====')
print('delta in secs ' + d)
print('====')

test_ProcessCreate() → function to generate a self-created ProcessCreate event

Using the codes above, we created a new function to measure how long it takes to insert 10000 ProcessCreate events.

Results:

First attempt: It took 100.776 seconds to insert 10000 ProcessCreate events.

Second attempt: It took 92 seconds to insert 10000 ProcessCreate events.

Third attempt: It took 96.509 seconds to insert 10000 ProcessCreate events.

On average, it takes around 96 seconds to insert 10000 ProcessCreate events.

*Note that test_ProcessCreate() function always generate an Orphan ProcessCreate

2. Propose how modify any test other server functions to measure the total time taken for complete processing such that there are no more ProcessCreate with ToBeProcessed = true for both cases:

(a) Orphan ProcessCreate

(b) ProcessCreate that can be linked