997319 - Data request: modules loaded into Firefox which match the pattern .*\.[0-9a-f]{12}\.dll

Status: RESOLVED FIXED

(Socorro :: Data request, task)

Description

[Benjamin Smedberg]

Socorro data request:

To determine the risk of bug 973138, we'd like to get a list of modules loaded into Firefox/plugin crash reports which match this pattern:

.*\.[0-9a-f]{12}\.dll (case-insensitive)

This should catch the following modules from that bug:
MovieMode.48CA2AEFA22D.dll
SafeMonitor.5D8B1F66A294.dll
WbShld.384B48E6DC83.dll

But I'm interested in what other DLLs it catches. I tried to do this using a new custom ES search, but the searches timed out.

I think it would be sufficient to do this over 4 days of recent crashes.

Can I have these results by Friday?

Comment 1

[[DEACTIVATED] Adrian Gaudebert]

If you have an elasticsearch JSON query, I can run it against production data and give you the results. 

I filed bug 997816 about the timeout problem.

Comment 2

[Lonnen :lonnen]

I used this stage super search page: https://crash-stats.allizom.org/search/custom/?date=%3E%3D2014-04-15&dump=~.*\.[0-9a-f]{12}\.dll&_facets=signature&_columns=signature&_columns=date

to construct a raw ES query that I ran directly on the production ES servers. I got no results, not even the expected ones. Looking it over again.

Comment 3

[Lonnen :lonnen]

@adrian -- so "wildcard" queries don't appear to match a regex; they recognize * and ?. I tried changing the query to use a "regex" query type and got "No query registered for [regexp]". After chatting with Erik in irc I rewrote the query to matchall and use a regex filter. That had a similar error "No filter registered for [regexp]".

Could you handle this bug and show me what eventually worked? I bet it would take you much less time than it has already taken me.

Comment 4

[Lonnen :lonnen]

@mbrandt -- this is probably outside the scope of general website functionality. We're running raw queries against the ES servers directly.

Comment 5

[Matt Brandt [:mbrandt]]

@lonnen - thank you for the clarification. Agreed

Comment 6

[(Away)]

For comment 3

Comment 7

[[DEACTIVATED] Adrian Gaudebert]

Here are the results I found from production data:

MovieMode.48CA2AEFA22D.dll
SearchDonkey.E3E38E2B3C8C.dll
LightsOff.CD920490367F.dll
WbShld.384B48E6DC83.dll
Websteroids.B324755F3F87.dll
ZombieAlert.A222801BB6B4.dll
Radsteroids.33AABCF1AD13.dll

I'm going to attach the elasticsearch query and the script I used to extract that data as well so you can perform the same operation again if need be.

Comment 8

[[DEACTIVATED] Adrian Gaudebert]

Attachment: es_dlls.json

elasticsearch query I used to get all the dumps containing the dlls we are looking for.

Comment 9

[[DEACTIVATED] Adrian Gaudebert]

Attachment: dlls.py

Python script I used to extract DLL names from the dumps I received from elasticsearch.

Comment 10

[Benjamin Smedberg]

Thanks.