-
|
Hi, Thanks for creating this tool btw!Error.log: 2025-05-13 10:55:25 INFO 2025-05-13 10:55:25 INFO [+] Modules imports status: OK the way kape calls it in mkape |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
Hi, thanks ! I believe this is the same problem as in here : #81 Basically, there is a hard limit of how many columns a SQLite table can have (and Zircolite is based on SQLite). This problem is directly linked to the number of provided log files with different sources/channels (powershell, sysmon, security etc.)to Zircolite. One solution is to limit the above (check the linked issue) |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the reply, yes i have the same reason for that error. Just wondering any plans in the future to split the output so the too many column issue would be avoided? The collection i ran it on was just a kape !SANS triage target and the evtx logs it collected by default generated too much columns for zircolite. Thanks and take care! |
Beta Was this translation helpful? Give feedback.
-
|
I have worked a little bit on a it in the v3 branch where zircolite handle the files separately and concurrently. But it is just a PoC for now. |
Beta Was this translation helpful? Give feedback.
Hi, thanks !
I believe this is the same problem as in here : #81
Basically, there is a hard limit of how many columns a SQLite table can have (and Zircolite is based on SQLite). This problem is directly linked to the number of provided log files with different sources/channels (powershell, sysmon, security etc.)to Zircolite.
One solution is to limit the above (check the linked issue)