Use a HashMap for Timesync parsing

Cargo.toml

@@ -7,19 +7,19 @@ edition = "2021"
 
 [dependencies]
 nom = "7.1.3"
-serde_json = "1.0.128"
-serde = { version = "1.0.210", features = ["derive"] }
+serde_json = "1.0.133"
+serde = { version = "1.0.215", features = ["derive"] }
 log = "0.4.22"
 lz4_flex = "0.11.3"
 byteorder = "1.5.0"
 plist = "1.7.0"
-regex = "1.10.6"
+regex = "1.11.1"
 base64 = "0.22.1"
 chrono = "0.4.38"
 
 [dev-dependencies]
 simplelog = "0.12.2"
-csv = "1.3.0"
+csv = "1.3.1"
 chrono = "0.4.38"
 criterion = "0.5.1"
 anyhow = "1.0.93"

benches/big_sur_benchmark.rs

@@ -5,8 +5,6 @@
 // is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and limitations under the License.
 
-use std::path::PathBuf;
-
 use criterion::{criterion_group, criterion_main, Criterion};
 use macos_unifiedlogs::{
     dsc::SharedCacheStrings,
@@ -15,6 +13,7 @@ use macos_unifiedlogs::{
     unified_log::UnifiedLogData,
     uuidtext::UUIDText,
 };
+use std::{collections::HashMap, path::PathBuf};
 
 fn big_sur_parse_log(path: &str) {
     let _ = parse_log(&path).unwrap();
@@ -24,7 +23,7 @@ fn bench_build_log(
     log_data: &UnifiedLogData,
     string_results: &Vec<UUIDText>,
     shared_strings_results: &Vec<SharedCacheStrings>,
-    timesync_data: &Vec<TimesyncBoot>,
+    timesync_data: &HashMap<String, TimesyncBoot>,
     exclude_missing: bool,
 ) {
     let (_, _) = build_log(

benches/high_sierra_benchmark.rs

@@ -5,8 +5,6 @@
 // is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and limitations under the License.
 
-use std::path::PathBuf;
-
 use criterion::{criterion_group, criterion_main, Criterion};
 use macos_unifiedlogs::{
     dsc::SharedCacheStrings,
@@ -15,6 +13,7 @@ use macos_unifiedlogs::{
     unified_log::UnifiedLogData,
     uuidtext::UUIDText,
 };
+use std::{collections::HashMap, path::PathBuf};
 fn high_sierra_parse_log(path: &str) {
     let _ = parse_log(&path).unwrap();
 }
@@ -23,7 +22,7 @@ fn bench_build_log(
     log_data: &UnifiedLogData,
     string_results: &Vec<UUIDText>,
     shared_strings_results: &Vec<SharedCacheStrings>,
-    timesync_data: &Vec<TimesyncBoot>,
+    timesync_data: &HashMap<String, TimesyncBoot>,
     exclude_missing: bool,
 ) {
     let (_, _) = build_log(

benches/monterey_benchmark.rs

@@ -5,7 +5,7 @@
 // is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and limitations under the License.
 
-use std::path::PathBuf;
+use std::{collections::HashMap, path::PathBuf};
 
 use criterion::{criterion_group, criterion_main, Criterion};
 use macos_unifiedlogs::{
@@ -23,7 +23,7 @@ fn bench_build_log(
     log_data: &UnifiedLogData,
     string_results: &Vec<UUIDText>,
     shared_strings_results: &Vec<SharedCacheStrings>,
-    timesync_data: &Vec<TimesyncBoot>,
+    timesync_data: &HashMap<String, TimesyncBoot>,
     exclude_missing: bool,
 ) {
     let (_, _) = build_log(

examples/parse_tracev3/src/main.rs

@@ -6,13 +6,10 @@
 // See the License for the specific language governing permissions and limitations under the License.
 
 use log::LevelFilter;
-use macos_unifiedlogs::dsc::SharedCacheStrings;
 use macos_unifiedlogs::parser::{build_log, parse_log};
-use macos_unifiedlogs::timesync::TimesyncBoot;
 use macos_unifiedlogs::unified_log::LogData;
-use macos_unifiedlogs::uuidtext::UUIDText;
-
 use simplelog::{Config, SimpleLogger};
+use std::collections::HashMap;
 use std::env;
 use std::error::Error;
 use std::fs::OpenOptions;
@@ -39,9 +36,9 @@ fn parse_trace_file(path: &str) {
     let log_data = parse_log(path).unwrap();
     let filename = Path::new(path);
     // Pass empty UUID, UUID cache, timesync files
-    let string_results: Vec<UUIDText> = Vec::new();
-    let shared_strings_results: Vec<SharedCacheStrings> = Vec::new();
-    let timesync_data: Vec<TimesyncBoot> = Vec::new();
+    let string_results = Vec::new();
+    let shared_strings_results = Vec::new();
+    let timesync_data = HashMap::new();
     let exclude_missing = false;
 
     // We only get minimal data since we dont have the log metadata

examples/unifiedlog_iterator/src/main.rs

@@ -17,6 +17,7 @@ use macos_unifiedlogs::timesync::TimesyncBoot;
 use macos_unifiedlogs::unified_log::{LogData, UnifiedLogData};
 use macos_unifiedlogs::uuidtext::UUIDText;
 use simplelog::{Config, SimpleLogger};
+use std::collections::HashMap;
 use std::error::Error;
 use std::fs::OpenOptions;
 use std::io::Write;
@@ -130,7 +131,7 @@ fn parse_live_system(writer: &mut OutputWriter) {
 fn parse_trace_file(
     string_results: &[UUIDText],
     shared_strings_results: &[SharedCacheStrings],
-    timesync_data: &[TimesyncBoot],
+    timesync_data: &HashMap<String, TimesyncBoot>,
     path: &str,
     writer: &mut OutputWriter,
 ) {
@@ -317,7 +318,7 @@ fn iterate_chunks(
     missing: &mut Vec<UnifiedLogData>,
     strings_data: &[UUIDText],
     shared_strings: &[SharedCacheStrings],
-    timesync_data: &[TimesyncBoot],
+    timesync_data: &HashMap<String, TimesyncBoot>,
     writer: &mut OutputWriter,
     oversize_strings: &mut UnifiedLogData,
 ) -> usize {

examples/unifiedlog_parser/src/main.rs

@@ -16,11 +16,12 @@ use macos_unifiedlogs::timesync::TimesyncBoot;
 use macos_unifiedlogs::unified_log::{LogData, UnifiedLogData};
 use macos_unifiedlogs::uuidtext::UUIDText;
 use simplelog::{Config, SimpleLogger};
+use std::collections::HashMap;
 use std::error::Error;
-use std::{fs, io};
 use std::fs::OpenOptions;
 use std::io::Write;
 use std::path::PathBuf;
+use std::{fs, io};
 
 use clap::Parser;
 use csv::Writer;
@@ -101,7 +102,7 @@ fn parse_live_system(writer: &mut Writer<Box<dyn Write>>) {
         &shared_strings,
         &timesync_data,
         "/private/var/db/diagnostics",
-        writer
+        writer,
     );
 
     eprintln!("\nFinished parsing Unified Log data.");
@@ -112,9 +113,9 @@ fn parse_live_system(writer: &mut Writer<Box<dyn Write>>) {
 fn parse_trace_file(
     string_results: &[UUIDText],
     shared_strings_results: &[SharedCacheStrings],
-    timesync_data: &[TimesyncBoot],
+    timesync_data: &HashMap<String, TimesyncBoot>,
     path: &str,
-    writer: &mut Writer<Box<dyn Write>>
+    writer: &mut Writer<Box<dyn Write>>,
 ) {
     // We need to persist the Oversize log entries (they contain large strings that don't fit in normal log entries)
     // Some log entries have Oversize strings located in different tracev3 files.
@@ -318,8 +319,7 @@ fn parse_trace_file(
     // Since we have all Oversize entries now. Go through any log entries that we were not able to build before
     for mut leftover_data in missing_data {
         // Add all of our previous oversize data to logs for lookups
-        leftover_data
-            .oversize = oversize_strings.oversize.clone();
+        leftover_data.oversize = oversize_strings.oversize.clone();
 
         // Exclude_missing = false
         // If we fail to find any missing data its probably due to the logs rolling
@@ -340,10 +340,12 @@ fn parse_trace_file(
 
 fn construct_writer(output_path: &str) -> Result<Writer<Box<dyn Write>>, Box<dyn Error>> {
     let writer = if output_path != "" {
-        Box::new(OpenOptions::new()
-            .append(true)
-            .create(true)
-            .open(output_path)?) as Box<dyn Write>
+        Box::new(
+            OpenOptions::new()
+                .append(true)
+                .create(true)
+                .open(output_path)?,
+        ) as Box<dyn Write>
     } else {
         Box::new(io::stdout()) as Box<dyn Write>
     };
@@ -376,7 +378,10 @@ fn output_header(writer: &mut Writer<Box<dyn Write>>) -> Result<(), Box<dyn Erro
 }
 
 // Append or create csv file
-fn output(results: &Vec<LogData>, writer: &mut Writer<Box<dyn Write>>) -> Result<(), Box<dyn Error>> {
+fn output(
+    results: &Vec<LogData>,
+    writer: &mut Writer<Box<dyn Write>>,
+) -> Result<(), Box<dyn Error>> {
     for data in results {
         let date_time = Utc.timestamp_nanos(data.time as i64);
         writer.write_record(&[

examples/unifiedlog_parser_json/src/main.rs

@@ -15,6 +15,7 @@ use macos_unifiedlogs::timesync::TimesyncBoot;
 use macos_unifiedlogs::unified_log::{LogData, UnifiedLogData};
 use macos_unifiedlogs::uuidtext::UUIDText;
 use simplelog::{Config, SimpleLogger};
+use std::collections::HashMap;
 use std::error::Error;
 use std::fs;
 use std::fs::OpenOptions;
@@ -105,7 +106,7 @@ fn parse_live_system() {
 fn parse_trace_file(
     string_results: &[UUIDText],
     shared_strings_results: &[SharedCacheStrings],
-    timesync_data: &[TimesyncBoot],
+    timesync_data: &HashMap<String, TimesyncBoot>,
     path: &str,
 ) {
     // We need to persist the Oversize log entries (they contain large strings that don't fit in normal log entries)