Report.json is too big-- Is there any way to reduce the size

[seantree]

Hello guys,

After analyzing so many samples I realized that cuckoo is generating a heavy report size after disabling memory dump and buffer drop. Is there any way to reduce the json file size because it's taking so many disk space on my system.
.
Waiting for some positive reply.
.
Thanks & Regards
Seantree

[thebitbucket123]

There's any number of things that could cause an analysis' report.json file to grow in size. In my experience, it ends up being spammy/repeated behavior of the sample that takes up the most space. It may take the form of repeated API calls in behavioral analysis or repeated network activity in network analysis.

Short of turning off those features, I'm not personally aware of a way to reduce the generated size of your report.json file.

[mattwhatkins]

report.json includes all of the string matches which I've found in the past to massively increase it's size. Some way of requesting certain data for the report via arguments may be preferable.

[RicoVZ]

Hi seantree,

There is a way to reduce the size of the json reports. That is, if you don't mind the API call logs missing from the them. The calls tend to be the force behind large reports.

If you add the option json.calls=0 to your options when submitting a new analysis (as is --options "json.calls=1"), it will not add the API call logs to the report.json files when processing the results.

[seantree]

Hi @RicoVZ Thank you for your reply. In which config file I have to add this line? Reporting.conf?

Thanks & Regards
Seantree

[RicoVZ]

The option json.calls=0 can be added when submitting a task. It is indeed also possible to completely disable API calls in the json report. You can do this by changing calls = yes in reporting.conf to calls = no, This setting is located under [jsondump].

[seantree]

Ok Thanks @RicoVZ for helping me out.

[jbremer]

Is this enough information on this topic @seantree? We're aware of the report size issue (also for MongoDB) and plan to mitigate this somewhere next year.. yes, stuff takes time :p

[jbremer]

Closing issue as resolved.

[sachinmatte]

Hello @jbremer their is section [processing] in cuckoo.conf with analysis_size_limit = 134217728 i.e. 128 MB so why I am getting report.json with size bigger than 500MB+?