ZMQError: Too many open files (windows 10 image, plaso running on macbook)

[rp....@gmail.com]

Any help would be appreciated!

log2timeline.sh --no-dependencies-check --status_view window --logfile /Volumes/1T/plaso/plaso_0818.log /Volumes/1T/plaso/win_mac.plaso /Volumes/1T/plaso/win.E01

The following Volume Shadow Snapshots (VSS) were found:

Identifier      Creation Time

vss1            2018-10-17T01:41:47.467093+00:00

vss2            2018-10-18T03:59:08.005718+00:00

vss3            2018-10-19T06:16:15.512158+00:00

vss4            2018-10-20T15:02:04.134235+00:00

vss5            2018-10-22T02:16:26.018017+00:00

vss6            2018-10-24T10:15:20.018510+00:00

Please specify the identifier(s) of the VSS that should be processed:

Note that a range of stores can be defined as: 3..5. Multiple stores can

be defined as: 1,3,5 (a list of comma separated values). Ranges and lists can

also be combined as: 1,3..5. The first store is 1. All stores can be defined

as "all". If no stores are specified none will be processed. You

can abort with Ctrl^C.

6

Source path : /Volumes/1T/plaso/win.E01

Source type : storage media image

Processing time : 00:00:00

Processing started.

Traceback (most recent call last):

  File "/usr/local/bin/log2timeline.py", line 68, in <module>

    if not Main():

  File "/usr/local/bin/log2timeline.py", line 54, in Main

    tool.ExtractEventsFromSources()

  File "/Library/Python/2.7/site-packages/plaso/cli/log2timeline_tool.py", line 445, in ExtractEventsFromSources

    worker_memory_limit=self._worker_memory_limit)

  File "/Library/Python/2.7/site-packages/plaso/multi_processing/task_engine.py", line 790, in ProcessSources

    self._task_queue.Open()

  File "/Library/Python/2.7/site-packages/plaso/engine/zeromq_queue.py", line 229, in Open

    self._CreateZMQSocket()

  File "/Library/Python/2.7/site-packages/plaso/engine/zeromq_queue.py", line 605, in _CreateZMQSocket

    super(ZeroMQBufferedQueue, self)._CreateZMQSocket()

  File "/Library/Python/2.7/site-packages/plaso/engine/zeromq_queue.py", line 201, in _CreateZMQSocket

    self._zmq_socket = self._zmq_context.socket(self._SOCKET_TYPE)

  File "/Library/Python/2.7/site-packages/zmq/sugar/context.py", line 146, in socket

    s = self._socket_class(self, socket_type, **kwargs)

  File "/Library/Python/2.7/site-packages/zmq/sugar/socket.py", line 59, in __init__

    super(Socket, self).__init__(*a, **kw)

  File "zmq/backend/cython/socket.pyx", line 330, in zmq.backend.cython.socket.Socket.__init__

zmq.error.ZMQError: Too many open files

[Daniel White]

How many files are in the EWF archive? This looks like a variant of https://github.com/log2timeline/plaso/issues/1565

-Daniel

--
You received this message because you are subscribed to the Google Groups "log2timeline-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to log2timeline-dis...@googlegroups.com.
To post to this group, send email to log2timeli...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.