Hash tagging analysis report too large

[joachimmetz]

While troubleshooting #1036 ran into following issue:

Traceback (most recent call last):
  File "tools/psort.py", line 869, in <module>
    if not Main():
  File "tools/psort.py", line 855, in Main
    tool.ProcessStorage()
  File "tools/psort.py", line 821, in ProcessStorage
    self._PrintAnalysisReportsDetails(storage_reader)
  File "tools/psort.py", line 251, in _PrintAnalysisReportsDetails
    for index, analysis_report in enumerate(storage.GetAnalysisReports()):
  File "plaso/storage/zip_file.py", line 2524, in GetAnalysisReports
    data_stream, u'analysis_report'):
  File "plaso/storage/zip_file.py", line 1798, in _ReadAttributeContainersFromStream
    data_stream, container_type)
  File "plaso/storage/zip_file.py", line 1784, in _ReadAttributeContainerFromStreamEntry
    entry_data = data_stream.ReadEntry()
  File "plaso/storage/zip_file.py", line 495, in ReadEntry
    u'Unable to read data entry size value out of bounds.')
IOError: Unable to read data entry size value out of bounds.

The report nsrlsvr generates is too large. Per previous discussions a structural fix requires an overhaul of reports.

• work-around make report smaller
  • do not write every path spec
  • do not serialize event tags as part of report
• remove event tags from analysis report
• generate event tags on demand not on report generation? - done
• don't allow writing reports that are too large to read - no longer using ZIP storage

[joachimmetz]

However it does not look like the contents of the report is that useful:

  "text": "nsrlsvr hash tagging Results
OS:plaso/test_data/MFT: nsrl_present
OS:plaso/test_data/MFT: nsrl_present
OS:plaso/test_data/MFT: nsrl_present
...

[Onager]

Not going to make release, removing milestone.