Create multiCleaner.py

[garanews]

This script will delete samples (present into mongodb and on disk) older than X seconds (find in delta variable), with a malware score less than Y value (find in MAX_MALSCORE) and with no virustotal evidences (0 is considered a report).
Before run it, some index into monngodb is needed:
mongo cuckoo then
db.calls.createIndex({"pid": 1})
db.analysis.createIndex({"virustotal_summary": 1, "info.ended": -1})
db.analysis.createIndex({"malscore": 1, "info.ended": -1})
db.analysis.createIndex({"virustotal_summary": -1, "info.ended": -1})
db.analysis.createIndex({"malscore": -1, "info.ended": -1})

It is working, need to fix the duplicates id output from mongo:
db.analysis.find( {$and : [{"malscore": {$gt : -1}}, {"malscore": {$lt : 4}}], "info.ended": {$lt : "2016-06-23 10:00:42"}, "virustotal_summary": {$exists: false } } , {"info.id": 1} )

{ "_id" : ObjectId("576b9ae39992744853f44f2e"), "info" : { "id" : 11 } }
{ "_id" : ObjectId("576b9a3599927449392608ef"), "info" : { "id" : 11 } }
{ "_id" : ObjectId("576ba3949992744937261c39"), "info" : { "id" : 26 } }
{ "_id" : ObjectId("576ba3bf9992744853f4803b"), "info" : { "id" : 26 } }

in order to avoid the double try removal, if "debug = true" will see:

python multiCleaner.py
2016-06-23 15:32:06 starting
found 66 samples
/home/analyst/cuckoo-advanced/storage/analyses/11
deleted: 11
/home/analyst/cuckoo-advanced/storage/analyses/11
[Errno 2] No such file or directory: '/home/analyst/cuckoo-advanced/storage/analyses/11'
/home/analyst/cuckoo-advanced/storage/analyses/26
deleted: 26
/home/analyst/cuckoo-advanced/storage/analyses/26
[Errno 2] No such file or directory: '/home/analyst/cuckoo-advanced/storage/analyses/26'

[doomedraven]

see this https://github.com/spender-sandbox/cuckoo-modified/blob/bc3f63e5e1407337bd5a0da7e3431847ccbb9325/modules/reporting/retention.py

[garanews]

I have seen, the reason I created new one is to keep samples with a malscore greater than X value and/or positive to VT for comparison (malheur) etc
In that script you can set only days...

[doomedraven]

check this one https://github.com/doomedraven/cuckoo-modified/blob/master/utils/remove_older.py

there also your misp improvements merged