# Buggy code
def ExamineEvent(self, mediator, event):
    """Evaluates whether an event contains the right data for a hash lookup.

    Args:
      mediator (AnalysisMediator): mediates interactions between
          analysis plugins and other components, such as storage and dfvfs.
      event (EventObject): event.
    """
    self._EnsureRequesterStarted()
    pathspec = event.pathspec
    event_uuids = self._event_uuids_by_pathspec[pathspec]
    event_uuids.append(event.uuid)
    if event.data_type in self.DATA_TYPES:
        for attribute in self.REQUIRED_HASH_ATTRIBUTES:
            hash_for_lookup = getattr(event, attribute, None)
            if not hash_for_lookup:
                continue
            pathspecs = self._hash_pathspecs[hash_for_lookup]
            pathspecs.append(pathspec)
            # There may be multiple pathspecs that have the same hash. We only
            # want to look them up once.
            if len(pathspecs) == 1:
                self.hash_queue.put(hash_for_lookup)
            return
        warning_message = (
            "Event with ID {0:s} had none of the required attributes {1:s}."
        ).format(event.uuid, self.REQUIRED_HASH_ATTRIBUTES)
        logging.warning(warning_message)


# Traceback (KeyError)
[ERROR] (nsrlsvr   ) PID:XXXXX <analysis_process> <dfvfs.path.os_path_spec.OSPathSpec object at 0xXXXXXXXXXXXX>
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/plaso/multi_processing/analysis_process.py", line 138, in _Main
self._analysis_mediator.ProduceAnalysisReport(self._analysis_plugin)
File "/usr/lib/python2.7/dist-packages/plaso/analysis/mediator.py", line 95, in ProduceAnalysisReport
analysis_report = plugin.CompileReport(self)
File "/usr/lib/python2.7/dist-packages/plaso/analysis/interface.py", line 280, in CompileReport
hash_analysis)
File "/usr/lib/python2.7/dist-packages/plaso/analysis/interface.py", line 187, in _HandleHashAnalysis
event_uuids = self._event_uuids_by_pathspec.pop(pathspec)
KeyError: <dfvfs.path.os_path_spec.OSPathSpec object at 0xXXXXXXXXXXXX>

# Fixed code
def ExamineEvent(self, mediator, event):
    """Evaluates whether an event contains the right data for a hash lookup.

    Args:
      mediator (AnalysisMediator): mediates interactions between
          analysis plugins and other components, such as storage and dfvfs.
      event (EventObject): event.
    """
    self._EnsureRequesterStarted()

    path_spec = event.pathspec
    event_uuids = self._event_uuids_by_pathspec[path_spec]
    event_uuids.append(event.uuid)
    if event.data_type not in self.DATA_TYPES:
        return

    if not self._analyzer.lookup_hash:
        return

    lookup_hash = "{0:s}_hash".format(self._analyzer.lookup_hash)
    lookup_hash = getattr(event, lookup_hash, None)
    if not lookup_hash:
        display_name = mediator.GetDisplayName(path_spec)
        logging.warning(
            (
                "Lookup hash attribute: {0:s}_hash missing from event that "
                "originated from: {1:s}."
            ).format(self._analyzer.lookup_hash, display_name)
        )
        return

    path_specs = self._hash_pathspecs[lookup_hash]
    path_specs.append(path_spec)
    # There may be multiple path specification that have the same hash. We only
    # want to look them up once.
    if len(path_specs) == 1:
        self.hash_queue.put(lookup_hash)