Added by Andreas Herz over 6 years ago. Updated over 5 years ago.
Description
In filestore v2 files are stored by their sha256. When it finds a duplicate, it will only update the timestamp.
I think the request here is to log in some way the number of times this file was already seen.
Stian, IIRC you brought this up. Could you describe what you are after a bit more?
I did not bring it up actually :)
But iirc the wanted feature was to update the metainfo in filestore with first seen, last seen and how many times seen. I guess that should not be too complicated?
Hah, sorry! Doesn't sound over complicated, although I'm not sure what would happen if multiple threads would try to rewrite this file at the same time.
From my notes it was to simply create a flag in the fileinfo entry that it was a dup. I think its simple enough. Of course, we'd only catch this case if the file was seen multiple times within your retention window.
It seems this is something that could be inferred from the fileinfo eve logs