Suricata

Reported privately: "I found that when an HTTP session has a client download a file larger than the ‘stream.depth’ configuration setting, the ‘log-file’ module which writes in JSON format doesn’t log the file at all, and the ‘log-filestore’ module does not call the ‘LogFilestoreLogCloseMetaFile()’ function so some of the meta data is missing, both of which I believe are because the state is still set to FILE_STATE_OPENED. I’m not sure if this as-designed or something that should be fixed, at least the JSON logging, since filestore works to an extent even in this scenario."