Project

General

Profile

Actions
Copy link

Bug #6161

open

file-store: missing hash on TRUNCATED files

Added by Andreas Herz about 2 years ago. Updated about 2 months ago.

Status:
Feedback
Priority:
Normal
Assignee:
Andreas Herz
Target version:
TBD
Affected Versions:
6.0.13, 7.0.0-rc2
Effort:
Difficulty:
Label:

Description

While `sha256` is always seen, when we also enable `md5` and/or `sha1` via `force-hash` they are not shown in the log for files being flagged TRUNCATED.

Related issues 2 (2 open — 0 closed)

Related to Suricata - Feature #4279: Optionally allow hashing truncated files, and a maximum length to hashIn ReviewJeff WeeksActions
Related to Suricata - Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATEDNewFanny DwargeeActions
Actions
Copy link
 #1

Updated by Philippe Antoine about 2 months ago

I think this is working as designed, so this ticket may be more a feature request...

Actions
Copy link
 #2

Updated by Philippe Antoine about 2 months ago

  • Status changed from Assigned to Feedback
Actions
Copy link
 #3

Updated by Philippe Antoine about 1 month ago

  • Related to Feature #4279: Optionally allow hashing truncated files, and a maximum length to hash added
Actions
Copy link
 #4

Updated by Philippe Antoine about 1 month ago

  • Related to Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED added
Actions
Copy link

Also available in: Atom PDF