Project

General

Profile

Actions
Copy link

Feature #6161

open
AH AH

file-store: missing hash on TRUNCATED files

Feature #6161: file-store: missing hash on TRUNCATED files

Added by Andreas Herz almost 3 years ago. Updated 1 day ago.

Status:
Feedback
Priority:
Normal
Assignee:
Andreas Herz
Target version:
TBD
Effort:
Difficulty:
Label:

Description

While `sha256` is always seen, when we also enable `md5` and/or `sha1` via `force-hash` they are not shown in the log for files being flagged TRUNCATED.

Related issues 2 (2 open — 0 closed)

Related to Suricata - Feature #4279: Optionally allow hashing truncated files, and a maximum length to hashAssignedJeff WeeksActions
Related to Suricata - Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATEDNewFanny DwargeeActions
Actions
Copy link

Also available in: PDF Atom