File data loss in stream event

王辰成 <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAFhvOVChNCOJZKYx1A+-zXU018izNbZrVTT9dz-_j0ah3TvVVw@mail.gmail.com>
Hi,
I'm sorry to bother you.
During using Zeek  I met some problem.  Could you help me?
I found a bro package named  credit-card-exposure(link
<https://packages.zeek.org/packages/view/75734569-4fb7-11e8-88be-0a645a3f3086>),
and  imitated the bro script
<https://github.com/sethhall/credit-card-exposure/blob/master/scripts/main.bro>
in this package  for detect some sensitive info.
 Part of the code is as follows
[image: ttt.png]

I printed the fields named seen_bytes and total_bytes of all the files, and
found that  many data of files  have not  entered the handler of stream
event. I  can also find  in files.log, the seen_bytes was far less than
total_bytes.
what  can I do  to solve this problem?

Yours respectfully

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
ttt.png (image/png, 54.1 KB) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.