<div dir="ltr">Those aren't TEMP files as far as zeek is concerned. Those are being extracted by the BZAR script: <a href="https://github.com/mitre-attack/bzar/blob/master/scripts/bzar_files.bro">https://github.com/mitre-attack/bzar/blob/master/scripts/bzar_files.bro</a><div><br></div><div>they just happen to be from c:\windows\TEMP\ on the server.</div><div><br></div><div>You should be analyzing those files, or if you don't want them at all the bzar script has <span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">BZAR::file_extract_option</span> or some other ways of filtering things to turn that feature off.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Dec 30, 2019 at 4:35 PM Scot Harris <<a href="mailto:SHARRIS@hollywoodfl.org">SHARRIS@hollywoodfl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-7380747925791475038WordSection1">
<p class="MsoNormal">While running some system checks, I noted that on the two zeek 3.0 boxes I have in a cluster that drive space was being taken up in the following directory:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">/opt/zeek/spool/worker-3-1/extract_files.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">These files not large but numerous.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">total 15884720<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 50 Dec 30 16:26 CZi12w40mQqZt08H24_FWsM9w4uCR965XUybc__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-93.txt<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 326 Dec 30 16:26 CZi12w40mQqZt08H24_FEJBtK3MwBWHCM3ET__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110812.bat<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 44 Dec 30 16:26 CZi12w40mQqZt08H24_FzgNR24m7uP0dbeI54__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-92.txt<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 315 Dec 30 16:26 CZi12w40mQqZt08H24_FlcyIJ91gLM90QJhe__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110811.bat<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 23 Dec 30 16:26 CZi12w40mQqZt08H24_FXnI1p4BopgQQE4jye__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-91.txt<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 285 Dec 30 16:26 CZi12w40mQqZt08H24_FXROsS11QBGTbOJGNd__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110810.bat<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 19 Dec 30 16:25 CZi12w40mQqZt08H24_FZ3vCj4O7BqZZYdgT__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-90.txt<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 330 Dec 30 16:25 CZi12w40mQqZt08H24_FozvDx13eGGG5Sssyc__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110793.bat<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 77 Dec 30 16:25 CZi12w40mQqZt08H24_FIwGEp2TW6WJ8IbEcd__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-89.txt<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 313 Dec 30 16:25 CZi12w40mQqZt08H24_FWm9sG44On6hV5AoWj__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110781.bat<u></u><u></u></p>
<p class="MsoNormal">-rw-rw-r-- 1 zeek zeek 10 Dec 30 16:25 CZi12w40mQqZt08H24_Fo3rTB2pdq5ooABUCa__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-88.txt<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Can these files be purged periodically?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Seeing this on both the master box and the cluster node.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thank you.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Justin</div></div>