[Bro-Dev] #780: file extraction trunctation.

[Bro Tracker]

#780: file extraction trunctation.
----------------------------+---------------------------------------
  Reporter:  justin         |      Owner:
      Type:  Merge Request  |     Status:  new
  Priority:  High           |  Milestone:  Bro2.1
 Component:  Bro            |    Version:  git/master
Resolution:                 |   Keywords:  file extraction truncated
----------------------------+---------------------------------------

Comment (by robin):

 Replying to [comment:3 jsiwek]:

 > - Unserializing files that were previously kicked out of the open-file
 >   cache would cause them to be fopen'd with the original access
 >   permissions which is usually 'w' and causes truncation.  They
 >   are now opened in 'a' mode.  (addresses #780)

 Sounds like this changes the behavior for unserializing files that already
 exist before Bro start up; which matters with remote prints (i.e., they
 now append). I don't think it's very important now that we have the new
 logging and remote prints are hardly used anymore so I'm going to merge
 it. But for the record, we could remember which files we have already
 opened once (by their path), and only open them in append mode.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/780#comment:5>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker