`post-terminate`'s processing of a node's `spool/zeek/` state discards extracted files about zeekctl HOT 2 CLOSED

An easy fix could be for zeekctl to adjust the FileExtract::prefix to something that separates that location from its log processing.

I'm swinging between moving to spool/extract_files and spool/extract_files/<node>/, with slight preferences for the latter.

A bigger change would be to build out proper post-processing for finished files.

Isn't logic often implemented via file_state_remove() in custom scripts? In a default setup it appears even difficult to determine (as an external consumer inspecting the filesystem) if a file has finished extraction or not.

from zeekctl.

spool/extract_files/<node>/

Yeah I was thinking something similar — at least some separation so it doesn't all pile up in one place. This sounds good to me.

Isn't logic often implemented via file_state_remove() in custom scripts?

Yeah.

In a default setup it appears even difficult to determine (as an external consumer inspecting the filesystem) if a file has finished extraction or not.

Yeah exactly — I read over the extractor code and was a bit surprised by that. Seems we could fairly easily do better there.

from zeekctl.