Suggestion about file skipping due to file size
security-companion opened this issue · 4 comments
Hi,
I really like loki but recently I made an own rule and had a hard time figuring out why a certain file that I was scanning didn't trigger an alert that I had defined in my own rule. After some time I noticed that the reason for it was it's file size. Loki skips files that are bigger in size than the default value.
So my suggestion is:
- show at the end of a scan log a notice that files were skipped because of file size, otherwise a user can be false-leaded. He thinks his system is clean but actually a "bad" file was skipped and an alert not detected as the file was too big
- when using --printall then print in log if a file is skipped because of file size
What do you think? Would you accept these suggestions as a pull request?
Greetings
security-companion
A WARNING level message for every file that gets skipped?
That would lead to hundreds of Warning messages per scan.
Okay, if you want I can also convert it to an INFO. Then it would be the same level as "Skipping file due to fast scan mode"
I've adapted the pull request
@Neo23x0 What about adding (only if files were skipped) one warning or notice at the end with something like "There have been files skipped due to file size or unkown file type. Please rerun with --printall to see which"