# 2.1 file analysis logging in 2.2 **URL:** \ **Category:** Zeek\ **Created:** [February 21, 2014, 2:43pm UTC](https://community.zeek.org/t/2-1-file-analysis-logging-in-2-2/3010 "2014-02-21T14:43:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Mike\_Hamilton](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Mike\_Hamilton](https://community.zeek.org/u/Mike_Hamilton)\ **Post date:** [February 21, 2014, 2:43pm UTC](https://community.zeek.org/t/2-1-file-analysis-logging-in-2-2/3010/1 "2014-02-21T14:43:31Z")
I’m fairly new to Bro, but had a question I was hoping to get answered. I’ve combed documentation and source code, but can’t quite get to what I’m looking for. I believe in 2.2, the file analysis engine was modified such that the HTTP, SMTP,etc. file analysis logs were merged into a single files.log file. Some of the guys around the office thought they remembered a presentation back in August on being able to configure Bro to still report files in the 2.1 mode. Am I way off base, or is there a way to do this in 2.2 to report like 2.1? Thanks, Mike ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 21, 2014, 4:10pm UTC](https://community.zeek.org/t/2-1-file-analysis-logging-in-2-2/3010/2 "2014-02-21T16:10:49Z")
> I believe in 2.2, the file analysis engine was modified such that the HTTP, SMTP,etc. file analysis logs were merged into a single files.log file. Yep, sort of. There is still some information about the files pulled back into the protocol logs too. (and you could write scripts that pull more back). > Some of the guys around the office thought they remembered a presentation back in August on being able to configure Bro to still report files in the 2.1 mode. I think you're going to need to describe what is missing that you want back.   .Seth ---
**Author:** ![Mike\_Hamilton](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Mike\_Hamilton](https://community.zeek.org/u/Mike_Hamilton)\ **Post date:** [February 21, 2014, 5:06pm UTC](https://community.zeek.org/t/2-1-file-analysis-logging-in-2-2/3010/3 "2014-02-21T17:06:34Z")
> > I believe in 2.2, the file analysis engine was modified such that the > > HTTP, SMTP,etc. file analysis logs were merged into a single files.log > > file. > > Yep, sort of. There is still some information about the files pulled > back into the protocol logs too. (and you could write scripts that pull > more back). > > > Some of the guys around the office thought they remembered a > > presentation back in August on being able to configure Bro to still > > report files in the 2.1 mode. > > I think you're going to need to describe what is missing that you want > back. So in 2.1, the http.log format had field/column values for 'mime\_type' and 'md5', both simple strings. That appears to have been expanded significantly in 2.2 such that there are now 4 columns: 'orig\_fuids','orig\_mime\_types', 'resp\_fuids', 'resp\_mime\_types', which are vectors of strings that reference the fuid's in files.log(if my understanding is correct). Is there a simple way to add back those two old columns to the http.log file? Understanding that the new mime\_types fields are vectors instead of straight strings, do either of the new mime\_type fields correspond to the old mime\_type column? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 21, 2014, 8:30pm UTC](https://community.zeek.org/t/2-1-file-analysis-logging-in-2-2/3010/4 "2014-02-21T20:30:59Z")
You can certainly do that, but I do want to point out that the old log was incorrect. HTTP uses MIME to transfer data so you can send multiple files and receive multiple files in a single request or response. mime\_type is basically the same as the resp\_mime\_types field except that it can represent more than one file. Hashes are not included in the HTTP log at all anymore but you can add it back by basically copying how the resp\_mime\_types field is populated. Finally I should probably point out that the resp\_fuids and orig\_fuids fields correspond to the second field (fuid) in the files.log.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/2-1-file-analysis-logging-in-2-2/3010/5 "2022-05-06T15:41:36Z")