# bro files - network drive

**URL:** <https://community.zeek.org/t/bro-files-network-drive/4844>\
**Category:** Zeek\
**Created:** [May 16, 2017, 4:43pm UTC](https://community.zeek.org/t/bro-files-network-drive/4844 "2017-05-16T16:43:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [May 16, 2017, 4:43pm UTC](https://community.zeek.org/t/bro-files-network-drive/4844/1 "2017-05-16T16:43:31Z")

</div>

Izik Birka \<Izik.Birka@hot.net.il\> writes:

> Why when I only search file in network drive all the files in the  
> network drive are written to files.log ?

I'm assuming you mean over SMB? More data than just file transfers is  
logged because it can be useful for incident response.

> How can I detect a real file transfer ?

Take a look at the total\_bytes and seen\_bytes fields.

&nbsp;&nbsp;--Vlad

---

<div class="post-metadata">

**Author:** ![Izik\_Birka](https://avatars.discourse-cdn.com/v4/letter/i/b3f665/32.png) [@Izik\_Birka](https://community.zeek.org/u/Izik_Birka)\
**Post date:** [May 17, 2017, 9:03am UTC](https://community.zeek.org/t/bro-files-network-drive/4844/2 "2017-05-17T09:03:05Z")

</div>

hi  
YES , over smb  
my problem is when I searching files on file server all the files are written to files.log (include total\_bytes and seen\_bytes data)  
and because of that I can't distinguish between search on file server and copy files from the file server

any suggestion ?

thanks

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/bro-files-network-drive/4844/3 "2022-05-06T15:44:57Z")

</div>