# Changing files.log: Unrolling and removal of rx\_hosts, tx\_hosts and conn\_uids

**URL:** <https://community.zeek.org/t/changing-files-log-unrolling-and-removal-of-rx-hosts-tx-hosts-and-conn-uids/6644>\
**Category:** Zeek\
**Tags:** development\
**Created:** [August 5, 2022, 12:08pm UTC](https://community.zeek.org/t/changing-files-log-unrolling-and-removal-of-rx-hosts-tx-hosts-and-conn-uids/6644 "2022-08-05T12:08:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [August 5, 2022, 12:08pm UTC](https://community.zeek.org/t/changing-files-log-unrolling-and-removal-of-rx-hosts-tx-hosts-and-conn-uids/6644/1 "2022-08-05T12:08:43Z")

</div>

Hello,

the files.log is currently unusual to work with in that it does not have the typical uid and c$id fields that most other logs have, while still being very connection oriented (conn\_uids in most cases contains just a single uid).

We’re proposing the following change that may be included in Zeek 5.1 or 5.2:

> Removal of tx\_hosts, rx\_hosts and conn\_uids from files.log and unrolling files.log such that each entry has a single, optional, connection uid and connection identifier.

More details about the motivation and approach can be found in the Google Doc. Feedback and comments are welcome. We understand this is a rather invasive change and very happy to hear what others think.

> **[files.log: Unrolling and removal of rx\_hosts, tx\_hosts and conn\_uids](https://docs.google.com/document/d/1M2QNbofW__MeDNHbFTqpy8CdpWXZrjB4D4OiUB-fJ3U/edit?usp=sharing)**
>
> Proposal Removal of tx\_hosts, rx\_hosts and conn\_uids from files.log and unrolling files.log such that each entry has a single, optional, connection uid and connection identifier. Background Zeek currently has the capability to associate multiple...

Thanks,  
Arne