# \- HTTP extract files from wget

**URL:** <https://community.zeek.org/t/http-extract-files-from-wget/6046>\
**Category:** Zeek\
**Created:** [March 11, 2020, 10:44am UTC](https://community.zeek.org/t/http-extract-files-from-wget/6046 "2020-03-11T10:44:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [March 11, 2020, 10:44am UTC](https://community.zeek.org/t/http-extract-files-from-wget/6046/1 "2020-03-11T10:44:21Z")

</div>

Hi everyone,

I’ve stumbled upon a weird issue using Zeek 3.0.  
Parsing traffic that has a file transfer over http using wget does not produce any file analysis.

I do see the get\_file\_handle event were it says ANALYZER::ANALYZER\_HTTP but no files.log is created and extract-all-files.zeek script does not produce the transferred file.

am I missing something here ?

Thanks  
B

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [March 11, 2020, 1:40pm UTC](https://community.zeek.org/t/http-extract-files-from-wget/6046/2 "2020-03-11T13:40:44Z")

</div>

What does the conn log entry look like?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/http-extract-files-from-wget/6046/3 "2022-05-06T15:47:08Z")

</div>

Closed on May 6, 2022, 3:47pm UTC