# no sha1\\md5 for some logs in files.log **URL:** \ **Category:** Zeek\ **Created:** [June 8, 2017, 8:51am UTC](https://community.zeek.org/t/no-sha1-md5-for-some-logs-in-files-log/4887 "2017-06-08T08:51:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Izik\_Birka](https://avatars.discourse-cdn.com/v4/letter/i/b3f665/32.png) [@Izik\_Birka](https://community.zeek.org/u/Izik_Birka)\ **Post date:** [June 8, 2017, 8:51am UTC](https://community.zeek.org/t/no-sha1-md5-for-some-logs-in-files-log/4887/1 "2017-06-08T08:51:24Z")
Hi Why there some logs in files.log that not contains the sha1 or md5 value ? For example : Jun 8 11:32:39 127.0.0.1 bro\_files: 1496910758.272740|FIMpTB242jcRsKCCYj|x.x.x.x|x.x.x.x|CAuOUv3lwBwigjH7mk|SMB|0|MD5,SHA1|-|test\test111\bro\go.pdf|0.021820|F|F|581600|1040352|458752|65536|F|-|-|-|-|- ![image001.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/35ea7c69d9212c10fecabd30f574630a2dc5a4be.jpeg) ![image002.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f4c44896d0a80f2b824e3ccef0ab1e9ef8c561c7.jpeg) ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [June 8, 2017, 1:31pm UTC](https://community.zeek.org/t/no-sha1-md5-for-some-logs-in-files-log/4887/2 "2017-06-08T13:31:38Z")
Hi Izik, Your file had a content gap (458752 bytes missing). Since the file was transferred over SMB, it’s very possible that only part of the file was actually transferred due to offset reads or writes. It’s one of the downsides of monitoring file system protocols since it’s very common for software to only read or write a portion of a file after seeking. The reason that no hashes are provided in that case is that the hash wouldn’t mean anything since it would just be a hash of some fairly arbitrary portion of the file. .Seth ![image001.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/35ea7c69d9212c10fecabd30f574630a2dc5a4be.jpeg) ![image002.jpg](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f4c44896d0a80f2b824e3ccef0ab1e9ef8c561c7.jpeg) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/no-sha1-md5-for-some-logs-in-files-log/4887/3 "2022-05-06T15:45:01Z")