Suggestion about file skipping due to file size

security-companion commented 2 years ago

Hi, I really like loki but recently I made an own rule and had a hard time figuring out why a certain file that I was scanning didn't trigger an alert that I had defined in my own rule. After some time I noticed that the reason for it was it's file size. Loki skips files that are bigger in size than the default value.

So my suggestion is:

show at the end of a scan log a notice that files were skipped because of file size, otherwise a user can be false-leaded. He thinks his system is clean but actually a "bad" file was skipped and an alert not detected as the file was too big
when using --printall then print in log if a file is skipped because of file size

What do you think? Would you accept these suggestions as a pull request?

Greetings security-companion

Neo23x0 commented 1 year ago

A WARNING level message for every file that gets skipped? That would lead to hundreds of Warning messages per scan.

security-companion commented 1 year ago

Okay, if you want I can also convert it to an INFO. Then it would be the same level as "Skipping file due to fast scan mode"

security-companion commented 1 year ago

I've adapted the pull request

security-companion commented 1 year ago

@Neo23x0 What about adding (only if files were skipped) one warning or notice at the end with something like "There have been files skipped due to file size or unkown file type. Please rerun with --printall to see which"

Neo23x0 / Loki

Suggestion about file skipping due to file size #223