file: improve file pruning

Check if file has been logged/stored before considering it 'done'.

diff --git a/src/util-file.c b/src/util-file.c
index 908dc19b1b62fa8eb885d0fe292b231b8dec9cd0..ec5e4df4f1bc30811c83c6c13ad8f9b8a22ccd39 100644 (file)
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -28,6 +28,7 @@
 #include "debug.h"
 #include "flow.h"
 #include "stream.h"
+#include "runmodes.h"
 #include "util-hash.h"
 #include "util-debug.h"
 #include "util-memcmp.h"
@@ -173,10 +174,15 @@ static int FilePruneFile(File *file)
         }
     }
 
-    if (file->state >= FILE_STATE_CLOSED)
+    /* file is done when state is closed+, logging/storing is done (if any) */
+    if (file->state >= FILE_STATE_CLOSED &&
+        (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) &&
+        (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED)))
+    {
         SCReturnInt(1);
-    else
+    } else {
         SCReturnInt(0);
+    }
 }
 
 void FilePrune(FileContainer *ffc)