From c58b2b4b18375781d56384c5c2e123c6a2fa3e31 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Fri, 23 Jan 2015 10:22:01 +0100
Subject: [PATCH] file: improve file pruning

Check if file has been logged/stored before considering it 'done'.
---
 src/util-file.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/util-file.c b/src/util-file.c
index 908dc19b1b..ec5e4df4f1 100644
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -28,6 +28,7 @@
 #include "debug.h"
 #include "flow.h"
 #include "stream.h"
+#include "runmodes.h"
 #include "util-hash.h"
 #include "util-debug.h"
 #include "util-memcmp.h"
@@ -173,10 +174,15 @@ static int FilePruneFile(File *file)
         }
     }
 
-    if (file->state >= FILE_STATE_CLOSED)
+    /* file is done when state is closed+, logging/storing is done (if any) */
+    if (file->state >= FILE_STATE_CLOSED &&
+        (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) &&
+        (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED)))
+    {
         SCReturnInt(1);
-    else
+    } else {
         SCReturnInt(0);
+    }
 }
 
 void FilePrune(FileContainer *ffc)