Malcolm doesn't preserve some text files

[jrydecki]

Describe the bug
When using Malcolm, I've noticed that often it will not save text files even when
ZEEK_EXTRACTOR_MODE=all and EXTRACTED_FILE_PRESERVATION=all are set. The Zeek files logs
are still created for these text files (and therefore presumably scanned), but the files aren't
preserved. This doesn't seem to be an issue for other file types, just plain text files.

To Reproduce
Steps to reproduce the behavior:

1. Upload attached PCAP to "Artifact Upload"
2. After processing, see that only 3/5 files were preserved even though all were logged by Zeek.

Expected behavior
All files of all files types should be preserved under zeek-logs/extract_files/preserved/ or
accessible through the web portal.

Screenshots and/or Logs

See attached example-1.zip which contains example-1.pcap. Likewise the following screenshots show the files being seen, but not preserved:

example-1.zip

Malcolm Version:

• Version 25.11.0
• Also observed on: 25.08.1, and 25.05.0

How are you running Malcolm?

• ISO installed (on VM or dedicated hardware)
• via Docker on Linux
• via Docker on Microsoft Windows
• via Docker on macOS
• via Kubernetes (please provide platform details: e.g., on-prem K3s, Amazon AWS EKS, Microsoft Azure AKS, etc.)
• other (please describe)

Additional context
I've attached a pcap that reproduces the issue across multiple systems/versions on my end.
There should be 5 preserved files, yet only the JSON (test4.json), Linux executable (test2.exe), and HTML (test3.html) are saved--neither of the text files (test1.txt, test5.json). These files (and their given names, e.g. HTTP-xxx.txt) appear in the Kibana files dashboards, yet the link yields a 404 and when looking at the filesystem (zeek-logs/extract_files/preserved/) they also aren't there.

[mmguero]

What's the size of the files that are missing? These settings in zeek.env specify a minimum and maximum size to be extracted, so if they're smaller than the default (64 bytes) that could explain why.

[jrydecki]

Sure enough the text files happened to be less than 64 bytes, I missed this setting when troubleshooting. Thanks!

[mmguero]

No problem!