From a1d621748e5a60222e363140ab0221d820818b58 Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Mon, 29 Apr 2024 09:09:28 -0700
Subject: [PATCH] Merge remote-tracking branch 'origin/topic/johanna/gh-3700'

* origin/topic/johanna/gh-3700:
  Fix cid propagation into files.log

(cherry picked from commit d7e30d9ee222332f7105203601a31500b96acaa5)
---
 scripts/base/frameworks/files/main.zeek | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/base/frameworks/files/main.zeek b/scripts/base/frameworks/files/main.zeek
index baefdfeecb..31da1a7b51 100644
--- a/scripts/base/frameworks/files/main.zeek
+++ b/scripts/base/frameworks/files/main.zeek
@@ -603,7 +603,7 @@ event file_state_remove(f: fa_file) &priority=-10
 		# by reference in Log::write() rather than by copy.
 		local info = |f$conns| > 1 ? copy(f$info) : f$info;
 		info$uid = c$uid;
-		info$id = cid;
+		info$id = c$id;
 		Log::write(Files::LOG, info);
 		}
 	}