From 2217eab38ac987e3cb519475e35d3a299cf35965 Mon Sep 17 00:00:00 2001
From: Johanna Amann <johanna@corelight.com>
Date: Mon, 29 Apr 2024 14:13:19 +0100
Subject: [PATCH] Fix cid propagation into files.log

Changes to the connection id were not propagated to files.log in all
cases.

Fixes GH-3700
---
 scripts/base/frameworks/files/main.zeek | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/base/frameworks/files/main.zeek b/scripts/base/frameworks/files/main.zeek
index baefdfeecb..31da1a7b51 100644
--- a/scripts/base/frameworks/files/main.zeek
+++ b/scripts/base/frameworks/files/main.zeek
@@ -603,7 +603,7 @@ event file_state_remove(f: fa_file) &priority=-10
 		# by reference in Log::write() rather than by copy.
 		local info = |f$conns| > 1 ? copy(f$info) : f$info;
 		info$uid = c$uid;
-		info$id = cid;
+		info$id = c$id;
 		Log::write(Files::LOG, info);
 		}
 	}