# All event\_type:smb events have double tree\_id in the eve logs. Version 6.0.9

**URL:** <https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146>\
**Category:** Help\
**Tags:** suricata\
**Created:** [January 21, 2023, 4:21pm UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146 "2023-01-21T16:21:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tellus83](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@tellus83](https://forum.suricata.io/u/tellus83)\
**Post date:** [January 21, 2023, 4:21pm UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146/1 "2023-01-21T16:21:48Z")

</div>

On all SMB eve events have double tree\_id in the events. “tree\_id”:0,“tree\_id”:0,  
This is a problem when I use elastic to store all eve events.

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [January 24, 2023, 9:55am UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146/2 "2023-01-24T09:55:30Z")

</div>

can you provide a test case?

---

<div class="post-metadata">

**Author:** ![tellus83](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@tellus83](https://forum.suricata.io/u/tellus83)\
**Post date:** [January 24, 2023, 11:01pm UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146/3 "2023-01-24T23:01:08Z")

</div>

This is a exemple of the eve event:  
{“timestamp”:“2023-01-24T22:58:37.213379+0000”,“flow\_id”:1465644208335260,“in\_iface”:“tap1”,“event\_type”:“smb”,“src\_ip”:“10.32.X.X”,“src\_port”:57717,“dest\_ip”:“10.100.X.X”,“dest\_port”:445,“proto”:“TCP”,“smb”:{“id”:1310,“dialect”:“3.11”,“command”:“SMB2\_COMMAND\_TREE\_CONNECT”,“status”:“STATUS\_ACCESS\_DENIED”,“status\_code”:“0xc0000022”,“session\_id”:760906405380213, **“tree\_id”:0,“tree\_id”:0** ,“share”:“\\PC-475-Y.mydomain.local\ADMIN$”,“share\_type”:“UNKNOWN”},“metadata”:{“flowbits”:[“ET.smb.binary”]},“community\_id”:“1:ekGnmKy57l4o7WAsYOToidEVXXX=”}

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [January 25, 2023, 1:39pm UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146/4 "2023-01-25T13:39:37Z")

</div>

What version are you using?  
Can you post your suricata.yaml and also how you start suricata?

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [January 25, 2023, 2:56pm UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146/5 "2023-01-25T14:56:43Z")

</div>

Besides that I can confirm that this happens even on some of the `suricata-verify` tests. We created a bug tracking ticket for that at our redmine, see [Bug #5811: SMB events sometimes have duplicate `tree_id` output. - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/5811)

---

<div class="post-metadata">

**Author:** ![tellus83](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@tellus83](https://forum.suricata.io/u/tellus83)\
**Post date:** [January 26, 2023, 1:28pm UTC](https://forum.suricata.io/t/all-event-type-smb-events-have-double-tree-id-in-the-eve-logs-version-6-0-9/3146/6 "2023-01-26T13:28:03Z")

</div>

The sample data is from a default confige. Only changed the interface.  
But I see you have the bug created.