From 2317e8b3481ec6db8382b9baabe4878d9bd89e70 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 7 Oct 2020 11:08:41 -0400
Subject: [PATCH] only send loss if timestamp on data has changed

---
 salt/telegraf/scripts/zeekcaptureloss.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/telegraf/scripts/zeekcaptureloss.sh b/salt/telegraf/scripts/zeekcaptureloss.sh
index f6302566d..818e139e9 100644
--- a/salt/telegraf/scripts/zeekcaptureloss.sh
+++ b/salt/telegraf/scripts/zeekcaptureloss.sh
@@ -12,5 +12,5 @@ if [ -f "$ZEEKLOG" ]; then
       echo "zeekcaptureloss loss=$LOSS"
     fi
   fi
-  echo "$CURRENTS" > "$LASTCAPTURELOSSLOG"
+  echo "$CURRENTS" > $LASTCAPTURELOSSLOG
 fi
\ No newline at end of file