From 992ced685f65c861b9352e1af5149d0c989b03b0 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 5 Dec 2022 09:27:31 -0500
Subject: [PATCH] fix filecheck for suricata deployments

---
 salt/strelka/filecheck/filecheck | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/strelka/filecheck/filecheck b/salt/strelka/filecheck/filecheck
index c6148a953..314f73a70 100644
--- a/salt/strelka/filecheck/filecheck
+++ b/salt/strelka/filecheck/filecheck
@@ -83,11 +83,11 @@ if __name__ == "__main__":
     checkexisting()
 
     event_handler =CreatedEventHandler()
-    observer = Observer()
 
     shutdown = False
     while not shutdown:
         logging.info("Scheduling observer")
+        observer = Observer()
         observer.schedule(event_handler, extract_path, recursive=True)
         observer.start()
         try: