I'm noticing that a file named show.log is being created on my server, even though I don't intend for it. Does that get created any time I use --show or is there some other combination of flags making that be created?
Unless your command line is customizing the name of the session with --session=show, I don't think hashcat is directly generating this file.
Thanks Royce, that's my confusion too. I use a hashcat server for my job and the server admin just asked why I keep creating show.log files, which I don't even know how to create them. I'll try to figure something out.
Without giving away any sensitive information, can you describe or post what the contents of that file are?
Sure. I simply run hashcat -m1000 <hashfile> --show --username --potfile-path potfile

and that generates a show.log file in my hashcat directory. The contents of the show.log file look like it's debugging or something, as it seems to show a lot of what look like environment variables. I know in the past, I've turned on debugging, to know which cracked a hash, but I would have thought that debugging was only on for that specific session and didn't carry on. Other people use the same hashcat server and it doesn't create a show.log for them. Here are the first few lines of the show.log file:
user_options->separator :
user_options->encoding_from utf-8
user_options->encoding_to utf-8
user_options->potfile_path potfile
user_options->rule_buf_l :
user_options->rule_buf_r :
user_options->session show
user_options->limit 0
user_options->skip 0
user_options->attack_mode 100
Yep, that's a hashcat log file all right. I swear it's acting like you ran something like this:

hashcat --session=show [etc]

That's the only way I know of to get hashcat to save its log file somewhere other than the default (hashcat.log).
Yeah, it's pretty weird that it keeps getting created. I didn't even know about the --session flag. Also one time when trying to show, I got an error that I didn't have permission to my show.log file, which of course is even more weird.