# Bro install on new machine - SSH logging broken

**URL:** <https://community.zeek.org/t/bro-install-on-new-machine-ssh-logging-broken/2882>\
**Category:** Zeek\
**Created:** [October 31, 2013, 5:58pm UTC](https://community.zeek.org/t/bro-install-on-new-machine-ssh-logging-broken/2882 "2013-10-31T17:58:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicholas\_Siow1](https://avatars.discourse-cdn.com/v4/letter/n/e0b2c6/32.png) [@Nicholas\_Siow1](https://community.zeek.org/u/Nicholas_Siow1)\
**Post date:** [October 31, 2013, 5:58pm UTC](https://community.zeek.org/t/bro-install-on-new-machine-ssh-logging-broken/2882/1 "2013-10-31T17:58:49Z")

</div>

Hello all,

We recently did a fresh install of Bro 2.1 on a new machine as per the quick start guide. This machine has been watching traffic for about a week now and all of the logs seem to be fine except for the SSH logs, which have the following problems.

1. These logs are not adding geo-location information. The MaxMind databases were installed and put in the proper location, and a quick bro script that called the lookup\_location() function seems to be working fine in retrieving this information. However, none of this information is logged, even for heuristically successful connections.

2. About half of the entries in the SSH log have a status of “undetermined”. This is not something we saw before on our older machine, where every entry was listed as either a ‘success’ or ‘failure’ in the status column.

3. The “resp\_size” field of **every** entry is 0. Once again, this is not something that we have seen before.

I should also mention that we have an older machine watching the exactly same network as this one (though with a smaller network card) and that one seems to be picking up on SSH traffic fine. Any idea what’s going on here?

Thank you,  
N. Siow

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [October 31, 2013, 6:25pm UTC](https://community.zeek.org/t/bro-install-on-new-machine-ssh-logging-broken/2882/2 "2013-10-31T18:25:37Z")

</div>

Run without checksums and see if you notice a difference:

broctl.cfg  
\<snip\>  
broargs = --no-checksums

James

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [November 1, 2013, 1:15am UTC](https://community.zeek.org/t/bro-install-on-new-machine-ssh-logging-broken/2882/3 "2013-11-01T01:15:32Z")

</div>

For what it’s worth, I only see 0 response on mine…but I don’t see the other two symptoms.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-install-on-new-machine-ssh-logging-broken/2882/4 "2022-05-06T15:41:21Z")

</div>

Closed on May 6, 2022, 3:41pm UTC