Apparently, the output is heavily buffered.
It's the usual stdio buffering. Bro catches SIGINT, so when you kill it, it
should flush those files. Is that not working, or were you looking at the
files while Bro was running?
Bro needs a mechanism for telling it "flush your current state". A hack
for this would be some sort of signal; but I think the right way to do
it is to add a general mechanism for communicating with Bro (one that lets
you inject [authenticated, of course] events). This is needed anyway
because Bro needs to evolve towards multiple event agents (some watching
network links, some perhaps running on hosts and just watching the hosts)
and that will require an event communication mechanism.
Vern