I check the version with zeekctl and zeek but they are different, I don’t know if this could be the root of the problem, as I have found in this thread a similar problem with a version similar to my zeekctl: ssh-detect-bruteforcing: auth_success and auth_attempts are not recorded in ssh.log
I thought that when I ran zeek -v it was the service, and that /opt/zeek/bin/zeekctl was also the same.
But I see that it is not.