# ERSPAN & Missing Logs **URL:** \ **Category:** Zeek\ **Created:** [June 27, 2017, 8:30pm UTC](https://community.zeek.org/t/erspan-missing-logs/4920 "2017-06-27T20:30:45Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Kyle\_Reidell](https://avatars.discourse-cdn.com/v4/letter/k/4bbf92/32.png) [@Kyle\_Reidell](https://community.zeek.org/u/Kyle_Reidell)\ **Post date:** [June 27, 2017, 8:30pm UTC](https://community.zeek.org/t/erspan-missing-logs/4920/1 "2017-06-27T20:30:45Z")
Hello all, I am attempting to monitor a Cisco CSR1000v within AWS via ERSPAN. Through my research, I am running Bro version 2.5-147 on an AWS Linux AMI and have uploaded a pcap containing ERSPAN data which I have been able to read; however, the only log files that are being created from Bro/live traffic are the following: capture\_loss stats stderr stdout weird communication As a test, I have used tcpdump to capture packets on the configured interface (mon0) which sees plenty of traffic, however, I still cannot see the corresponding logs from Bro. Any help would be greatly appreciated!! Thank you, Planearium ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [June 30, 2017, 2:51pm UTC](https://community.zeek.org/t/erspan-missing-logs/4920/2 "2017-06-30T14:51:46Z")
If you could send me a few packets of traffic captured with tcpdump I could take a look for you (I wrote the RSPAN support). Sometimes it's hard to verify that parsers will always work with all versions of protocols and all usage of a protocol.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/erspan-missing-logs/4920/3 "2022-05-06T15:45:05Z")
Closed on May 6, 2022, 3:45pm UTC