http.log event

Zeek
1

I have enabled the conn.log and http.log in Bro.
I am seeing TCP events in dst_port==80 that do not generate events for http.log.

No Event in HTTP: http 2120 80 tcp 368 1414142 SF X
Event %1 in HTTP: http 59637 80 tcp 1495 1244 SF X %1

The SF flag indicates Normal Establishment and Termination. Why would Bro record one event in http.log, and not the other one?
Note that both of them are actual HTTP traffic.

Another example:
No event in HTTP: http 49971 80 tcp 0 924818 SH X

I am guessing in the last one, since there are 0 bytes from the originator, it would not generate an event for http.log.

My question is more general: In which occasions of dst_port==80, an http.log event is being recorded?

thank you,
Yannis

2

You appear to be running an older version of Bro. I recommend trying out our new 2.0 version that we released last month. We made so many changes and fixes that it's very likely the problem you are seeing has been fixed.

You can get it from here (we even have binaries for several platforms):
  http://www.bro-ids.org/download/

.Seth