# http.log event

**URL:** <https://community.zeek.org/t/http-log-event/2232>\
**Category:** Zeek\
**Created:** [February 18, 2012, 5:38pm UTC](https://community.zeek.org/t/http-log-event/2232 "2012-02-18T17:38:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ioannis\_WiCom](https://avatars.discourse-cdn.com/v4/letter/i/e9a140/32.png) [@Ioannis\_WiCom](https://community.zeek.org/u/Ioannis_WiCom)\
**Post date:** [February 18, 2012, 5:38pm UTC](https://community.zeek.org/t/http-log-event/2232/1 "2012-02-18T17:38:21Z")

</div>

I have enabled the conn.log and http.log in Bro.  
I am seeing TCP events in dst\_port==80 that do not generate events for http.log.

_No Event in HTTP: http 2120 80 tcp 368 1414142 SF X_  
_Event %1 in HTTP: http 59637 80 tcp 1495 1244 SF X %1_

The SF flag indicates Normal Establishment and Termination. Why would Bro record one event in http.log, and not the other one?  
Note that both of them are actual HTTP traffic.

Another example:  
_No event in HTTP: http 49971 80 tcp 0 924818 SH X_

I am guessing in the last one, since there are 0 bytes from the originator, it would not generate an event for http.log.

My question is more general: In which occasions of dst\_port==80, an http.log event is being recorded?

thank you,  
Yannis

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [February 18, 2012, 9:52pm UTC](https://community.zeek.org/t/http-log-event/2232/2 "2012-02-18T21:52:56Z")

</div>

You appear to be running an older version of Bro. I recommend trying out our new 2.0 version that we released last month. We made so many changes and fixes that it's very likely the problem you are seeing has been fixed.

You can get it from here (we even have binaries for several platforms):  
&nbsp;&nbsp;[http://www.bro-ids.org/download/](http://www.bro-ids.org/download/)

.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/http-log-event/2232/3 "2022-05-06T15:40:12Z")

</div>


