# http.log missing info **URL:** \ **Category:** Zeek\ **Created:** [February 13, 2012, 9:02pm UTC](https://community.zeek.org/t/http-log-missing-info/2220 "2012-02-13T21:02:00Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Tyler](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@Tyler](https://community.zeek.org/u/Tyler)\ **Post date:** [February 13, 2012, 9:02pm UTC](https://community.zeek.org/t/http-log-missing-info/2220/1 "2012-02-13T21:02:00Z")
Hello all,   Forgive my question if its basic, but I was not able to find the answer I was looking for in the docs, FAQ or mailing list archive.   I just set up bro and am having it just run locally so I can work with it. I noticed that my http.log file is not recording all the information for HTTP sessions. It records the connection info (src, dst, ports) the status\_code and msg and thats it. Anything beyond that, like the uri, host, UA are missing.   I also noticed that the request body lengths are set to 0. My conn.log shows the same (request lengths are set to 0). To me this means that its not seeing the requests go out. I have verified this is happening with both live analysis and through a recorded pcap which does contain the requests. Oddly, if I dl the http.pcap from the second exercise from the 2011 Bro workshop, it does work correctly. Is there a config option that I did not set correctly? I have verified that my networks.cfg is set up correctly and have not modified any other settings. Tyler ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 13, 2012, 9:58pm UTC](https://community.zeek.org/t/http-log-missing-info/2220/2 "2012-02-13T21:58:06Z")
> Anything beyond > that, like the uri, host, UA are missing. You're missing everything from the client. 😉 > Is there a config option that I did not set correctly? I have > verified that my networks.cfg is set up correctly and have not > modified any other settings. I suspect you have checksum offloading onto your NIC. The behavior when someone runs this on their desktop is that you will see everything from the server since the checksums are set correct, but data from the client (you) will offload checksum creation to the NIC so when libpcap receives the packet it has random data in the checksum field. Try running Bro with the -C flag to disable checksum validation (but only for testing, you obviously don't want that on live traffic).   .Seth ---
**Author:** ![Tyler](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@Tyler](https://community.zeek.org/u/Tyler)\ **Post date:** [February 13, 2012, 11:27pm UTC](https://community.zeek.org/t/http-log-missing-info/2220/3 "2012-02-13T23:27:20Z")
That was it! Man, I even read that in the FAQ and didn't think about it. Thanks! Tyler ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/http-log-missing-info/2220/4 "2022-05-06T15:40:11Z")