In some scenarios, zeek cannot capture the SSH login status

My test environment is an embedded Linux system, zeek is installed on it. Normally, when I login this Linux system through SSH login from MacBook, zeek will record it (set “auth_success” as true, and “auth_attempts” as 1/2/3…).
But, when I switch to another ubuntu PC , zeek cannot detect the login behavior( no setting of “auth_succcess” and “auth_attempts”). But I really login successfully.
Does anybody meet this phenomenon before? Is it related with some network settings (network cable is same) ? Thanks in advance.

below two log texts show the difference:

capture login success: {“ts":1587136399.660159,“uid”:“CqXaOV38H6o0d1PAdj”,“id.orig_h”:“”,“id.orig_p”:56832,“id.resp_h”:“”,“id.resp_p”:22,“version”:2,“auth_success”:true,“auth_attempts”:3,“client”:“SSH-2.0-OpenSSH_8.1”,“server”:“SSH-2.0-OpenSSH_8.2”,“cipher_alg”:",“mac_alg”:"",“compression_alg”:“none”,“kex_alg”:“curve25519-sha256”,“host_key_alg”:“ecdsa-sha2-nistp256”,“host_key”:“d1:0f:fe:e0:9d:29:6f:09:3e:0d:01:e4:08:5a:c9:cf”}

miss the SSH login:

I use ‘tcpdump’ captured the PCAP files for both MacBook and Ubuntu PC, but don’t know how to upload it. (It seems only support picture format )

If you’re having trouble trying to share a pcap here, feel free to visit us on Slack. Here is the invite: