Have the semantics of the "L" flag in the conn log been changed?
From http://www.bro-ids.org/wiki/index.php/Reference_Manual:_Analyzers_and_Events#Connection_summaries:
Line format:
Yes, the log format has changed as you indicated quite some time ago
already. I'll fix the documentation. Thanks for pointing this out.
Robin