# Log file issues

**URL:** <https://community.zeek.org/t/log-file-issues/3787>\
**Category:** Zeek\
**Created:** [August 24, 2015, 4:44pm UTC](https://community.zeek.org/t/log-file-issues/3787 "2015-08-24T16:44:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aaron\_Haycraft](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Aaron\_Haycraft](https://community.zeek.org/u/Aaron_Haycraft)\
**Post date:** [August 24, 2015, 4:44pm UTC](https://community.zeek.org/t/log-file-issues/3787/1 "2015-08-24T16:44:10Z")

</div>

Good afternoon everyone,

My name is Aaron Haycraft. I am attempting to work with Bro for a project and I am having some  
issues. I am running Bro from the command line on a Fedora machine, and I want to run a lot of PCAP files through it. For example, the lines of code I run are “bro -r test.pcap” and “bro -r test2.pcap”, and so on. However, when I do so, the logs seem to overwrite after awhile and I lose a lot of data. I know that when Bro runs, it stores the logs in the local directory, but after the log gets full, it goes somewhere that I don’t know. Is there anyway to get around this, such that everything goes into one big log file?

Thank you for your time,

Aaron H.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [August 24, 2015, 5:44pm UTC](https://community.zeek.org/t/log-file-issues/3787/2 "2015-08-24T17:44:21Z")

</div>

When you run Bro from the command line, everything in the trace you  
give to an invocation will end up in a single set of logs files inside  
the current directory. But if you then restart Bro with a different  
trace, these logs will be overwritten with new ones (i.e., Bro won't  
append the new data). You'll either need move them away before you  
start the new Bro, or you could concanate all your traces into one  
pcap stream on stdin and have Bro read from "-" (tcpslice and mergecap  
can both do that).

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/log-file-issues/3787/3 "2022-05-06T15:43:00Z")

</div>


