# Logging at end of connections

**URL:** <https://community.zeek.org/t/logging-at-end-of-connections/4113>\
**Category:** Zeek\
**Created:** [April 18, 2016, 1:48pm UTC](https://community.zeek.org/t/logging-at-end-of-connections/4113 "2016-04-18T13:48:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lamps\_Jereme](https://avatars.discourse-cdn.com/v4/letter/l/82dd89/32.png) [@Lamps\_Jereme](https://community.zeek.org/u/Lamps_Jereme)\
**Post date:** [April 18, 2016, 1:48pm UTC](https://community.zeek.org/t/logging-at-end-of-connections/4113/1 "2016-04-18T13:48:04Z")

</div>

I would like to take some action on a connection before it is written to conn.log. I added some code to the event Conn::log\_conn and it works as intended when running through pcaps. However, when I try to run the script live on a network interface, it appears that log\_conn is not getting called until I hit ctrl-c… Is there another event I need to use??

Thanks in advance,

Jereme

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/logging-at-end-of-connections/4113/2 "2022-05-06T15:43:36Z")

</div>