# No http.log and dns.log missing

**URL:** <https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601>\
**Category:** Zeek\
**Created:** [May 18, 2015, 1:02pm UTC](https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601 "2015-05-18T13:02:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Monah\_Baki](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Monah\_Baki](https://community.zeek.org/u/Monah_Baki)\
**Post date:** [May 18, 2015, 1:02pm UTC](https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601/1 "2015-05-18T13:02:10Z")

</div>

Bro seems to have all the logs except http and dns. If I run a quick tcpdump on my interface for port 80 and 53, I do see event.

Anything else I can troubleshoot for?

Thanks

Monah

---

<div class="post-metadata">

**Author:** ![Yahoo](https://avatars.discourse-cdn.com/v4/letter/y/898d66/32.png) [@Yahoo](https://community.zeek.org/u/Yahoo)\
**Post date:** [May 18, 2015, 1:21pm UTC](https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601/2 "2015-05-18T13:21:11Z")

</div>

have you checked if your interfaces are running in promiscuous mode?

---

<div class="post-metadata">

**Author:** ![Monah\_Baki](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Monah\_Baki](https://community.zeek.org/u/Monah_Baki)\
**Post date:** [May 18, 2015, 1:31pm UTC](https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601/3 "2015-05-18T13:31:23Z")

</div>

netstat -i

Kernel Interface table  
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg  
eth0 1500 0 463397 0 10 0 521906 0 0 0 BMRU  
eth1 1500 0 299482016 0 28 0 8 0 0 0 BMRU

eth1 is my listening interface

Thanks

---

<div class="post-metadata">

**Author:** ![Monah\_Baki](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Monah\_Baki](https://community.zeek.org/u/Monah_Baki)\
**Post date:** [May 18, 2015, 1:46pm UTC](https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601/4 "2015-05-18T13:46:26Z")

</div>

Yes it is.

eth1 Link encap:Ethernet HWaddr 00:50:56:8b:0f:0a  
inet6 addr: fe80::250:56ff:fe8b:f0a/64 Scope:Link  
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1  
RX packets:300657037 errors:0 dropped:28 overruns:0 frame:0  
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0  
collisions:0 txqueuelen:1000  
RX bytes:193217271566 (193.2 GB) TX bytes:648 (648.0 B)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/no-http-log-and-dns-log-missing/3601/5 "2022-05-06T15:42:40Z")

</div>