# problems using Bro (http)

**URL:** <https://community.zeek.org/t/problems-using-bro-http/519>\
**Category:** Zeek\
**Created:** [June 15, 2004, 2:55pm UTC](https://community.zeek.org/t/problems-using-bro-http/519 "2004-06-15T14:55:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![\_rmkml](https://avatars.discourse-cdn.com/v4/letter/_/87869e/32.png) [@\_rmkml](https://community.zeek.org/u/_rmkml)\
**Post date:** [June 15, 2004, 2:55pm UTC](https://community.zeek.org/t/problems-using-bro-http/519/1 "2004-06-15T14:55:53Z")

</div>

Hi,

I have a little question,

I start bro :

$ export BROPATH=/usr/src/bro/bro-pub-0.9a2/policy;  
$ /usr/src/bro/bro-pub-0.9a2/bro -i eth0 bro.init mt http

ok bro not write on stdout !

when bro run,  
files log.log/http.log/ftp.log/alert.log/weird.log  
is zero

but if I stop bro,  
only weird.log fill :  
1087310691.743467 2.10.12.2/33282 \> 128.193.0.3/http: spontaneous\_FIN

and bro write on stdout :  
1087310691.743467 0.172724 2.10.12.2 128.193.0.3 http 33282 80 tcp 0 ? RSTR X

possible help me please  
why bro not fill http.log ?  
and why bro write weird.log only after stop bro ?

I use bro 0.9a2 on linux 2.4.26.  
same on fbsd49.  
(no compile option: ./configure && make [openssl disable auto by configure])

Regards

[Rmkml@Wanadoo.fr](mailto:Rmkml@Wanadoo.fr)

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [June 15, 2004, 3:24pm UTC](https://community.zeek.org/t/problems-using-bro-http/519/2 "2004-06-15T15:24:04Z")

</div>

> $ /usr/src/bro/bro-pub-0.9a2/bro -i eth0 bro.init mt http

You should use "http-request" (and perhaps "http-reply") instead of  
http.

> and why bro write weird.log only after stop bro ?

Most of the log files are buffered, i.e. output is written in larger  
chunks (and at termination).

Robin

---

<div class="post-metadata">

**Author:** ![\_rmkml](https://avatars.discourse-cdn.com/v4/letter/_/87869e/32.png) [@\_rmkml](https://community.zeek.org/u/_rmkml)\
**Post date:** [June 15, 2004, 3:33pm UTC](https://community.zeek.org/t/problems-using-bro-http/519/3 "2004-06-15T15:33:31Z")

</div>

thanks for your help Robin

Regards  
[Rmkml@Wanadoo.fr](mailto:Rmkml@Wanadoo.fr)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/problems-using-bro-http/519/4 "2022-05-06T15:37:02Z")

</div>