# smtp.log empty for long-running MTA capture

**URL:** <https://community.zeek.org/t/smtp-log-empty-for-long-running-mta-capture/2824>\
**Category:** Zeek\
**Created:** [September 23, 2013, 9:29am UTC](https://community.zeek.org/t/smtp-log-empty-for-long-running-mta-capture/2824 "2013-09-23T09:29:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![user11](https://avatars.discourse-cdn.com/v4/letter/u/dfb087/32.png) [@user11](https://community.zeek.org/u/user11)\
**Post date:** [September 23, 2013, 9:29am UTC](https://community.zeek.org/t/smtp-log-empty-for-long-running-mta-capture/2824/1 "2013-09-23T09:29:35Z")

</div>

Hi list,

Is there a way to tell bro to generate log events (specifically smtp.log) from partial sessions?

I have a system that periodically feeds packet capture files through bro in order to generate its log data. I recently discovered that much of my smtp traffic was not showing up in the smtp.log. The segment in question is doing long-running bulk email transfers, resulting in the capture file seldom having SYN or FIN flagged packets, only PUSH and ACK flags. (This is due to the capture file rotation time being shorter than the MTA sessions).

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/smtp-log-empty-for-long-running-mta-capture/2824/2 "2022-05-06T15:41:14Z")

</div>