# Smtp.log missing x-originating-ip

**URL:** <https://community.zeek.org/t/smtp-log-missing-x-originating-ip/3979>\
**Category:** Zeek\
**Created:** [January 19, 2016, 6:12pm UTC](https://community.zeek.org/t/smtp-log-missing-x-originating-ip/3979 "2016-01-19T18:12:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [January 19, 2016, 6:12pm UTC](https://community.zeek.org/t/smtp-log-missing-x-originating-ip/3979/1 "2016-01-19T18:12:55Z")

</div>

Topic says it...after a digging into this it appears my smtp.log is missing all x-originating-ip:

[18:11:06 ids:~/current$] head -n 40 smtp.log | bro-cut -d ts x\_originating\_ip  
2016-01-18T23:58:31+0000 -  
2016-01-18T23:58:34+0000 -  
2016-01-18T23:58:32+0000 -  
2016-01-18T23:58:35+0000 -  
2016-01-18T23:58:39+0000 -  
2016-01-18T23:58:46+0000 -  
2016-01-18T23:58:52+0000 -  
2016-01-18T23:59:02+0000 -  
2016-01-18T23:59:04+0000 -

I can see the field in full packet captures. Any hints on what I'm missing? Thank you.

James

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [January 19, 2016, 8:53pm UTC](https://community.zeek.org/t/smtp-log-missing-x-originating-ip/3979/2 "2016-01-19T20:53:36Z")

</div>

Could you privately send along a couple of headers that it's messing up?

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/smtp-log-missing-x-originating-ip/3979/3 "2022-05-06T15:43:21Z")

</div>