# Ssl.log fields showing "\*\*" instead of "-" caused by Log::unset\_field redef in local.zeek **URL:** \ **Category:** Zeek\ **Tags:** logging\ **Created:** [August 12, 2023, 6:01am UTC](https://community.zeek.org/t/ssl-log-fields-showing-instead-of-caused-by-log-unset-field-redef-in-local-zeek/7111 "2023-08-12T06:01:18Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Five](https://avatars.discourse-cdn.com/v4/letter/f/eb8c5e/32.png) [@Five](https://community.zeek.org/u/Five)\ **Post date:** [August 12, 2023, 6:01am UTC](https://community.zeek.org/t/ssl-log-fields-showing-instead-of-caused-by-log-unset-field-redef-in-local-zeek/7111/1 "2023-08-12T06:01:18Z")
Hello everyone, I am using **zeek 6.0.0**. I monitored the interface through a Zeek cluster with 28 lb\_procs by replaying the “all.pcap” file using tcpreplay. Then I find there are “\*\*” in some flows from “ssl.log” as this result: 1691041937.587900 C4YDek4n3ysPyu1Epc 172.28.3.212 51922 221.239.56.138 8443 \*\* \*\* \*\* \*\* F \*\* \*\* F C \*\* \*\* \*\* \*\* The configuration of node.cfg is： [manager] type=manager host=127.0.0.1 [proxy-1] type=proxy host=127.0.0.1 [worker-1] type=worker host=127.0.0.1 interface=eno3 lb\_method=pf\_ring lb\_procs=28 pin\_cpus=0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 Beside, i execute zeek -C -r “all.pcap” to generate “ssl.log” offline, i also find there are “\*\*” in some flows as this result: 1659060023.917768 CkzTYF201DvRkAGAJ 172.28.3.212 51922 221.239.56.138 8443 \*\* TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA \*\* \*\* F \*\* \*\* T CsxnGIi 350df0cc8f2b82a86f32e43a9a31c486acd6d4be (empty) \*\* Then i employed tshark to extract this flow from “all.pcap” as “test.pcap” based on the 5-tuple, and execute zeek -C -r “test.pcap” to generate the “ssl.log”，the result is as fllowed: 1659060023.917768 CsN8ku37wprcCMb7Ab 172.28.3.212 51922 221.239.56.138 8443 TLSv12 TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA - - F - - T CsxnGIi 6f938ed5a27e1c7cb7e30a7c9d919f7eca95f317d38c424b071979d01a4a8c67 (empty) - It seems this result is right, why there are some “\*\*”? How can i solve this problem to get right result? Thanks. ---
**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\ **Post date:** [August 14, 2023, 8:44am UTC](https://community.zeek.org/t/ssl-log-fields-showing-instead-of-caused-by-log-unset-field-redef-in-local-zeek/7111/2 "2023-08-14T08:44:30Z")
Any chance your `local.zeek` for the replay setup contains something like `redef Log::unset_field = "**";` ? ---
**Author:** ![Five](https://avatars.discourse-cdn.com/v4/letter/f/eb8c5e/32.png) [@Five](https://community.zeek.org/u/Five)\ **Post date:** [August 15, 2023, 2:22am UTC](https://community.zeek.org/t/ssl-log-fields-showing-instead-of-caused-by-log-unset-field-redef-in-local-zeek/7111/3 "2023-08-15T02:22:22Z")
Thanks for reply, i do find something like `redef Log::unset_field = "**"`; in my local.zeek. Just comment this code, i get the right result. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [April 20, 2026, 8:54pm UTC](https://community.zeek.org/t/ssl-log-fields-showing-instead-of-caused-by-log-unset-field-redef-in-local-zeek/7111/4 "2026-04-20T20:54:34Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.