# Unable to generate intel.log

**URL:** <https://community.zeek.org/t/unable-to-generate-intel-log/7955>\
**Category:** Zeek\
**Created:** [March 12, 2026, 1:33pm UTC](https://community.zeek.org/t/unable-to-generate-intel-log/7955 "2026-03-12T13:33:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pixelbrain](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@Pixelbrain](https://community.zeek.org/u/Pixelbrain)\
**Post date:** [March 12, 2026, 1:33pm UTC](https://community.zeek.org/t/unable-to-generate-intel-log/7955/1 "2026-03-12T13:33:30Z")

</div>

I’m trying to detect connections to specific IP addresses using the Intelligence framework. I read the documentation, however I have trouble getting even a basic test scenario working.

No matter what I do, it seems like no intel.log is being generated.

I followed these steps:

1. Create a intel file to match against. I’m calling it `test.txt` and include a sample domain and IP address:

```auto
#fields	indicator	indicator_type	meta.source	meta.desc
heise.de	Intel::DOMAIN	test_source	Heise Domain
193.99.144.80	Intel::ADDR	test_source	Heise IP

```

2. Add the following to the end of `/opt/zeek/share/zeek/site/local.zeek`:

```auto
@load frameworks/intel/seen
redef Intel::read_files += { "/opt/zeek/intel/test.txt" };

```

3. Create a sample PCAP using `tcpdump`. While the capture is running, I navigate to the test URL on a webbrowser:

```Bash
sudo tcpdump -w capture.pcap

```

4. Run Zeek on the PCAP file:

```Bash
sudo /opt/zeek/bin/zeek /opt/zeek/share/zeek/site/local.zeek -r capture.pcap -C LogAscii::use_json=T

```

I would expect to see a `intel.log` file being generated with this, however I don’t get any as a result. I only get the following files:

```Bash
capture_loss.log
capture.pcap
conn.log
dns.log
known_hosts.log
known_services.log
loaded_scripts.log
packet_filter.log
quic.log
ssl.log
stats.log
telemetry.log
x509.log

```

I checked the `loaded_scripts.log` and was able to verify that the intel framework was loaded. I can also see the domain and IP address show up in various Zeek logs such as `conn.log`, `dns.log` or `ssl.log`.  
I’m using Zeek 8.0.6, the current LTS version.

Can you please point me towards what I’m doing wrong?

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [March 12, 2026, 4:52pm UTC](https://community.zeek.org/t/unable-to-generate-intel-log/7955/2 "2026-03-12T16:52:30Z")

</div>

Hi,

there are a couple of possible cases for this to happen. The first one is that, when processing pcaps, there always is a bit of a race condition between the input framework and the pcap processing. Both happen simultaneously - and pcap processing (for small pcaps) often is faster.

You can load a short script that suspends processing till after the intelligence file is loaded, e.g. like this:

```auto
event zeek_init()
        {
        suspend_processing();
        }

event Input::end_of_data(name: string, source: string)
        {
        if ( /^intel-/ in name )
                continue_processing();
        }

```

The second possibility is that only a quic connection is established (via udp). UDP connections don’t automatically trigger the intelligence framework.

---

<div class="post-metadata">

**Author:** ![Pixelbrain](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@Pixelbrain](https://community.zeek.org/u/Pixelbrain)\
**Post date:** [March 13, 2026, 12:20pm UTC](https://community.zeek.org/t/unable-to-generate-intel-log/7955/3 "2026-03-13T12:20:17Z")

</div>

Hey, thanks for the quick response.

I was able to test your suggestion and indeed pausing the processing worked. The intel.log file gets generated without issue now.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 11, 2026, 1:33pm UTC](https://community.zeek.org/t/unable-to-generate-intel-log/7955/4 "2026-05-11T13:33:31Z")

</div>

This topic was automatically closed after 60 days. New replies are no longer allowed.