# Where are the log files when DNS monitoring ran by cli ? **URL:** \ **Category:** Zeek\ **Created:** [October 22, 2014, 12:58pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323 "2014-10-22T12:58:24Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![John\_Donnelly](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@John\_Donnelly](https://community.zeek.org/u/John_Donnelly)\ **Post date:** [October 22, 2014, 12:58pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/1 "2014-10-22T12:58:24Z")
Hi, When I run : bro -i eth0 -i eth1 /usr/local/bro/share/bro/base/protocols/dns/main.bro listening on eth0, capture length 8192 bytes listening on eth1, capture length 8192 bytes 1413981834.692222 warning in /usr/local/bro/share/bro/base/misc/find-checksum-offloading.bro, line 54: Your interface is likely receiving invalid TCP and UDP checksums, most likely from NIC checksum offloading. ^C 1413982439.080452 received termination signal 1413982439.080452 5 packets received on interface eth0, 0 dropped 1413982439.080452 1977 packets received on interface eth1, 0 dropped I don’t see any log file created under: /usr/local/bro/logs/current Suggestions ? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 22, 2014, 1:21pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/2 "2014-10-22T13:21:08Z")
It looks like you have bad checksums probably from NIC checksum offloading. 🙂   .Seth ---
**Author:** ![John\_Donnelly](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@John\_Donnelly](https://community.zeek.org/u/John_Donnelly)\ **Post date:** [October 22, 2014, 1:25pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/3 "2014-10-22T13:25:32Z")
I have bro on Ubuntu 14.04 VM’s running under VirtualBox on Linux . Should the dns.logs appear /usr/local/bro/logs if those errors were corrected ? The logs appear when I start bro using broctl . ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 22, 2014, 1:34pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/4 "2014-10-22T13:34:37Z")
I get the sense you've made changes to broctl's configuration then. Did you add broars=-C to broctl.cfg perhaps?   .Seth ---
**Author:** ![John\_Donnelly](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@John\_Donnelly](https://community.zeek.org/u/John_Donnelly)\ **Post date:** [October 22, 2014, 1:42pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/5 "2014-10-22T13:42:31Z")
No changes made to broctl.cfg ! I am running bro outside of broctl … are those setting read by bro during startup ? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 22, 2014, 2:26pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/6 "2014-10-22T14:26:06Z")
I'm confused. You first said that you weren't getting logs when you ran Bro outside of BroControl but then you said you were getting logs when you ran Bro with BroControl. If you run bro directly at the command line, it won't load any of the broctl scripts or implement any of the broctl configuration. You are almost certainly seeing invalid checksums on one of the interfaces you're sniffing. If you want to see if that's it, you could temporarily disable checksum checking with the -C flag on the command line. I don't recommend running with that configuration for normal use though. It seemed like you were also confused about where logs would be written when running bro directly. They should be written to your current working directory by default. 🙂   .Seth ---
**Author:** ![John\_Donnelly](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@John\_Donnelly](https://community.zeek.org/u/John_Donnelly)\ **Post date:** [October 22, 2014, 2:28pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/7 "2014-10-22T14:28:54Z")
Bingo - the dns.log is in the cwd ! Q answered ! ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 22, 2014, 2:30pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/8 "2014-10-22T14:30:01Z")
Try running bro -C -i eth0 -i eth1 By default, all scripts in base/ are loaded when calling Bro. Log files are dropped in your working directory when running bro without broctl. Just a note, don’t ever change scripts in base/. -AK ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/where-are-the-log-files-when-dns-monitoring-ran-by-cli/3323/9 "2022-05-06T15:42:10Z")