# Where is my conn.log?

**URL:** <https://community.zeek.org/t/where-is-my-conn-log/5524>\
**Category:** Zeek\
**Created:** [November 12, 2018, 7:47pm UTC](https://community.zeek.org/t/where-is-my-conn-log/5524 "2018-11-12T19:47:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krenz\_Mark\_Steven](https://avatars.discourse-cdn.com/v4/letter/k/5e9695/32.png) [@Krenz\_Mark\_Steven](https://community.zeek.org/u/Krenz_Mark_Steven)\
**Post date:** [November 12, 2018, 7:47pm UTC](https://community.zeek.org/t/where-is-my-conn-log/5524/1 "2018-11-12T19:47:53Z")

</div>

I’ve inherited a Bro 2.5.5 setup from someone else and am coming to it after it’s been running for a while without producing any conn or other protocol logs. I’ve tried restarting Bro and redeploying, but the only logs that get started are

communication.log  
loaded\_scripts.log  
packet\_filter.log  
reporter.log  
stats.log  
stderr.log  
stdout.log  
weird.log

None of these logs are filling up with anything useful or indicating what the problem may be. The only useful message is “non\_ip\_packet\_in\_ethernet” in the weird.log. That seems to point to a network issue rather than a Bro issue, but I’d like to rule out a Bro issue first if possible. At one point this setup did produce useful logs but apparently it just stopped at some point and I’m not sure why. The only thing somewhat unique about this setup is that at one point it required me to use the setting ‘redef encap\_hdr\_size=10;’ to handle an incompatibility between Bro and a vlan technology this network uses. I’ve also verified that the taps that Bro is listening on are seeing actual traffic by using tshark, which is able to decode the protocols.

Any suggestions as to where to start and how to diagnose this?

Thanks,

Mark

---

<div class="post-metadata">

**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\
**Post date:** [November 12, 2018, 8:25pm UTC](https://community.zeek.org/t/where-is-my-conn-log/5524/2 "2018-11-12T20:25:17Z")

</div>

Check the reporter.log. I highly suspect that it will have an error related to checksum offloading.

You'll want to try running bro with the -C option to see if that produces logs. If it does, then you'll need to modify your interface configuration. You can do this by installing the interface setup package from NCSA: [https://github.com/ncsa/bro-interface-setup](https://github.com/ncsa/bro-interface-setup) or manually configuring your interface along the lines of the guide located here: [https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html](https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html)

Security Onion: When is full packet capture NOT full packet capture?\<[https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html](https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html)\>  
[blog.securityonion.net](http://blog.securityonion.net)  
I was looking at some packets recently and noticed the Wireshark message "Packet size limited during capture". &nbsp;This was strange since the p...

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/where-is-my-conn-log/5524/3 "2022-05-06T15:46:11Z")

</div>

Closed on May 6, 2022, 3:46pm UTC