# Delayed event logs in live capture mode

**URL:** <https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574>\
**Category:** Help\
**Tags:** suricata\
**Created:** [June 17, 2022, 9:20am UTC](https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574 "2022-06-17T09:20:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![minhthong176881](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/minhthong176881/32/1483_2.png) [@minhthong176881](https://forum.suricata.io/u/minhthong176881)\
**Post date:** [June 17, 2022, 9:20am UTC](https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574/1 "2022-06-17T09:20:52Z")

</div>

Hi, I am using Suricata to capture traffic on a network interface. When I tried to replay a pcap (included 2 tcp sessions) with tcpreplay, only the events from first session were logged out, the events from second session were delayed, about 2 or 3 minutes later. I realized that they came out at the same time with the event flow log. I couldn’t find out the reason.  
Can you explain for me about this exception and how to handle it?  
Thanks.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [June 17, 2022, 12:22pm UTC](https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574/2 "2022-06-17T12:22:55Z")

</div>

Hi – welcome to the community!

What version of Suricata are you using?

What command are you using to start Suricata?

You’re using `tcpreplay` to inject packets onto the network – are you doing this from the same system on which Suricata is running?

---

<div class="post-metadata">

**Author:** ![minhthong176881](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/minhthong176881/32/1483_2.png) [@minhthong176881](https://forum.suricata.io/u/minhthong176881)\
**Post date:** [June 17, 2022, 7:09pm UTC](https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574/3 "2022-06-17T19:09:46Z")

</div>

Hi, Thanks for your response.  
I’m currently using suricata 6.2.0.  
The command I used was ‘suricata -c suricata.yaml -i ens33 -v’, with ens33 is my network interface.  
And i’m running tcpreplay on the same machine.

---

<div class="post-metadata">

**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\
**Post date:** [June 21, 2022, 1:17pm UTC](https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574/4 "2022-06-21T13:17:33Z")

</div>

Could it be that the TCP session is never properly closed? Try running your tests again but with a shorter active timeout in your suricata config.

---

<div class="post-metadata">

**Author:** ![minhthong176881](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/minhthong176881/32/1483_2.png) [@minhthong176881](https://forum.suricata.io/u/minhthong176881)\
**Post date:** [June 21, 2022, 1:26pm UTC](https://forum.suricata.io/t/delayed-event-logs-in-live-capture-mode/2574/5 "2022-06-21T13:26:41Z")

</div>

Yes, turn out that my HTTP request didn’t get any response (didn’t make a complete transaction), and that cause it was skipped until reassembled when the flow timed out.