On a suggestion from a subscriber on the list, I generated a ton of ftp traffic and bro did write to the ftp.log. Apparently, the output is heavily buffered. Kelly