I have noticed several times that in the event of bro termination after expiration of StopTimeout, bro logs disappear.
This is generally seen when log sizes are much bigger (for example after overnight)
This issue was present in bro-2.1 and continue to be present in bro-2.2
I see (kill from control.py - kick in often when stopping or restarting bro) because catch-n-release is still trying to flush its tables (which takes long time). Then there is no logs from overnight!
I can provide more information if desired (or even a test case).
Branch topic/dnthayer/ticket1126 has a fix for this.