In this case I suppose he needs to login to a web client (or perhaps other client) which can publish an initial kind 0 event. Not sure if I’m giving the right reason for this but I remember my wife had this issue and she resolved it by logging in to snort (using browser extension)