ZEEK-CLIENT(1)

📦 version 8.2.2, in nixos 26.05, nixpkgs unstable

💖 NAME 💖

okay so bestie, meet zeek-client — the actual main character of the ZEEK-CLIENT(1) manual page (User Commands section, iykyk). That’s the name, and yes it’s giving command-line royalty. 👑

✨ SYNOPSIS ✨

zeek-client [-h] [-c FILE] [--controller HOST:PORT] [--set
       SECTION.KEY=VAL] [--quiet | --verbose] [--version] {deploy,deploy-
       config,get-config,get-id-value,get-instances,get-
       nodes,monitor,restart,stage-config,show-settings,test-timeout} ...

🌸 DESCRIPTION 🌸

okay so zeek-client is a command-line client for Zeek’s Management Framework. Use this client to push cluster configurations to a cluster controller, retrieve running state from the system, restart nodes, and more. No cap, that’s the whole vibe. 💅

For details about Zeek’s Management Framework, please consult the documentation at https://docs.zeek.org/en/master/frameworks/management.html.

🎀 OPTIONS 🎀

  • -c FILE, --configfile FILE — Path to zeek-client config file. (Default: @ZEEK_CLIENT_CONFIG_FILE@)
  • --controller HOST:PORT — Address and port of the controller, either of which may be omitted (default: 127.0.0.1:2149)
  • --set SECTION.KEY=VAL — Adjust a configuration setting. Can use repeatedly. See show-settings.
  • --quiet, -q — Suppress informational output to stderr.
  • --verbose, -v — Increase informational output to stderr. Repeat for more output (e.g. -vvv).
  • --version — Show version number and exit.

🦋 COMMANDS 🦋

here’s the command menu, bestie — every single one, no skipping. 💖

💅 zeek-client deploy

Deploy a staged cluster configuration.

usage: zeek-client deploy [-h]

💅 zeek-client deploy-config

Upload a cluster configuration and deploy it.

usage: zeek-client deploy-config [-h] FILE

arguments:

  • FILE — Cluster configuration file, "-" for stdin

💅 zeek-client get-config

Retrieve staged or deployed cluster configuration.

usage: zeek-client get-config [-h] [--filename FILE] [--as-json]
       [--deployed | --staged]

options:

  • --filename FILE, -f FILE — Output file for the configuration, default stdout
  • --as-json — Report in JSON instead of INI-style config file
  • --deployed — Return deployed configuration
  • --staged — Return staged configuration (default)

💅 zeek-client get-id-value

Show the value of a given identifier in Zeek cluster nodes.

usage: zeek-client get-id-value [-h] IDENTIFIER [NODES ...]

arguments:

  • IDENTIFIER — Name of the Zeek script identifier to retrieve.
  • NODES — Name(s) of Zeek cluster nodes to query. When omitted, queries all nodes.

💅 zeek-client get-instances

Show instances connected to the controller.

usage: zeek-client get-instances [-h]

💅 zeek-client get-nodes

Show active Zeek nodes at each instance.

usage: zeek-client get-nodes [-h]

💅 zeek-client monitor

For troubleshooting: do nothing, just report events. honestly iconic. 🫶

usage: zeek-client monitor [-h]

💅 zeek-client restart

Restart cluster nodes.

usage: zeek-client restart [-h] [NODES ...]

arguments:

  • NODES — Name(s) of Zeek cluster nodes to restart. When omitted, restarts all nodes.

💅 zeek-client stage-config

Upload a cluster configuration for later deployment.

usage: zeek-client stage-config [-h] FILE

arguments:

  • FILE — Cluster configuration file, "-" for stdin

💅 zeek-client show-settings

Show zeek-client’s own configuration.

usage: zeek-client show-settings [-h]

💅 zeek-client test-timeout

Send timeout test event.

usage: zeek-client test-timeout [-h] [--with-state]

options:

  • --with-state — Make request stateful in the controller.

💀 EXIT STATUS 💀

The client exits with 0 on success and 1 if a problem arises, such as lack of a response from the controller, unexpected response data, or the controller explicitly reporting an error in its handling of a command. So yeah: 0 = slay, 1 = something’s off. 💅

🌈 ENVIRONMENT 🌈

zeek-client supports the following environment variables:

  • ZEEK_CLIENT_CONFIG_FILE — Same as --configfile argument, but lower precedence.
  • ZEEK_CLIENT_CONFIG_SETTINGS — Same as a space-separated series of --set arguments, but lower precedence.

🫶 SUGGESTIONS AND BUG REPORTS 🫶

⚠️ heads up, bestie: the Management Framework and this client are experimental software. The Zeek team welcomes your feedback.

Please file issues on Github at https://github.com/zeek/zeek-client/issues, or contact us on Discourse or Slack: https://zeek.org/community.

That’s the whole zeek-client page from the ZEEK-CLIENT(1) manual, bestie 💖 — the footer’s source/manual tag is zeek-client / ZEEK-CLIENT(1), and no separate version number or date was printed in this copy, so I’m not inventing one. periodt. ✨

📦 where this page comes from