ZEEKCTL(8)

✨ ZEEKCTL ✨

okay bestie, gather round, because this one is literally the group chat admin of your whole Zeek setup 💅 it's zeekctl from the System Administration Utilities section of the manual (section 8, iykyk), and it's about to become your main character.

🌸 NAME 🌸

zeekctl — the interactive shell for managing Zeek installations 🦋

🎀 SYNOPSIS 🎀

zeekctl [command]

💖 DESCRIPTION 💖

So zeekctl is an interactive interface for managing either a standalone install or a Zeek cluster installation. Both. She does both. 👑

Here's the vibe: if you pass a zeekctl command directly on the command-line, then zeekctl just does the thing for that command immediately — no interactive interface, no small talk, straight to business. ✨

But before you actually run zeekctl, you first need to edit the zeekctl.cfg, node.cfg, and networks.cfg files. Not optional, bestie. Order of operations:

1. In the zeekctl.cfg file, review the zeekctl options and make sure the options are set correctly for your environment. 🌍
2. Next, edit the node.cfg file and specify the nodes that you will be running. 🖥️
3. Finally, edit the networks.cfg file and list each network that is considered local to the monitored environment (see the examples in the file for the format to use). 📝

okay and this part is SO important: when running zeekctl for the first time, you must run the zeekctl deploy command before running any other commands in order to apply the configuration settings. no skipping. 🙈

You must also run zeekctl deploy each time you change the configuration (including any Zeek scripts) or upgrade Zeek. Every. Single. Time. She needs the deploy, she's dramatic like that. 💅

🌈 OPTIONS 🌈

• capstats [<nodes>] [<secs>] — report interface statistics with capstats 📊
• check [<nodes>] — check configuration before installing it ✅
• cleanup [--all] [<nodes>] — delete working dirs (flush state) on nodes 🧹
• config — print zeekctl configuration 🖨️
• cron [--no-watch] — perform jobs intended to run from cron ⏰
• cron enable|disable|? — enable/disable "cron" jobs 🔛
• deploy — check, install, and restart 🚀 (the icon, the moment, the ritual)
• df [<nodes>] — print nodes' current disk usage 💾
• diag [<nodes>] — output diagnostics for nodes 🩺
• exec <shell cmd> — execute shell command on all hosts 🐚
• exit — exit from the interactive interface 👋
• install — update zeekctl installation/configuration 📦
• netstats [<nodes>] — print nodes' current packet counters 📈
• nodes — print node configuration 🌐
• peerstatus [<nodes>] — print status of nodes' remote connections 🤝
• print <id> [<nodes>] — print values of script variable at nodes 🔍
• process <trace> [<op>] [-- <sc>] — run Zeek (with options and scripts) on trace 🎬
• restart [--clean] [<nodes>] — stop and then restart processing 🔄
• scripts [-c] [<nodes>] — list the Zeek scripts the nodes will load 📜
• start [<nodes>] — start processing ▶️
• status [<nodes>] — summarize node status 📋
• stop [<nodes>] — stop processing ⏹️
• top [<nodes>] — show Zeek processes ala top 👀

🧚 Commands provided by plugins:

• ps.zeek [<nodes>] — show Zeek processes on nodes' systems 🫶

👑 AUTHOR 👑

zeekctl was written by The Zeek Project <info@zeek.org>. 💜

and that's the whole page, bestie — no cap, you're ready to deploy. this little legend is dated November 2014, and it lives in section ZEEKCTL(8) of the manual, so if you ever forget where you read this, that's the receipt. now go forth and deploy, periodt. 💖✨🎀