Error installing af_packet plugin for Zeek 3.0.11 (SOLVED)

I have found the problem. It was PATH variable. I don’t know why, but RedHat put the following option in profile’s user:

User specific environment

if ! [[ “$PATH” =~ “$HOME/.local/bin:$HOME/bin:” ]]

then

PATH="$HOME/.local/bin:$HOME/bin:$PATH"

fi

export PATH

As you can see, the error appears due to zkg installs a “zeek” python script wrapper, and it is executed first during zkg tests to install af_packet plugin instead of the real zeek binary located in /opt/zeek/bin, in my case.

Regards.

Glad you solved the issue, though for clarity: a standard `zkg`
install doesn't come with a `zeek` wrapper script, so guess that came
from elsewhere.

- Jon

Thanks Jon, but according to my installation:

zeek@rhelzeek05:~$ ls -la
total 20
drwx------. 4 zeek idps 127 Nov 10 08:41 .
drwxr-xr-x. 3 root root 18 Nov 9 14:46 ..
-rw-------. 1 zeek idps 1798 Nov 9 16:25 .bash_history
-rw-r--r--. 1 zeek idps 18 Jun 23 13:37 .bash_logout
-rw-r--r--. 1 zeek idps 273 Nov 9 16:18 .bash_profile
-rw-r--r--. 1 zeek idps 321 Nov 9 16:18 .bashrc
-rw-r--r--. 1 zeek idps 2933 Nov 9 14:07 .dir_colors
drwxr-xr-x. 2 zeek idps 6 Nov 10 08:41 logs
drwxr-xr-x. 4 zeek idps 61 Nov 10 08:41 spool
zeek@ rhelzeek05:~$

zeek@ rhelzeek05:~$ pip3 install --user zeek zkg
Collecting zeek
  Downloading https://files.pythonhosted.org/packages/34/62/8a5957ad91aeec8cde357bc7ed6af75bee2b8aacc73b158aca692d73d2f1/zeek-0.1.5.tar.gz
Collecting zkg
  Downloading https://files.pythonhosted.org/packages/64/10/2962084d30ca69522a8249fffaed9fe04b1fe5af75b75d0cd53672309293/zkg-2.4.1-py2.py3-none-any.whl (49kB)
    100% |████████████████████████████████| 51kB 491kB/s
Collecting Click (from zeek)
  Downloading https://files.pythonhosted.org/packages/d2/3d/fa76db83bf75c4f8d338c2fd15c8d33fdd7ad23a9b5e57eb6c5de26b430e/click-7.1.2-py2.py3-none-any.whl (82kB)
    100% |████████████████████████████████| 92kB 1.5MB/s
Collecting Kazoo (from zeek)
  Downloading https://files.pythonhosted.org/packages/a4/01/a43084598589d0f5afd0dd5a9dd551132050cdea978ef73ebf0e32d2ec1c/kazoo-2.8.0-py2.py3-none-any.whl (142kB)
    100% |████████████████████████████████| 143kB 1.8MB/s
Collecting gitpython (from zkg)
  Downloading https://files.pythonhosted.org/packages/24/d1/a7f8fe3df258549b303415157328bfcc63e9b11d06a7ad7a3327f3d32606/GitPython-3.1.11-py3-none-any.whl (159kB)
    100% |████████████████████████████████| 163kB 4.2MB/s
Collecting configparser (from zkg)
  Downloading https://files.pythonhosted.org/packages/08/b2/ef713e0e67f6e7ec7d59aea3ee78d05b39c15930057e724cc6d362a8c3bb/configparser-5.0.1-py3-none-any.whl
Collecting btest (from zkg)
  Downloading https://files.pythonhosted.org/packages/62/04/c29981cc95f0ee964fd0d76b142ef02de9ed6e7ebc649cf064a7042ba093/btest-0.64.tar.gz (80kB)
    100% |████████████████████████████████| 81kB 6.4MB/s
Collecting semantic-version (from zkg)
  Downloading https://files.pythonhosted.org/packages/a5/15/00ef3b7888a10363b7c402350eda3acf395ff05bebae312d1296e528516a/semantic_version-2.8.5-py2.py3-none-any.whl
Requirement already satisfied: six in /usr/lib/python3.6/site-packages (from Kazoo->zeek)
Collecting gitdb<5,>=4.0.1 (from gitpython->zkg)
  Downloading https://files.pythonhosted.org/packages/48/11/d1800bca0a3bae820b84b7d813ad1eff15a48a64caea9c823fc8c1b119e8/gitdb-4.0.5-py3-none-any.whl (63kB)
    100% |████████████████████████████████| 71kB 7.6MB/s
Collecting smmap<4,>=3.0.1 (from gitdb<5,>=4.0.1->gitpython->zkg)
  Downloading https://files.pythonhosted.org/packages/b0/9a/4d409a6234eb940e6a78dfdfc66156e7522262f5f2fecca07dc55915952d/smmap-3.0.4-py2.py3-none-any.whl
Building wheels for collected packages: zeek, btest
  Running setup.py bdist_wheel for zeek ... done
  Stored in directory: /nsm/zeek/.cache/pip/wheels/c9/c5/09/125f8615bcbefa78ba34a0263004fa12f81a3d107790ba8260
  Running setup.py bdist_wheel for btest ... done
  Stored in directory: /nsm/zeek/.cache/pip/wheels/a2/6c/ed/65a232d78b04e0694e1707d9a9ab841789d8ceb8a08604314b
Successfully built zeek btest
Installing collected packages: Click, Kazoo, zeek, smmap, gitdb, gitpython, configparser, btest, semantic-version, zkg
Successfully installed Click-7.1.2 Kazoo-2.8.0 btest-0.64 configparser-5.0.1 gitdb-4.0.5 gitpython-3.1.11 semantic-version-2.8.5 smmap-3.0.4 zeek-0.1.5 zkg-2.4.1
zeek@ rhelzeek05:~$

And after zkg is installed, a "zeek" python wrapper appears (as you can see with the same date/time):

zeek@ rhelzeek05:~$ ls -la .local/bin/
total 232
drwxr-xr-x. 2 zeek idps 4096 Nov 10 08:47 .
drwx------. 4 zeek idps 28 Nov 10 08:47 ..
-rwxr-xr-x. 1 zeek idps 538 Nov 10 08:47 bro-pkg
-rwxr-xr-x. 1 zeek idps 83330 Nov 10 08:47 btest
-rwxr-xr-x. 1 zeek idps 1025 Nov 10 08:47 btest-ask-update
-rwxr-xr-x. 1 zeek idps 679 Nov 10 08:47 btest-bg-run
-rwxr-xr-x. 1 zeek idps 458 Nov 10 08:47 btest-bg-run-helper
-rwxr-xr-x. 1 zeek idps 3046 Nov 10 08:47 btest-bg-wait
-rwxr-xr-x. 1 zeek idps 6321 Nov 10 08:47 btest-diff
-rwxr-xr-x. 1 zeek idps 398 Nov 10 08:47 btest-diff-rst
-rwxr-xr-x. 1 zeek idps 737 Nov 10 08:47 btest-progress
-rwxr-xr-x. 1 zeek idps 3422 Nov 10 08:47 btest-rst-cmd
-rwxr-xr-x. 1 zeek idps 399 Nov 10 08:47 btest-rst-include
-rwxr-xr-x. 1 zeek idps 146 Nov 10 08:47 btest-rst-pipe
-rwxr-xr-x. 1 zeek idps 140 Nov 10 08:47 btest-setsid
-rwxr-xr-x. 1 zeek idps 209 Nov 10 08:47 zeek
-rwxr-xr-x. 1 zeek idps 87159 Nov 10 08:47 zkg
zeek@ rhelzeek05:~$

With this content:

zeek@ rhelzeek05:~$ cat .local/bin/zeek
#!/usr/bin/python3.6

# -*- coding: utf-8 -*-
import re
import sys

from zeek import main

if __name__ == '__main__':
    sys.argv[0] = re.sub(r'(-script\.pyw?|\.exe)?$', '', sys.argv[0])
    sys.exit(main())

It is a clean installed server and Zeek is installed under /opt/zeek ...

So, In my opinion, is zkg who installs this "zeek" wrapper ...

That's a request to install two packages, "zeek" and "zkg", but "zeek"
is actually not related to "zkg" or even Zeek.

- Jon