# Getting error during sample Zeek (from Spicy) integration

**URL:** <https://community.zeek.org/t/getting-error-during-sample-zeek-from-spicy-integration/7044>\
**Category:** Zeek\
**Tags:** spicy\
**Created:** [June 2, 2023, 5:25pm UTC](https://community.zeek.org/t/getting-error-during-sample-zeek-from-spicy-integration/7044 "2023-06-02T17:25:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![arotnemer](https://avatars.discourse-cdn.com/v4/letter/a/e47774/32.png) [@arotnemer](https://community.zeek.org/u/arotnemer)\
**Post date:** [June 2, 2023, 5:25pm UTC](https://community.zeek.org/t/getting-error-during-sample-zeek-from-spicy-integration/7044/1 "2023-06-02T17:25:20Z")

</div>

Hi, I am new to Zeek and Spicy. I am running Redhat Linux Version 7.9. I installed Zeek and Spicy via RPM and have the following RPMs installed:  
zeek-btest-data-5.2.2-1.1.x86\_64  
zeek-client-5.2.2-1.1.x86\_64  
zeek-devel-5.2.2-1.1.x86\_64  
zeek-zkg-5.2.2-1.1.x86\_64  
zeek-core-5.2.2-1.1.x86\_64  
zeek-debuginfo-5.2.2-1.1.x86\_64  
zeek-spicy-devel-5.2.2-1.1.x86\_64  
zeek-btest-5.2.2-1.1.x86\_64  
zeekctl-5.2.2-1.1.x86\_64

I have verified the Spicy parsers support  
[ar435f@ar435f-vmbuild07-clone my-http]$ sudo /opt/zeek/bin/zeek -N Zeek::Spicy  
Zeek::Spicy - Support for Spicy parsers (\*.hlto) (built-in)

I am attempting to to the “Getting Started” steps at:  
[https://docs.zeek.org/projects/spicy/en/latest/getting-started.html](https://docs.zeek.org/projects/spicy/en/latest/getting-started.html)

I ran the sample “Hello World” app with no problems.

Ran into an issue during Section 2.3 “Zeek Integration”  
I downloaded the “request-line.pcap” file  
Copied the “my-http.evt” file  
Copied the “my-http.zeek” file  
However on the next step I got an error:

[ar435f@ar435f-vmbuild07-clone my-http]$ sudo /opt/zeek/bin/zeek -Cr request-line.pcap my-http.spicy my-http.evt my-http.zeek  
fatal error: cannot load ‘my-http.spicy’: analyzers need to be precompiled with ‘spicyz’

I was able to run the subsequent steps but I was wondering if there is an explanation to the above error. Am I missing any RPMs?

Thanks

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [June 5, 2023, 7:32am UTC](https://community.zeek.org/t/getting-error-during-sample-zeek-from-spicy-integration/7044/2 "2023-06-05T07:32:03Z")

</div>

Hey @arotnemer ,

it appears the documentation is outdated around the JIT approach where .spicy and .evt are provided to Zeek and it compiles these on-the-fly. This feature has been removed.

> [@RFC: Removing JIT mode from Spicy's Zeek plugin?](https://community.zeek.org/t/rfc-removing-jit-mode-from-spicys-zeek-plugin/6854):
>
> I’ve been pondering making a change to the Spicy plugin for Zeek where I’d be interested in feedback. Right now, there are two ways to have Zeek pull in a Spicy analyzer: (1) pre-compile the analyzer with spicyz into an HLTO file, then give that HLTO file to Zeek to load; and (2) give Spicy source code and EVT files directly to Zeek for compilation just-in-time at startup. I’m considering removing Option (2). For operational usage, Option (1) is already the only viable way to go because Option…

I’ve opened a ticket in the Spicy project, too.

Thanks for the report!

Arne