# How to add process field to conn.log?

**URL:** <https://community.zeek.org/t/how-to-add-process-field-to-conn-log/6865>\
**Category:** Development\
**Created:** [December 28, 2022, 6:11am UTC](https://community.zeek.org/t/how-to-add-process-field-to-conn-log/6865 "2022-12-28T06:11:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nick](https://avatars.discourse-cdn.com/v4/letter/n/f9ae1b/32.png) [@nick](https://community.zeek.org/u/nick)\
**Post date:** [December 28, 2022, 6:11am UTC](https://community.zeek.org/t/how-to-add-process-field-to-conn-log/6865/1 "2022-12-28T06:11:27Z")

</div>

Hi!  
Dear Team!  
I have installed zeek on my individual linux ubuntu system for test. When a new connection goes from inside the network to outside, I want to know which process Initiates that connection, that is, how to add a new field named “process” to conn.log?  
Thank you very much!

---

<div class="post-metadata">

**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\
**Post date:** [December 30, 2022, 1:53am UTC](https://community.zeek.org/t/how-to-add-process-field-to-conn-log/6865/2 "2022-12-30T01:53:40Z")

</div>

Hi Nick, welcome!

Out of the box Zeek does not provide any host-based analysis capability, so there’s nothing that would provide process IDs or other non-network-visible information. However, we’re working on a host agent that provides exactly that kind of context. Take a look [here](https://github.com/zeek/zeek-agent-v2) and let us know how it goes.

Best,  
Christian

---

<div class="post-metadata">

**Author:** ![nick](https://avatars.discourse-cdn.com/v4/letter/n/f9ae1b/32.png) [@nick](https://community.zeek.org/u/nick)\
**Post date:** [January 5, 2023, 7:22am UTC](https://community.zeek.org/t/how-to-add-process-field-to-conn-log/6865/3 "2023-01-05T07:22:44Z")

</div>

Thank you for your reply!  
I have seen zeek-agent-v2, but that architecture does not fit my need, I just deploy zeek on one machine.  
I have wrote a zeek script to deal my problem through the use of Exec::run.
