# Quickstart guide feedback

**URL:** https://community.zeek.org/t/quickstart-guide-feedback/1943
**Category:** Development
**Tags:** development
**Created:** [July 22, 2011, 4:26pm UTC](https://community.zeek.org/t/quickstart-guide-feedback/1943 "2011-07-22T16:26:42Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)
#### Post date: [July 22, 2011, 4:26pm UTC](https://community.zeek.org/t/quickstart-guide-feedback/1943/1 "2011-07-22T16:26:42Z")

</div>

Taking a closer look at the quickstart guide was still on my todo  
list. It's very nice! but some thoughts about structure:

&nbsp;&nbsp;&nbsp;&nbsp;- I'd switch the order of "Reading from a Trace" vs "Live Traffic"  
&nbsp;&nbsp;&nbsp;&nbsp;The former seems to be the more "natural" deployment model for a  
&nbsp;&nbsp;&nbsp;&nbsp;new user.

&nbsp;&nbsp;&nbsp;&nbsp;- How about moving the "Capturing As Unprivileged User" section  
&nbsp;&nbsp;&nbsp;&nbsp;out of the main flow, perhaps into an appendix or even into the  
&nbsp;&nbsp;&nbsp;&nbsp;FAQ and then with a link from the Quickstart guide to there. It  
&nbsp;&nbsp;&nbsp;&nbsp;feels a bit distracting where it's right now; but it's actually  
&nbsp;&nbsp;&nbsp;&nbsp;also something that's quite relevant outside of the concept of  
&nbsp;&nbsp;&nbsp;&nbsp;"quickstarting".

&nbsp;&nbsp;&nbsp;&nbsp;- The Bro Control part:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- I think the link between running from the command-line and  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;using broctl doesn't become quite clear. A bit more context  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;upfront in the broctl section on what's it's doing and  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;why/when one wants to use it would be helpful.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- I'm also wondering if broctl should be discussed first, and the  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;command-line version afterwards and framed as "here's the bare  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bones version if you want more control".

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- The use should also edit networks.cfg and broctl.cfg right  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;away (for the latter at least point out how to change the  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;recipient address for mails; that's probably the most common  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;change).

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- At the end, not only mention the help command but also link  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;to the broctl README.

&nbsp;&nbsp;&nbsp;&nbsp;- The checksum discussion: is that another part for the FAQ, with  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;a link from the Quickstart guide to there?

&nbsp;&nbsp;&nbsp;&nbsp;- The configure/customize part: per above, I think this should  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;also start with doing customizations via BroControl: where's the  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local policy I can edit; an example of what I put there  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(local\_nets isn't a good one here because broctl already takes  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;care of that via networks.cfg); and what do I do to put the  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;change into place ("broctl check"; "install"; and "restart").

&nbsp;&nbsp;&nbsp;&nbsp;- $PREFIX/etc/analysis.dat isn't meant to be user-visible.

Taking these together, what I would suggest I think is to actually  
have one section just on BroControl, with the corresponding parts  
taken out of the current running/configuraion sections; and then a  
separate section on just command-line usage. Does that make sense?

Couple further thoughts:

&nbsp;&nbsp;&nbsp;&nbsp;- Don't remember whether we talked abot this already, but  
&nbsp;&nbsp;&nbsp;&nbsp;navigation links between the sections would be helpul.

&nbsp;&nbsp;&nbsp;&nbsp;- For the preview, we should add a note that binary packages won't  
&nbsp;&nbsp;&nbsp;&nbsp;be available before the final release.

Robin

---

<div class="post-metadata">

### Author: ![Jonathan\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/e68b1a/32.png) [@Jonathan\_Siwek](https://community.zeek.org/u/Jonathan_Siwek)
#### Post date: [July 26, 2011, 10:42pm UTC](https://community.zeek.org/t/quickstart-guide-feedback/1943/2 "2011-07-26T22:42:56Z")

</div>

> Taking a closer look at the quickstart guide was still on my todo  
> list. It's very nice! but some thoughts about structure:  
> ...  
> Taking these together, what I would suggest I think is to actually  
> have one section just on BroControl, with the corresponding parts  
> taken out of the current running/configuraion sections; and then a  
> separate section on just command-line usage. Does that make sense?

Yeah, it's more BroControl-centric now and the customization discussion focuses on working through a more specific example/use-case. Let me know if anyone has more ideas about anything that might be added.

> &nbsp;&nbsp;&nbsp;- Don't remember whether we talked abot this already, but  
> &nbsp;&nbsp;&nbsp;navigation links between the sections would be helpful.

I remembered it was also mentioned that having it on a single page might be preferred, so I did that for now to see what the impression is.

> &nbsp;&nbsp;&nbsp;- For the preview, we should add a note that binary packages won't  
> &nbsp;&nbsp;&nbsp;be available before the final release.

I didn't add a note to the document yet, maybe that's something that could just be pointed out during the preview/beta announcement?

- Jon

---

<div class="post-metadata">

### Author: ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)
#### Post date: [July 27, 2011, 11:50pm UTC](https://community.zeek.org/t/quickstart-guide-feedback/1943/3 "2011-07-27T23:50:24Z")

</div>

> Yeah, it's more BroControl-centric now and the customization  
> discussion focuses on working through a more specific  
> example/use-case. Let me know if anyone has more ideas about anything  
> that might be added.

I like it, thanks! I made a few further small tweaks to the structure,  
see what you think.

> I remembered it was also mentioned that having it on a single page  
> might be preferred, so I did that for now to see what the impression  
> is.

Yeah, I like that better as well.

> I didn't add a note to the document yet, maybe that's something that  
> could just be pointed out during the preview/beta announcement?

Makes sense.

Robin

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/quickstart-guide-feedback/1943/4 "2022-05-06T15:39:41Z")

</div>


