Seek error when I try to use zeekctl command

Zeek
1

Hi all,

I have doing a clean install on RHEL8 host with Zeek 3.0.0. When I try to use any zeekctl option, it returns the following error:

root@rhel8host:~# zeekctl help

Warning: ZeekControl plugin uses legacy BroControl API. Use

‘import ZeekControl.plugin’ instead of ‘import BroControl.plugin’

Error: no type given for node zeek

Maybe the problem is with python3 that comes with RHEL8? Any idea?

2

I run Zeek 3.0 on CentOS 8 and I also get this warning, though the error seems to suggest there’s an issue with your /opt/zeek/etc/node.cfg file.

3

Yep, you are right Ericooi … There was an error in my nodes.cfg … Now, it is solved. Many thanks.

On the other side, this:

Warning: ZeekControl plugin uses legacy BroControl API. Use

‘import ZeekControl.plugin’ instead of ‘import BroControl.plugin’

… appears every time zeekctl runs …

4

Cool, glad I could help.

Yeah, Zeek 3 was the big transition from Bro to Zeek so there are still areas where not every single command or line of code has been transitioned over to using “zeek” instead of “bro.” My guess is the warnings will go away in future releases of Zeek. For now, it is nothing to worry about.

5

It's possible that a plugin you have installed from the package manager or manually contained a zeekctl/broctl plugin and hasn't been updated for Zeek 3.0 yet. Take a look in /usr/local/bro/lib/zeekctl/plugins to see what's there and if one of the plugins there is using BroControl. If you find something in there using the BroControl API you could then go and file a ticket with the plugin that is causing the issue! :slight_smile:

   .Seth