# What to Watch For When Upgrading Zeek from 6.0.4 to 7.0.5

**URL:** <https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718>\
**Category:** Zeek\
**Tags:** upgrade\
**Created:** [February 27, 2025, 11:10am UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718 "2025-02-27T11:10:10Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![ephemeric](https://avatars.discourse-cdn.com/v4/letter/e/a698b9/32.png) [@ephemeric](https://community.zeek.org/u/ephemeric)\
**Post date:** [February 27, 2025, 11:10am UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/1 "2025-02-27T11:10:10Z")

</div>

We are in the unfortunate position of having to upgrade from 6.0.4 to 7.0.5 and are duly nervous.

Is there anything in particular to watch for? I have looked at NEWS and CHANGES and obviously, the changes from 6.0.4 to 7.0.5 are many.

I was thinking of taking some existing btests, running the traces in 6.0.4 as a baseline and then comparing in 7.0.5? Maybe my thinking is wrong and tests will break due to some changes?

What are the best practices for upgrading?

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [March 3, 2025, 12:45pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/2 "2025-03-03T12:45:17Z")

</div>

> [@ephemeric](#):
>
> What are the best practices for upgrading?

Not sure about best practices, but running a separate instance/infrastructure for the next version and comparing differences with your production environment is one approach. Or, having existing integration tests replaying defined traffic and doing checking on the logs.

If you have the ability to capture some of your production traffic as a PCAP, you could also run `zeek -r` with Zeek 6 and Zeek 7 and look for any surprising discrepancies (which we’d be happy to hear about). Make sure you’re loading any custom scripts for both versions, too.

---

<div class="post-metadata">

**Author:** ![ephemeric](https://avatars.discourse-cdn.com/v4/letter/e/a698b9/32.png) [@ephemeric](https://community.zeek.org/u/ephemeric)\
**Post date:** [March 3, 2025, 12:57pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/3 "2025-03-03T12:57:27Z")

</div>

Thank you, I will do this and post any pertinent info here.

---

<div class="post-metadata">

**Author:** ![ende](https://avatars.discourse-cdn.com/v4/letter/e/59ef9b/32.png) [@ende](https://community.zeek.org/u/ende)\
**Post date:** [March 13, 2025, 8:46am UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/4 "2025-03-13T08:46:45Z")

</div>

Hi, I am just setting up 7.0.5 and have run into an issue setting up a broker. Perhaps its just me but if you run into any issues, please let me know, especially if you solve them. I will do the same.

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [March 13, 2025, 9:53am UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/5 "2025-03-13T09:53:03Z")

</div>

If you describe the issue, perhaps someone will be able to help you 🙂

---

<div class="post-metadata">

**Author:** ![ende](https://avatars.discourse-cdn.com/v4/letter/e/59ef9b/32.png) [@ende](https://community.zeek.org/u/ende)\
**Post date:** [March 13, 2025, 5:38pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/6 "2025-03-13T17:38:21Z")

</div>

Sure thing! When I install broker using pip, I get the error that the “Endpoint not found”.

broker version: 0.6.5  
zeek version: 7.0.5

The script used:

```auto
import broker
with broker.Endpoint() as ep,
     ...do the thing...

```

I have read that zeek needs to be paired with a specific version of broker. Is this true? If so, what version should I be using?

**edit**  
found announcement [Introducing Zeek 7.1](https://community.zeek.org/t/introducing-zeek-7-1/7688)

---

<div class="post-metadata">

**Author:** ![ende](https://avatars.discourse-cdn.com/v4/letter/e/59ef9b/32.png) [@ende](https://community.zeek.org/u/ende)\
**Post date:** [March 13, 2025, 10:40pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/7 "2025-03-13T22:40:07Z")

</div>

Error persist after updating to 7.1.0:

 ![image](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/80695b77a4771725eb35bf175e4f8b932f2c0191.png)

---

<div class="post-metadata">

**Author:** ![ende](https://avatars.discourse-cdn.com/v4/letter/e/59ef9b/32.png) [@ende](https://community.zeek.org/u/ende)\
**Post date:** [March 13, 2025, 11:28pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/8 "2025-03-13T23:28:08Z")

</div>

compiling broker and its submodules. ill update when done

**update**  
Working with test example:

 ![image](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/96b3a51fb2ae442727377d03080cfc9d5b994474.png)

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [March 14, 2025, 8:30am UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/9 "2025-03-14T08:30:52Z")

</div>

> Error persist after updating to 7.1.0:

Instead of using broker from pip or compiling it by hand, could you adapt PYTHONPATH for test-broker.py to point to your Zeek 7.1 installation’s `lib/zeek/python` directory?

Within the 7.1 container images, this works fine, it should be the same on your local system. You might need to adapt `/usr/local/zeek` to the prefix used at `./configure` time.

```auto
$ docker run --rm -it zeek/zeek:7.1
root@a299bcb956a8:/ PYTHONPATH=.:/usr/local/zeek/lib/zeek/python python3
Python 3.11.2 (main, Sep 14 2024, 03:00:30) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import broker
>>> print(broker)
<module 'broker' from '/usr/local/zeek/lib/zeek/python/broker/ __init__.py'>
>>> broker.Endpoint()
ff835a78-f640-554c-9f85-0595cd8b3df1

```

Hope this helps, Arne.

---

<div class="post-metadata">

**Author:** ![ende](https://avatars.discourse-cdn.com/v4/letter/e/59ef9b/32.png) [@ende](https://community.zeek.org/u/ende)\
**Post date:** [March 14, 2025, 12:13pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/10 "2025-03-14T12:13:20Z")

</div>

I sure can, thanks for the tip! I am working on getting the broker to work in c++ but writing zeek scripts using the broker works fine as well now.

 ![image](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/0c9577326f40e61f20ba420a87961ee6f19bf0e3.png)

I have a couple questions now that docker was brought up:

1. Is there a significant performance penalty when running zeek in a container or is it negligible?

2. How do you manage your migrations to different versions of zeek?

---

<div class="post-metadata">

**Author:** ![ephemeric](https://avatars.discourse-cdn.com/v4/letter/e/a698b9/32.png) [@ephemeric](https://community.zeek.org/u/ephemeric)\
**Post date:** [June 22, 2025, 4:25pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718/11 "2025-06-22T16:25:20Z")

</div>

I saw this in the latest newsletter, what a Godsend! Exactly what I needed for the solution to this post:

> **[GitHub - zeek/logschema: A Zeek package that generates schemas for your log...](https://github.com/zeek/logschema)**
>
> A Zeek package that generates schemas for your log files.

I tried:

> **[GitHub - corelight/zeek\_metainfo: Extract from zeek information (metadata) about the...](https://github.com/corelight/zeek_metainfo)**
>
> Extract from zeek information (metadata) about the logs it will produce in its current configuration

but the tests fail when installing on zeek-7.0.5.