Zeek 9 stumbles and thoughts

Zeek
1

On ubuntu 22 (still supported) I had to:

export CXX=g++-12

export CC=gcc-12

in order to get zeek 9 to compile. After installing I was met with:
Warning: zeekctl netstats and print commands with cluster backend 'ZeroMQ' require UseWebSocket = 1

every five minutes due to the cron job. After enabling WebSockets I got:

Warning: zeekctl netstats and print commands with cluster backend 'ZeroMQ' require UseWebSocket = 1

Warning: zeekctl option UseWebSocket is set, but websockets non-functional: Failed to import websockets module (ModuleNotFoundError("No module named 'websockets'"))
Warning: The print and netstats commands will be non-functional, please install the Python websockets package version 11.0 or later.

At this point, what are my options? I’m running these standalone using afpacket. Is there a way to disable the cluster back end?

2

The documentation has a section on the Websockets requirement here:

You may choose to install websockets with pip like so to get the correct version:

pip install --target /opt/zeek/lib/zeek/python/ websockets

Does that work for you?

3

Thanks…is there a way I can just disable the cron message for now?

4

I believe you could disable websockets, then fallback to the Broker backend like here. Should just be:

ClusterBackend = Broker

in zeekctl.cfg.

I think making that warning in cron is a bit noisy on our part, but we would really like you to use ZeroMQ with websockets since Broker is going away. You’ll need to install websockets soon anyway and IMO my original answer was the easier fix, but up to you.

Though, I haven’t worked too much on that transition, so others might have better advice.

5

Appreciate it. Looks like there’s other folks on slack that have ubuntu 24 and websockets is causing issues. I get my dev box up and cranking and see how it goes. My “./configure, make, sudo make install” hope for 9.0.0 is gone though :frowning:

6

Thanks again…that worked fine on Ubuntu 24 :grinning_face:

7

Thanks James. This is coming up sufficiently frequently that we’ll look into what it will take to work with websockets versions older than 11.

The pip install command to get a sufficiently new version of the package is definitely the recommended approach. We’d rather you don’t revert back to Broker just for this.

If you really just want to get that message out of the way, you could locate lib64/zeek/python/zeekclient/config.py in your Zeek install tree (or auxil/zeekctl/ZeekControl/config.py in your source tree) and comment out these lines.

8

I really appreciate it. Several of my machines didn’t even have pip installed so…yea this upgrade was a bit of a heavier lift. I’ve only got installed on one ubuntu 24 machine, and I’m holding off on the 22 boxes until I see how things pan out.