# Zeek stats feature doubt **URL:** \ **Category:** Zeek\ **Tags:** scripting, logging\ **Created:** [June 21, 2023, 4:37pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060 "2023-06-21T16:37:42Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 21, 2023, 4:37pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/1 "2023-06-21T16:37:42Z")
Hi, What all kind of stats zeek provides? I can see stats.log, weird-stats.log and many other logs are supported but can’t able to enable these logs. By default my zeek is generating weird, conn and packet filter log. Please let me know the configuration! Also is there any event API available to get per connection advance stats like standard deviation, average pkt count or size , Inter arrival time (IAT) max min mean etc. similarly event API to get global or aggregated statistics for all connections ? Please let me know what else we can get from zeek in terms of statistics! Thanks Biswa ---
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [June 21, 2023, 8:15pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/2 "2023-06-21T20:15:38Z")
Hi Biswa, You’ll want to `@load misc/stats` to get a `stats.log`. You can redef `Stats::report_interval` to get updates at intervals other than the default 5 minutes. The `Stats::Info` record spells out the data reported that way, see details [here](https://docs.zeek.org/en/master/scripts/policy/misc/stats.zeek.html#type-Stats::Info). Alternatively you can collect metrics from Zeek via the [telemetry framework](https://docs.zeek.org/en/master/frameworks/telemetry.html), including scraping support for Prometheus. Best, Christian ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 22, 2023, 2:39pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/3 "2023-06-22T14:39:24Z")
Thanks a lot @Christian . I have added @load misc/stats in local.zeek. Anyway can’t able to generate stats.log. Also can’t able to redef the report\_interval variable as well. It’s giving redef used but not previously defined(Stats::report\_interval). Then I tried to pass Stats::report\_interval=5sec as an argument to the zeek command along with the pcap and script but it is giving unknown identifier in command-line options. Also I tried to modify the original stats.zeek but that is also not reflecting. Biswa ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 22, 2023, 2:57pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/4 "2023-06-22T14:57:41Z")
I made it work by @load …/…/policy/misc/stats.zeek redef Stats::report\_interval=1secs; Not sure if it’s a standard process. Please correct me! Thanks Biswa ---
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [June 23, 2023, 2:09am UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/5 "2023-06-23T02:09:17Z")
It’s working fine here for example with a simple `zeek -r some.pcap misc/stats`. If you’re using `local.zeek`, note that it already includes stats logging [by default](https://github.com/zeek/zeek/blob/master/scripts/site/local.zeek#L19) so you need to do nothing. The default stats logging interval is 5 minutes, so you’d need to wait that long to see the log if you’re running continuously. Best, Christian ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 23, 2023, 3:07am UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/6 "2023-06-23T03:07:41Z")
Oh sorry for the confusion . I did the below change in my script , test.zeek . It worked fine @load …/…/policy/misc/stats.zeek redef Stats::report\_interval=1secs; However when I tried to run from command line (without any change in test.zeek), it failed. zeek -Cr test.pcap stats::report\_interval=1secs test.zeek Do I need to give misc/stats path as well? Thanks Biswa ---
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [June 23, 2023, 6:42pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/7 "2023-06-23T18:42:53Z")
Hey, `stats::report_interval=1secs` should be `Stats::report_interval=1secs` — case matters. But there’s no point in doing that since it’s redundant to your test.zeek file. Best, Christian ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 23, 2023, 6:49pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/8 "2023-06-23T18:49:34Z")
In the previous I forgot to write Stats::report\_interval , I tried that only (case sensitive) but it’s giving unknown identifier in command-line options Thanks Biswa ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [June 29, 2023, 1:50pm UTC](https://community.zeek.org/t/zeek-stats-feature-doubt/7060/9 "2023-06-29T13:50:04Z")
Hi, My requirement is to get per connection stats such as orig and resp pkt, bytes at an particular interval or periodically. I have found that conn stats are already there in connection structure and connection\_status\_update() event can generate such periodic stats. Also I will use stats.log for accessing global or aggregated counters. Is there any other efficient method to get per connection stat ? Thanks Biswa