@@ -16,7 +16,8 @@ install from pre-built binary packages, or :doc:`building-from-source` in order
1616to build Zeek from source.
1717
1818We will first analyze previously captured network traffic from a ``pcap `` file -
19- :download: `quickstart.pcap <traces/quickstart.pcap >`. Later, we will use Zeek to monitor live traffic.
19+ :download: `quickstart.pcap <traces/quickstart.pcap >`. Later, we will use Zeek to
20+ monitor live traffic. Each section builds on the previous section.
2021
2122Running Zeek
2223============
@@ -191,7 +192,8 @@ In another terminal, run the two ``curl`` commands from before:
191192 The terminal running Zeek will print each command as it gets processed.
192193
193194More information on how to use Zeek’s scripting language can be found in the
194- :doc: `scripting/index ` section.
195+ :doc: `scripting/index ` section. Experiment with Zeek scripting at
196+ `try.zeek.org <https://try.zeek.org >`_.
195197
196198Managing Zeek
197199=============
@@ -301,7 +303,7 @@ contains one "standalone" node:
301303 A standalone node is not in a cluster. Instead, this will change to multiple
302304nodes which work together. The following configuration is commented out in the
303305``node.cfg `` file by default. Remove the ``[zeek] `` node from above and paste
304- this into the file (or uncomment the code) :
306+ this into the file:
305307
306308.. code-block :: console
307309
@@ -317,12 +319,7 @@ this into the file (or uncomment the code):
317319 type=proxy
318320 host=localhost
319321
320- [worker-1]
321- type=worker
322- host=localhost
323- interface=en0
324-
325- [worker-2]
322+ [worker]
326323 type=worker
327324 host=localhost
328325 interface=en0
@@ -348,11 +345,10 @@ Now check the status of the cluster with the ``top`` command:
348345 [ZeekControl] > top
349346
350347 Name Type Host Pid VSize Rss Cpu Cmd
351- logger-1 logger localhost XXXX 83M 83M 0% zeek
348+ logger logger localhost XXXX 83M 83M 0% zeek
352349 manager manager localhost XXXX 82M 82M 0% zeek
353- proxy-1 proxy localhost XXXX 82M 82M 0% zeek
354- worker-1 worker localhost XXXX 84M 84M 0% zeek
355- worker-2 worker localhost XXXX 84M 84M 0% zeek
350+ proxy proxy localhost XXXX 82M 82M 0% zeek
351+ worker worker localhost XXXX 84M 84M 0% zeek
356352
357353 This is how you can easily check the status of the running cluster. As before,
358354run the two ``curl `` commands in another terminal:
@@ -380,7 +376,7 @@ weird the same way as before:
380376
381377 $ zcat < $PREFIX/logs/2025-05-14/weird.08:58:26-08:58:31.log.gz
382378 <...>
383- 1747227503.828889 C3aXMM2AC3jzZbKl6i 192.168.1.8 60818 192.0.78.150 80 unknown_HTTP_method WEIRD F worker-2 -
379+ 1747227503.828889 C3aXMM2AC3jzZbKl6i 192.168.1.8 60818 192.0.78.150 80 unknown_HTTP_method WEIRD F worker -
384380
385381 Users can distribute work across multiple processes or machines with clusters.
386382See the `ZeekControl documentation `_ for more information on managing clusters
@@ -393,12 +389,16 @@ By this point, we’ve built up from Zeek's simplest use case to clusters.
393389Each section has links to guide further discovery. Here are some extra
394390considerations:
395391
392+ * Follow the interactive Zeek tutorial at
393+ `try.zeek.org <https://try.zeek.org >`_.
396394* Read more of the documentation: the documentation can be read sequentially.
395+ Documentation for Zeek's out-of-the-box logs can be found in the
396+ :doc: `logs/index ` section.
397397* Browse scripts from :samp: `{ $PREFIX } /share/zeek/policy ` that may be useful to
398398 load. Their documentation is found in the
399399 :ref: `overview of script packages <script-packages >`.
400400* Review the FAQ _.
401- * Join the Zeek community :slacklink: `Slack channel <> ` or
401+ * Join the Zeek community :slacklink: `Slack workspace <> ` or
402402 :discourselink: `forum <> ` to interact with fellow Zeekers and Zeek core
403403 developers.
404404* Track Zeek code releases on the `Get Zeek `_ page. Find the release notes
0 commit comments