Skip to content
This repository was archived by the owner on Oct 13, 2025. It is now read-only.

Commit 709c5fd

Browse files
committed
Address feedback on the new quickstart guide
1 parent c703c66 commit 709c5fd

File tree

1 file changed

+15
-15
lines changed

1 file changed

+15
-15
lines changed

quickstart.rst

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ install from pre-built binary packages, or :doc:`building-from-source` in order
1616
to build Zeek from source.
1717

1818
We will first analyze previously captured network traffic from a ``pcap`` file -
19-
:download:`quickstart.pcap <traces/quickstart.pcap>`. Later, we will use Zeek to monitor live traffic.
19+
:download:`quickstart.pcap <traces/quickstart.pcap>`. Later, we will use Zeek to
20+
monitor live traffic. Each section builds on the previous section.
2021

2122
Running Zeek
2223
============
@@ -191,7 +192,8 @@ In another terminal, run the two ``curl`` commands from before:
191192
The terminal running Zeek will print each command as it gets processed.
192193

193194
More information on how to use Zeek’s scripting language can be found in the
194-
:doc:`scripting/index` section.
195+
:doc:`scripting/index` section. Experiment with Zeek scripting at
196+
`try.zeek.org <https://try.zeek.org>`_.
195197

196198
Managing Zeek
197199
=============
@@ -301,7 +303,7 @@ contains one "standalone" node:
301303
A standalone node is not in a cluster. Instead, this will change to multiple
302304
nodes which work together. The following configuration is commented out in the
303305
``node.cfg`` file by default. Remove the ``[zeek]`` node from above and paste
304-
this into the file (or uncomment the code):
306+
this into the file:
305307

306308
.. code-block:: console
307309
@@ -317,12 +319,7 @@ this into the file (or uncomment the code):
317319
type=proxy
318320
host=localhost
319321
320-
[worker-1]
321-
type=worker
322-
host=localhost
323-
interface=en0
324-
325-
[worker-2]
322+
[worker]
326323
type=worker
327324
host=localhost
328325
interface=en0
@@ -348,11 +345,10 @@ Now check the status of the cluster with the ``top`` command:
348345
[ZeekControl] > top
349346
350347
Name Type Host Pid VSize Rss Cpu Cmd
351-
logger-1 logger localhost XXXX 83M 83M 0% zeek
348+
logger logger localhost XXXX 83M 83M 0% zeek
352349
manager manager localhost XXXX 82M 82M 0% zeek
353-
proxy-1 proxy localhost XXXX 82M 82M 0% zeek
354-
worker-1 worker localhost XXXX 84M 84M 0% zeek
355-
worker-2 worker localhost XXXX 84M 84M 0% zeek
350+
proxy proxy localhost XXXX 82M 82M 0% zeek
351+
worker worker localhost XXXX 84M 84M 0% zeek
356352
357353
This is how you can easily check the status of the running cluster. As before,
358354
run the two ``curl`` commands in another terminal:
@@ -380,7 +376,7 @@ weird the same way as before:
380376
381377
$ zcat < $PREFIX/logs/2025-05-14/weird.08:58:26-08:58:31.log.gz
382378
<...>
383-
1747227503.828889 C3aXMM2AC3jzZbKl6i 192.168.1.8 60818 192.0.78.150 80 unknown_HTTP_method WEIRD F worker-2 -
379+
1747227503.828889 C3aXMM2AC3jzZbKl6i 192.168.1.8 60818 192.0.78.150 80 unknown_HTTP_method WEIRD F worker -
384380
385381
Users can distribute work across multiple processes or machines with clusters.
386382
See the `ZeekControl documentation`_ for more information on managing clusters
@@ -393,12 +389,16 @@ By this point, we’ve built up from Zeek's simplest use case to clusters.
393389
Each section has links to guide further discovery. Here are some extra
394390
considerations:
395391

392+
* Follow the interactive Zeek tutorial at
393+
`try.zeek.org <https://try.zeek.org>`_.
396394
* Read more of the documentation: the documentation can be read sequentially.
395+
Documentation for Zeek's out-of-the-box logs can be found in the
396+
:doc:`logs/index` section.
397397
* Browse scripts from :samp:`{$PREFIX}/share/zeek/policy` that may be useful to
398398
load. Their documentation is found in the
399399
:ref:`overview of script packages <script-packages>`.
400400
* Review the FAQ_.
401-
* Join the Zeek community :slacklink:`Slack channel <>` or
401+
* Join the Zeek community :slacklink:`Slack workspace <>` or
402402
:discourselink:`forum <>` to interact with fellow Zeekers and Zeek core
403403
developers.
404404
* Track Zeek code releases on the `Get Zeek`_ page. Find the release notes

0 commit comments

Comments
 (0)