Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

@load packages/zeek-kafka can't find #80

Open
puquanyang0326 opened this issue Nov 7, 2023 · 6 comments
Open

@load packages/zeek-kafka can't find #80

puquanyang0326 opened this issue Nov 7, 2023 · 6 comments

Comments

@puquanyang0326
Copy link

I installed zeek-kafka via Manual Installation and it successfully outputs as follows
[root@securitypublicservicestest-bj-1 172.16.252.5 bin]# . /zeek -N Seiso::Kafka
Seiso::Kafka - Writes logs to Kafka (dynamic, version 0.3.0)

I followed up by writing local.zeek by referring to the documentation, which looks like this
@load packages/zeek-kafka
redef Kafka::send_all_active_logs = T;
redef Kafka::kafka_conf = table(
["metadata.broker.list"] = "localhost:9092"
).

At this point an error message is given
[ZeekControl] > deploy
checking configurations ...
zeek scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 121: can't find packages/zeek-kafka

[ZeekControl] > quit

@ottobackwards
Copy link
Collaborator

try just @load packages

@marvi
Copy link

marvi commented Apr 26, 2024

I have the same error. Compiled the plugin from source.

[root@zeek lib64]# zeek -N Seiso::Kafka
Seiso::Kafka - Writes logs to Kafka (dynamic, version 0.3.0)

[root@zeek lib64]# zeek --version
zeek version 6.0.3

zeek/site/local.zeek:

@load packages/zeek-kafka
redef Kafka::send_all_active_logs = T;
redef Kafka::kafka_conf = table(
    ["metadata.broker.list"] = "localhost:9092"
);

Error:

[root@zeek lib64]# zeekctl deploy
checking configurations ...
zeek scripts failed.
fatal error in /usr/local/zeek/share/zeek/site/local.zeek, line 124: can't find packages/zeek-kafka

Changed to @load packages

[root@zeek lib64]# zeekctl deploy
checking configurations ...
zeek scripts failed.
fatal error in /usr/local/zeek/share/zeek/site/local.zeek, line 124: can't find packages

@ottobackwards
Copy link
Collaborator

#80 (comment)

@marvi
Copy link

marvi commented Apr 26, 2024

I did.

#80 (comment)

@marvi
Copy link

marvi commented Apr 28, 2024

I did some more tests. I read in the Zeek documentation that "By default, Zeek will automatically activate all dynamic plugins found in its search path ZEEK_PLUGIN_PATH". So I remove all @load directives. Now zeek starts without error:

[root@zeek bin]# zeekctl deploy
checking configurations ...
installing ...
removing old policies in /usr/local/zeek/spool/installed-scripts-do-not-touch/site ...
removing old policies in /usr/local/zeek/spool/installed-scripts-do-not-touch/auto ...
creating policy directories ...
installing site policies ...
generating standalone-layout.zeek ...
generating local-networks.zeek ...
generating zeekctl-config.zeek ...
generating zeekctl-config.sh ...
stopping ...
stopping zeek ...
starting ...
starting zeek ...

zeek-kafka seems to be loaded:

[root@zeek current]# zeek -N Seiso::Kafka
Seiso::Kafka - Writes logs to Kafka (dynamic, version 0.3.0)
[root@zeek bin]# zeekctl scripts |grep kafka
  {"name":"  /usr/local/zeek/lib64/zeek/plugins/SEISO_KAFKA/lib/bif/kafka.bif.zeek"}

Kafka is accessible on localhost:9092:

[root@zeek bin]# ./kafka-broker-api-versions.sh --bootstrap-server localhost:9092
zeek.marvi.xyz:9092 (id: 1 rack: null) -> (
        Produce(0): 0 to 10 [usable: 10],
        Fetch(1): 0 to 16 [usable: 16],
        ListOffsets(2): 0 to 8 [usable: 8],

Configuration:

redef Kafka::send_all_active_logs = T;
redef Kafka::topic_name = "zeek";
redef Kafka::kafka_conf = table(
    ["metadata.broker.list"] = "localhost:9092"
);

Nothing is produced on the zeek topic. logs/current/ is populated.

I compiled zeek with debug enabled and recompiled the plugin. Then starting zeek as zeek -B plugin-Seiso-Kafka.
debug.log is empty. Is there any other way to get debug information so I can track down my issue?

@helloworld2019
Copy link

I have the same error. any solutions?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants