Skip to content

Binary Packages

Christian Kreibich edited this page Nov 8, 2021 · 7 revisions
Clone this wiki locally

Linux Binary Packages for Zeek

We are providing binary packages for a number of different Linux distributions, via the openSUSE Build Service. Once you've configured the OBS repositories on your system, you can easily install the packages using your distribution's package manager.

The Zeek repository is currently split into multiple packages. Typically you will just install the zeek meta-package, which will automatically install everything needed to run Zeek and ZeekControl.

The individual packages are:

  • zeek-core only contains the Zeek core and scripts.
  • zeekctl contains ZeekControl.
  • zeek-devel (or zeek-core-dev for .deb-based sysetms) contains header and other development files necessary to compile plugins.
  • zeek-libcaf-devel (or zeek-libcaf-dev for .deb-based systems) contains the caf header and other development files - which may be necessary to compile plugins.
  • libbroker-devel contains broker header and development files.
  • zeek-btest is installed starting with the 4.0 release - and contains the system that is used to drive unit tests and may be necessary to test plugins.
  • zeek-zkg is installed starting with the 4.0 release and contains the zeek package manager.

All packages are installed into /opt/zeek. A group named zeek is added to the system, if it does not already exist. Users that are part of the zeek group can edit configuration files and view the Zeek log files.

We also provide builds of our LTS releases. The package names for our LTS releases are zeek-lts, zeek-lts-core, etc. LTS packages also install into /opt/zeek/ and cannot be installed simultaneously with the normal zeek package, which follows the feature releases.

This means you can simply switch between the feature and LTS releases by telling your package manager to install the zeek or zeek-lts package; it will automatically remove the other package.

We also provide nightly builds tracking the most current development version. The package names for our nightly builds are zeek-nightly, zeek-nightly-core, etc. Nightly packages are installed to /opt/zeek-nightly and can be installed simultaneously with the other zeek packages.

For a list of supported operating systems, see the support matrix.

Note: /opt/zeek/bin is not automatically added to $PATH.
You either have to run Zeek using the full path to the binaries or add it to your $PATH.
Note: Please follow the "add repository and install manually" directions given by the OpenSUSE build service.
Grabbing rpm/deb files directly does not work due to inter-file dependencies.
Note: The binary packages are automatically signed by the openSUSE Build Service, which is outside of our control.
For debian-based systems you have to manually re-add the key, getting it from the listed location on the download page and adding it with apt-key add Release.key when the old key expires. This last happened in January 2021; the next key expiration is currently set for March 2023.

You can download the packages for the latest feature release build here. Please follow the instructions to add rpm/deb repositories; grabbing the binary files directly does not give you all dependencies. The source files are available here.

You can download the packages for the latest LTS release build here. Please follow the instructions to add rpm/deb repositories; grabbing the binary files directly does not give you all dependencies. The source files for LTS builds are available here.

Nightly builds are also available. Please follow the instructions to add rpm/deb repositories; grabbing the binary files directly does not give you all dependencies. The source files are here.