ZEEKCTL(8) System Administration Utilities ZEEKCTL(8)

# [NAME](#NAME)

**zeekctl** - interactive shell for managing Zeek installations

# [SYNOPSIS](#SYNOPSIS)

**zeekctl** \[*command*]

# [DESCRIPTION](#DESCRIPTION)

**zeekctl** is an interactive interface for managing either a standalone or a Zeek cluster installation. If a **zeekctl** command is specified directly on the command-line, then **zeekctl** performs the action associated with that command immediately (instead of running the interactive interface).

Before actually running **zeekctl** you first need to edit the **zeekctl.cfg**, **node.cfg**, and **networks.cfg** files. In the **zeekctl.cfg** file, you should review the **zeekctl** options and make sure the options are set correctly for your environment. Next, edit the **node.cfg** file and specify the nodes that you will be running. Finally, edit the **networks.cfg** file and list each network that is considered local to the monitored environment (see the examples in the file for the format to use).

When running **zeekctl** for the first time, you must run the **zeekctl** **deploy** command before running any other commands in order to apply the configuration settings. You must also run **zeekctl deploy** each time you change the configuration (including any Zeek scripts) or upgrade Zeek.

# [OPTIONS](#OPTIONS)

[**capstats** \[<nodes>\] \[<secs>\]](#capstats)

Report interface statistics with capstats

[**check** \[<nodes>\]](#check)

Check configuration before installing it

[**cleanup** \[--all\] \[<nodes>\]](#cleanup)

Delete working dirs (flush state) on nodes

[**config**](#config)

Print zeekctl configuration

[**cron** \[--no-watch\]](#cron)

Perform jobs intended to run from cron

[**cron** enable|disable|?](#cron~2)

Enable/disable "cron" jobs

[**deploy**](#deploy)

Check, install, and restart

[**df** \[<nodes>\]](#df)

Print nodes' current disk usage

[**diag** \[<nodes>\]](#diag)

Output diagnostics for nodes

[**exec** <shell cmd>](#exec)

Execute shell command on all hosts

[**exit**](#exit)

Exit from the interactive interface

[**install**](#install)

Update zeekctl installation/configuration

[**netstats** \[<nodes>\]](#netstats)

Print nodes' current packet counters

[**nodes**](#nodes)

Print node configuration

[**peerstatus** \[<nodes>\]](#peerstatus)

Print status of nodes' remote connections

[**print** <id> \[<nodes>\]](#print)

Print values of script variable at nodes

[**process** <trace> \[<op>\] \[-- <sc>\]](#process)

Run Zeek (with options and scripts) on trace

[**restart** \[--clean\] \[<nodes>\]](#restart)

Stop and then restart processing

[**scripts** \[-c\] \[<nodes>\]](#scripts)

List the Zeek scripts the nodes will load

[**start** \[<nodes>\]](#start)

Start processing

[**status** \[<nodes>\]](#status)

Summarize node status

[**stop** \[<nodes>\]](#stop)

Stop processing

[**top** \[<nodes>\]](#top)

Show Zeek processes ala top

Commands provided by plugins:

[**ps.zeek** \[<nodes>\]](#ps.zeek)

Show Zeek processes on nodes' systems

# [AUTHOR](#AUTHOR)

**zeekctl** was written by The Zeek Project <info@zeek.org>.

November 2014

---

Document: zeekctl(8) from zeek 9.0.0-r1 (Chainguard OS)