OS Manuals

zeek-client(1)

zeek-client

ZEEK-CLIENT(1) User Commands ZEEK-CLIENT(1)

zeek-client

zeek-client [-h] [-c FILE] [--controller HOST:PORT] [--set SECTION.KEY=VAL] [--quiet | --verbose] [--version] {deploy,deploy-config,get-config,get-id-value,get-instances,get-nodes,monitor,restart,stage-config,show-settings,test-timeout} ...

A command-line client for Zeek's Management Framework.

Use this client to push cluster configurations to a cluster controller, retrieve running state from the system, restart nodes, and more.

For details about Zeek's Management Framework, please consult the documentation at https://docs.zeek.org/en/master/frameworks/management.html.

Path to zeek-client config file. (Default: @ZEEK_CLIENT_CONFIG_FILE@)

Address and port of the controller, either of which may be omitted (default: 127.0.0.1:2149)

Adjust a configuration setting. Can use repeatedly. See show-settings.

Suppress informational output to stderr.

Increase informational output to stderr. Repeat for more output (e.g. -vvv).

Show version number and exit.

zeek-client deploy

Deploy a staged cluster configuration.

usage: zeek-client deploy [-h]

zeek-client deploy-config

Upload a cluster configuration and deploy it.

usage: zeek-client deploy-config [-h] FILE

arguments:

Cluster configuration file, "-" for stdin

zeek-client get-config

Retrieve staged or deployed cluster configuration.

usage: zeek-client get-config [-h] [--filename FILE] [--as-json] [--deployed | --staged]

options:

Output file for the configuration, default stdout

Report in JSON instead of INI-style config file

Return deployed configuration

Return staged configuration (default)

zeek-client get-id-value

Show the value of a given identifier in Zeek cluster nodes.

usage: zeek-client get-id-value [-h] IDENTIFIER [NODES ...]

arguments:

Name of the Zeek script identifier to retrieve.

Name(s) of Zeek cluster nodes to query. When omitted, queries all nodes.

zeek-client get-instances

Show instances connected to the controller.

usage: zeek-client get-instances [-h]

zeek-client get-nodes

Show active Zeek nodes at each instance.

usage: zeek-client get-nodes [-h]

zeek-client monitor

For troubleshooting: do nothing, just report events.

usage: zeek-client monitor [-h]

zeek-client restart

Restart cluster nodes.

usage: zeek-client restart [-h] [NODES ...]

arguments:

Name(s) of Zeek cluster nodes to restart. When omitted, restarts all nodes.

zeek-client stage-config

Upload a cluster configuration for later deployment.

usage: zeek-client stage-config [-h] FILE

arguments:

Cluster configuration file, "-" for stdin

zeek-client show-settings

Show zeek-client's own configuration.

usage: zeek-client show-settings [-h]

zeek-client test-timeout

Send timeout test event.

usage: zeek-client test-timeout [-h] [--with-state]

options:

Make request stateful in the controller.

The client exits with 0 on success and 1 if a problem arises, such as lack of a response from the controller, unexpected response data, or the controller explicitly reporting an error in its handling of a command.

zeek-client supports the following environment variables:


ZEEK_CLIENT_CONFIG_FILE: Same as `--configfile` argument, but lower precedence.
ZEEK_CLIENT_CONFIG_SETTINGS: Same as a space-separated series of `--set` arguments, but lower precedence.

The Management Framework and this client are experimental software. The Zeek team welcomes your feedback. Please file issues on Github at https://github.com/zeek/zeek-client/issues, or contact us on Discourse or Slack: https://zeek.org/community

zeek-client

zeek 9.0.1-r1 · enterprise-packages · ingested 2026-10-28