Manage Live Monitoring¶

Configure ZeekControl for a standalone sensor, start authorised monitoring, and understand where current and rotated logs are stored.

Before you begin

Use an authorised lab host and record the Zeek version, operating-system version, interface name, and command output used for validation.

Introduction to Zeek¶

Managing Zeek with ZeekControl¶

ZeekControl is an interactive shell for easily operating/managing Zeek installations on a single system or even across multiple systems in a traffic-monitoring cluster.

In /opt/zeek/etc/node.cfg, set the right interface to monitor.

For example:

nano /opt/zeek/etc/node.cfg

[zeek]
type=standalone
host=localhost
interface=ens32   # change this according to your listening interface in ifconfig

[Optional but recommended]: In /opt/zeek/etc/networks.cfg, add networks that Zeek will consider local to the monitored environment. More on this below.

[Optional]: In /opt/zeek/etc/zeekctl.cfg, change the MailTo email address to a desired recipient and the LogRotationInterval to a desired log archival frequency.

Now start the ZeekControl shell like:

cd /opt/zeek/bin
sudo ./zeekctl

Since this is the first-time use of the shell, perform an initial installation of the ZeekControl configuration:

[ZeekControl] > install

Then start up a Zeek instance:

[ZeekControl] > start

There is another ZeekControl command, deploy, that combines the above two steps and can be run after any changes to Zeek policy scripts or the ZeekControl configuration. Note that the check command is available to validate a modified configuration before installing it.

[ZeekControl] > deploy

If there are errors while trying to start the Zeek instance, you can view the details with the diag command. If started successfully, the Zeek instance will begin analyzing traffic according to a default policy and output the results in /opt/zeek/logs/current directory.

You can leave it running for now, but to stop this Zeek instance you would do:

[ZeekControl] > stop

Once Zeek is stopped, the log files in the /opt/zeek/logs/current directory are compressed and moved into the current day named folder inside the /opt/zeek/logs directory.

Browsing Log Files¶

By default, logs are written out in human-readable (ASCII) format and data is organized into columns (tab-delimited). Logs that are part of the current rotation interval are accumulated in /opt/zeek/logs/current/ (if Zeek is not running, the directory will be empty). For example, the http.log contains the results of Zeek HTTP protocol analysis. Here are the first few columns of http.log:

# ts              uid              orig_h     orig_p   resp_h         resp_p
1726175258.283795   ClWVdk6JZxaBGiba1   10.0.0.25    36768    91.189.91.48   80

Logs that deal with analysis of a network protocol will often start like this: a timestamp, a unique connection identifier (UID), and a connection 4-tuple (originator host/port and responder host/port). The UID can be used to identify and correlate all logged activity (possibly across multiple log files) associated with a given connection 4-tuple over its lifetime.

The remaining columns of protocol-specific logs then detail the protocol-dependent activity that’s occurring. E.g. http.log’s next few columns (shortened for brevity) show a request to the root of Zeek website:

# method   host         uri  referrer  user_agent
GET        zeek.org  /    -         <...>Chrome/12.0.742.122<...>

Apart from the conventional network protocol specific log files, Zeek also generates other important log files based on the network traffic statistics, interesting activity captured in the traffic, and detection focused log files. Some logs that are worth explicit mention:

conn.log

Contains an entry for every connection seen on the wire, with basic properties such as time and duration, originator and responder IP addresses, services and ports, payload size, and much more. This log provides a comprehensive record of the network’s activity.
notice.log

Identifies specific activity that Zeek recognises as potentially interesting, odd, or bad. In Zeek-speak, such activity is called a “notice”.
known_services.log

This log file contains the services detected on the local network and are known to be actively used by the clients on the network. It helps in enumerating what all services are observed on a local network and if they all are intentional and known to the network administrator.
weird.log

Contains unusual or exceptional activity that can indicate malformed connections, traffic that doesn’t conform to a particular protocol, malfunctioning or misconfigured hardware/services, or even an attacker attempting to avoid/confuse a sensor.

By default, ZeekControl regularly takes all the logs from /opt/zeek/logs/current and archives/compresses them to a directory named by date, e.g. /opt/zeek/logs/2021-01-01. The frequency at which this is done can be configured via the LogRotationInterval option in /opt/zeek/etc/zeekctl.cfg. The default is every hour.

Live-monitoring checkpoint

Confirm that ZeekControl reports the node as running and that /opt/zeek/logs/current/ contains recently updated logs.