Install Zeek on Ubuntu 20.04

Last Updated:

Follow through this tutorial to learn how to install Zeek on Ubuntu 20.04. Zeek, formerly Bro IDS, is the world’s leading passive open source network security monitoring tool.

Zeek is not an active security device, like a firewall or intrusion prevention system. Rather, Zeek sits on a “sensor,” a hardware, software, virtual, or cloud platform that quietly and unobtrusively observes network traffic. Zeek interprets what it sees and creates compact, high-fidelity transaction logs, file content, and fully customized output, suitable for manual review on disk or in a more analyst-friendly tool like a security and information event management (SIEM) system.

Installing Zeek on Ubuntu 20.04

Zeek can be installed by building it from the source code or by directly via the Zeek APT repositories.

In this tutorial, we will choose the later.

To install Zeek from the Zeek APT repositories;

Add Zeek repository to Ubuntu 20.04:

echo 'deb /' | sudo tee /etc/apt/sources.list.d/security:zeek.list
curl -fsSL | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null

Run system update;

apt update

Zeek 4.0.1 is the current stable release as of this writing, confirm the same by running the command below;

apt-cache policy zeek
  Installed: (none)
  Candidate: 4.0.1-0
  Version table:
     4.0.1-0 500
        500  Packages

You can then install Zeek by running the command below;

apt install zeek

During the installation, you will be prompted for some Postfix settings, choose Internet Site and enter your system FQDN.

Configuring Zeek on Ubuntu 20.04

Configure the Run-Time Environment

By default, Zeek is installed under /opt/zeek.

To begin with, add Zeek binary path to PATH;

echo "export PATH=$PATH:/opt/zeek/bin" >> ~/.bashrc
source ~/.bashrc

Define the Local Networks to Monitor

Next, you need to tell Zeek which local networks to monitor. This can be specified in the /opt/zeek/etc/networks.cfg configuration file.

The default networks defined are,, So, in our case, the network we want to monitor is


vim /opt/zeek/etc/networks.cfg

# List of local networks in CIDR notation, optionally followed by a
# descriptive tag.
# For example, "" or "fe80::/64" are valid prefixes.

#          Private IP space
#       Private IP space
#      Private IP space      Kifarunix-demo IP space

Save the file and exit once you made your network configuration changes.

Configure Zeek Cluster

Zeek can be run in standalone mode or in a cluster setup. To define whether to run in a cluster or standalone setup, you need to edit the /opt/zeek/etc/node.cfg configuration file.

  • For a standalone configuration, there must be only one Zeek node defined in this file.
  • For a cluster configuration, at a minimum there must be a manager node, a proxy node, and one or more worker nodes.

According to Zeek quickstart guide, using the standalone / single process mode of Zeek is not suitable for setups with significant amounts of traffic. In these cases one will almost certainly want to make use of a Zeek cluster, even on a single system.

Therefore, we will see how to setup Zeek cluster. You can have a look at Zeek cluster architecture.

The default Zeek node configuration is like;

cat /opt/zeek/etc/node.cfg

# Example ZeekControl node configuration.
# This example has a standalone node ready to go except for possibly changing
# the sniffing interface.

# This is a complete standalone configuration.  Most likely you will
# only need to change the interface.

## Below is an example clustered configuration. If you use this,
## remove the [zeek] node above.


Since we are running a single node Zeek Cluster in this setup, comment out the Zeek standalone configuration, section under [zeek] and define host address for your Zeek logger, manager, proxy and worker.

So what are these components;

  • logger: it is an optional Zeek process that receives log messages from the rest of the nodes in the cluster. It can be used instead of the manager to reduce the load on the manager itself.
  • manager: receives log messages and notices from the rest of the nodes in the Zeek cluster if no logger is defined.
  • proxy: is a Zeek process that may be used to offload data storage or any arbitrary workload. A cluster may contain multiple proxy nodes.
  • worker: is the Zeek process that sniffs network traffic and does protocol analysis on the reassembled traffic streams.

So below is our single node Zeek cluster configuration setup;

cat /opt/zeek/etc/node.cfg

# Example ZeekControl node configuration.
# This example has a standalone node ready to go except for possibly changing
# the sniffing interface.

# This is a complete standalone configuration.  Most likely you will
# only need to change the interface.

## Below is an example clustered configuration. If you use this,
## remove the [zeek] node above.


Review Global ZeekControl configuration file

Next, you need to review the global ZeekControl configuration file, /opt/zeek/etc/zeekctl.cfg.

Most of the default values in configuration files should suffice. The only change you might want to make or update here is the recipient address for all emails sent out by Zeek and ZeekControl, if you have any set. The default value is root@localhost.

Validate Zeek Configuration

Before you can install and start Zeek, you need to validate the configuration file;

zeekctl check

Hint: Run the zeekctl "deploy" command to get started.
kifarunix-demo-zeek-logger scripts are ok.
kifarunix-demo-zeek-manager scripts are ok.
kifarunix-demo-zeek-proxy scripts are ok.
kifarunix-demo-zeek-worker scripts are ok.
kifarunix-demo-worker-lo scripts are ok.

Deploy ZeekControl Configurations

If all is fine, install ZeekControl configuration and start the Zeek instance;

zeekctl deploy

checking configurations ...
installing ...
creating policy directories ...
installing site policies ...
generating cluster-layout.zeek ...
generating local-networks.zeek ...
generating zeekctl-config.zeek ...
generating ...
stopping ...
stopping workers ...
stopping proxy ...
stopping manager ...
stopping logger ...
starting ...
starting logger ...
starting manager ...
starting proxy ...
starting workers ...

Check the status of Zeek Instance

You can check the status of Zeek instance by executing;

zeekctl status

Name         Type    Host             Status    Pid    Started
kifarunix-demo-zeek-logger logger    running   17911  17 May 03:52:41
kifarunix-demo-zeek-manager manager    running   17962  17 May 03:52:43
kifarunix-demo-zeek-proxy proxy    running   18011  17 May 03:52:45
kifarunix-demo-zeek-worker worker    running   18081  17 May 03:52:48
kifarunix-demo-worker-lo worker  localhost        running   18082  17 May 03:52:48

Checking Zeek Logs

Zeek will start analyzing traffic according to a default policy and write the log results in /opt/zeek/logs/current directory.

ls -1 /opt/zeek/logs/current/


Some logs that are worth explicit mention:

  • conn.log: Contains an entry for every connection seen on the wire, with basic properties such as time and duration, originator and responder IP addresses, services and ports, payload size, and much more. This log provides a comprehensive record of the network’s activity.
  • notice.log: Identifies specific activity that Zeek recognizes as potentially interesting, odd, or bad. Such activity is called a “notice”.
  • known_services.log: This log file contains the services detected on the local network and are known to be actively used by the clients on the network. It helps in enumerating what all services are observed on a local network and if they all are intentional and known to the network administrator.
  • weird.log: Contains unusual or exceptional activity that can indicate malformed connections, traffic that doesn’t conform to a particular protocol, malfunctioning or misconfigured hardware/services, or even an attacker attempting to avoid/confuse a sensor.
  • (protocol).log such as (dns.log, dhcp.log, http.log, snmp.log): contains information for packets found in each respective protocol.

Sample conn.log logs;

tail /opt/zeek/logs/current/conn.log

1621277534.729878	CY3bmP18QlSIvSFxej	8132	80	tcp	-	-	-	-	RSTRH	T	T	0	^r	00	1	40	-
1621277534.729881	CGVzYD19RQxUT0Vzq	8133	80	tcp	-	-	-	-	S0	T	T	0	S	140	0	0	-
1621277534.729883	C8jp1t2D0NHoUeOiF1	8133	80	tcp	-	-	-	-	RSTRH	T	T	0	^r	00	1	40	-
1621277564.065743	CduRKb4f4bLM38gakl	47762	58282	tcp	-	-	-	-	OTH	T	T	0	Ccc00	0	0	-
1621277564.065833	CRgk0dMeT9AeMyROd	47762	58288	tcp	-	-	-	-	OTH	T	T	0	Ccc00	0	0	-
1621277564.215195	Cg09q71OaurnFkIdRe	38834	47761	tcp	-	-	-	-	OTH	T	T	0	Cc	00	0	0	-
1621277566.725573	CG17M71tH9TV52bBe7	38836	47761	tcp	-	-	-	-	OTH	T	T	0	Cc	00	0	0	-
1621277574.895432	C2aJF016ENvM3nF6da	34700	80	tcp	-	-	-	-	OTH	T	T	0	C	00	0	0	-
1621277570.315909	CQp7gp31EAsSvqgIn1	38846	47761	tcp	-	-	-	-	OTH	T	T	0	Cc	00	0	0	-
1621277574.895458	CIP6UASndf9AtymV2	34700	80	tcp	-	-	-	-	OTH	T	T	0	^cC00	0	0	-

The fields and types are;

ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	local_resp	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents
time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	bool	count	string	count	count	count	count	set[string]

Checking Zeek Node Processes

You can check processes running on each node by executing;

zeekctl ps.zeek <node>

For example, to check processes on Zeek manager node;

zeekctl ps.zeek kifarunix-demo-zeek-manager 

        USER         PID    PPID %CPU %MEM    VSZ   RSS TT       S  STARTED     TIME COMMAND
   (-) root       17911   17905  0.1  4.3 821252 88788 ?        S 03:52:41 00:00:02 zeek
   (+) root       17962   17956  0.0  4.3 642664 89200 ?        S 03:52:43 00:00:01 zeek
   (-) root       18011   18005  0.0  4.2 640972 87516 ?        S 03:52:45 00:00:01 zeek
   (-) root       18081   18069  0.1 10.7 772672 219204 ?       S 03:52:47 00:00:03 zeek
   (-) root       18082   18071  0.1 10.7 772148 218668 ?       S 03:52:47 00:00:03 zeek


Installing Zeek

Other Tutorials

Install and Configure AIDE on Debian 10

Install ModSecurity 3 with Apache in a Docker Container

Install and Setup Suricata on Ubuntu 18.04


We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!

Photo of author
Co-founder of, Linux Tips and Tutorials. Linux/Unix admin and author at

Leave a Comment