Package Details: zeek 6.1.1-1

Git Clone URL: (read-only, click to copy)
Package Base: zeek
Description: A network analysis framework
Upstream URL:
Licenses: BSD
Submitter: synnick
Maintainer: dllcoolj
Last Packager: dllcoolj
Votes: 5
Popularity: 0.000010
First Submitted: 2019-06-04 11:57 (UTC)
Last Updated: 2024-01-27 13:43 (UTC)

Latest Comments

1 2 3 Next › Last »

<deleted-account> commented on 2023-07-15 20:14 (UTC)

Bumped to 6.0.0 LTS version of Zeek. I'll be uploading a -git version later this week for those interested in bleed edge options.

enemyleft commented on 2022-09-16 21:08 (UTC)

Hi, Looks like the patch "0001-Fix-default-build-with-disable-cpp-tests.patch" was already applied to the source in the latest version (5.0.1)? - I am getting an error that the patch was already applied. When I skip the patch in prepare() it works.

bennyboersma commented on 2022-05-04 22:05 (UTC)


I cannot seem to find the configuration files like node.cfg, networks.cfg and zeekctl.cfg when using this package. Can someone point me in the right direction?

boogy commented on 2020-09-17 11:11 (UTC)

You need to change the path to the patch file as it's not installing due to a wrong path.

Replace ../../ with ../patchfile.diff

Best, Boogy

synnick commented on 2020-05-14 12:46 (UTC)

I've rolled the version back to 3.0.6 due to compilation errors encountered on an up to date arch system and gcc 10.1.0.

It's possible a 3.1.x will address the issue.

synnick commented on 2020-05-14 09:04 (UTC)

Hi Erik, Pierre

Ok, I accept the arguments. I've changed the prefix to /usr, removed the (incorrect) peg to git to prefer 3.1.3 and disabled what I could of optional pieces of the build.

The package now unpacks its ~2000 files into the following directories:

  • /usr/bin/ (9 binaries 3 soft-links)
  • /usr/include/<binpac, broker, caf, paraglob, zeek>
  • /usr/lib/zeek <- libbroker and libcaf are here
  • /usr/share/man
  • /usr/share/zeek <- .zeek scripts

eschwartz commented on 2020-05-13 20:57 (UTC)

Please convert this package to build from the latest stable release, and optionally create a second package named zeek-git which builds the latest development version from git master.

P.S. Upstream being strange and installing outside of /usr isn't a good reason to do so ourselves, furthermore, ignore their OBS package and look at the project README which doesn't list any --prefix to use.

P.P.S. Arch also does not do gratuitous split packaging, while debian as a matter of policy does. Therefore certainly don't emulate upstream's respect for debian packaging standards in their debian package by introducing debian packaging standards to archlinux.

mcd1992 commented on 2020-05-13 03:33 (UTC)

Package marked for deletion.

plt commented on 2020-02-05 14:22 (UTC)

Hi @synnick

I understand your choice, but I think the point of a Linux distribution is to be consistent: in ArchLinux, packages install under /usr. It is normal that, when installing a software using its source (as opposed to the distribution packages), you install it somewhere under /opt or /usr/local. But when installing an Archlinux or AUR package, one may expect that it installs under /usr.

My 2 cents,


synnick commented on 2020-02-05 14:16 (UTC)

Hi Pierre,

Sorry for the move of the package to /opt/zeek. I've been slowly aligning this package with the style used upstream by Johanna Amann (0xxon) on the OBS found here:

A few months ago, I actually opened a pull to include a zeek PKGBUILD and the response was to stick with /opt/zeek and further split the zeek package into a few different subcomponents (libbroker, zeekctl, zeek-core, etc, etc).

So I intend to follow that style with this PKGBUILD because it will reduce differences across OSes even if it isn't in the standard dirs.