<div dir="ltr">I've not attempted to install that plugin but looking at the github for it, <a href="https://github.com/apache/metron-bro-plugin-kafka">https://github.com/apache/metron-bro-plugin-kafka</a>, it has this statement "bro-pkg is the preferred mechanism for installing this plugin, as it will dynamically retrieve, build, test, and load the plugin." That leads me to the zkg config file documentation at <a href="https://docs.zeek.org/projects/package-manager/en/stable/zkg.html#zkg-config-file">https://docs.zeek.org/projects/package-manager/en/stable/zkg.html#zkg-config-file</a><div><br></div><div><pre style="box-sizing:border-box;font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",Courier,monospace;font-size:12px;margin-top:0px;margin-bottom:0px;padding:12px;overflow:auto;line-height:1.4;color:rgb(64,64,64)"><span class="gmail-c1" style="box-sizing:border-box;color:rgb(64,128,144);font-style:italic"># The directory containing Zeek distribution source code. This is only</span>
<span class="gmail-c1" style="box-sizing:border-box;color:rgb(64,128,144);font-style:italic"># needed when installing packages that contain Zeek plugins that are</span>
<span class="gmail-c1" style="box-sizing:border-box;color:rgb(64,128,144);font-style:italic"># not pre-built. The legacy name of this option is "bro_dist".</span>
<span class="gmail-n" style="box-sizing:border-box">zeek_dist</span> <span class="gmail-o" style="box-sizing:border-box;color:rgb(102,102,102)">=</span></pre><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>It doesn't sound like the plugin is prebuilt, so zkg is trying to do it. Do you have the source code anywhere on the system? Have you defined that varialbe in the config file to point to that location?</div><div><br>Thank you,<br><br>Jeff Lang<br><br>---------------------------------------------------<br><br>Jeffry Lang<br>IT Security Operations (0284)<br>1300 Torgersen Hall, Virginia Tech<br>620 Drillfield Dr.<br>Blacksburg VA 24061<br>540-<span style="font-size:12.8px">231-4117</span><br><a href="mailto:jefflang@vt.edu" target="_blank">jefflang@vt.edu</a></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Nov 27, 2019 at 9:49 AM Fadel <<a href="mailto:fadelkam@gmail.com">fadelkam@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div>Hello zeek community,</div><div dir="auto">Could anyone please help me solve this issue?</div><div dir="auto">I'm not able to move forward...</div><div dir="auto"><br></div><div dir="auto">Thanks very much!<br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Tue, Nov 12, 2019, 4:05 PM Fadel <<a href="mailto:fadelkam@gmail.com" target="_blank">fadelkam@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="auto">Hi, I've been trying to install this plugin and it seems to have some issues or confusion between bro and zeek for that plugin.</div><div dir="auto">Anyone encountered this issue?</div><div dir="auto">Thanks!</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">~]# zkg install apache/metron-bro-plugin-kafka</div><div dir="auto">The following packages will be INSTALLED:</div><div dir="auto"> zeek/apache/metron-bro-plugin-kafka (0.3)</div><div dir="auto"><br></div><div dir="auto">Verify the following REQUIRED external dependencies:</div><div dir="auto">(Ensure their installation on all relevant systems before proceeding):</div><div dir="auto"> from zeek/apache/metron-bro-plugin-kafka (0.3):</div><div dir="auto"> librdkafka ~0.11.5</div><div dir="auto"><br></div><div dir="auto">Proceed? [Y/n] </div><div dir="auto">zeek/apache/metron-bro-plugin-kafka asks for LIBRDKAFKA_ROOT (Path to librdkafka installation tree) ? [/usr/local/lib] </div><div dir="auto">Saved answers to config file: /root/.zkg/config</div><div dir="auto">Running unit tests for "zeek/apache/metron-bro-plugin-kafka"</div><div dir="auto">error: failed to run tests for zeek/apache/metron-bro-plugin-kafka: package build_command failed, see log in /root/.zkg/logs/metron-bro-plugin-kafka-build.log</div><div dir="auto">Proceed to install anyway? [N/y]</div><div dir="auto"><br></div><div dir="auto"><div dir="auto">~]# cat /root/.zkg/logs/metron-bro-plugin-kafka-build.log</div><div dir="auto">=== STDERR ===</div><div dir="auto">=== STDOUT ===</div><div dir="auto">Cannot determine Bro source directory, use --bro-dist=DIR.</div><div dir="auto"><br></div></div><div dir="auto"><br></div></div>
</blockquote></div></div></div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div>