<div dir="ltr"><div dir="ltr">I'm still fuzzy on the Supervisor framework, as we're still in the process of upgrading systems to the point of supporting the new C++ requirements.</div><div dir="ltr"><br></div><div>As a concrete example, what does a cluster upgrade look like? Today, that means install the new version on the manager, and then do `zeekctl deploy`, which copies the files to the nodes and restarts the cluster. All of that is done without Broker.</div><div><br></div><div>What does that look like with zeekcl + Broker? Let's say I install the new version on the manager. If I then tell zeekcl to destroy the running instance, will that work, or will the newer zeekcl be incompatible with the Broker version of the running Zeek?</div><div><br></div><div>Reading the script linked in [2], I notice that zeekcl would not support copying files from one node to another? Other features that would be missing that we routinely use are `zeekctl print` and `zeekctl exec`. I'm assuming `zeekcl` would be running in some uber-bare mode if it's written in Zeek?</div><div><br></div><div> --Vlad<br></div><div><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 18, 2020 at 2:15 AM Jon Siwek <<a href="mailto:jsiwek@corelight.com" target="_blank">jsiwek@corelight.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Don't recall any basic "project infrastructure" discussions happening<br>
yet for the upcoming replacement/alternative for ZeekControl that we<br>
want to introduce in Zeek 3.2 (roadmap/design links found at [1]), so<br>
here's starting questions.<br>
<br>
# What to Name It ?<br>
<br>
Suggestion: `zeekcl`, Zeek (Command-Line) CLlient.<br>
<br>
Open to ideas, but will use `zeekcl` below.<br>
<br>
# What Programming Language ?<br>
<br>
`zeekcl` has different/narrower scope than ZeekControl. It's more<br>
clearly a "client" with sole job of handling requests/responses via<br>
Broker without many (any?) system-level operations/integrations.<br>
Meaning there may be less of an approachability/convenience gap<br>
between C++ versus Python with `zeekcl` than there was with<br>
ZeekControl.<br>
<br>
Also nice if `zeekcl` doesn't require more dependencies beyond what<br>
`zeek` needs since they're expected to be used together.<br>
<br>
Is use of Python still desirable for other reasons? Otherwise, I lean<br>
towards `zeekcl` being C++.<br>
<br>
For reference/sanity-check in terms of what people expect `zeekcl` to<br>
be: in my testing of the SupervisorControl framework [2], I had a<br>
sloppy Zeek script implementing the full "client side" (essentially<br>
the majority of what `zeekcl` will do) in ~100 LOC. Most operations<br>
are that simple: send request and display response.<br>
<br>
That does mean the third option to consider besides either Python or<br>
C++ is Zeek's scripting language (e.g. `ctl.zeek`), but I don't<br>
suggest that since (1) using a full `zeek` process is way more than we<br>
need and (2) the command-line interface is awkward (`zeek ctl<br>
Supervisor::cmd="status"` versus `zeekcl status`)<br>
<br>
# Where's the Source Code Live ?<br>
<br>
Past experiences with ZeekControl being in a separate repo than Zeek<br>
are negative in terms of CI/testing: changes in Zeek have broken<br>
ZeekControl, but go uncaught for a while since it is tested<br>
independently.<br>
<br>
Since common use/maintenance will involve both `zeek` and `zeekcl`,<br>
and also don't expect the later to accrue large amounts of code<br>
deserving of a separate project, I plan to have `zeekcl` code/tests<br>
live inside the main Zeek repo.<br>
<br>
- Jon<br>
<br>
[1] <a href="https://github.com/zeek/zeek/issues/582" rel="noreferrer" target="_blank">https://github.com/zeek/zeek/issues/582</a><br>
[2] <a href="https://github.com/zeek/zeek/blob/689a242836092fba7818ba24724b74a7a7902e48/scripts/base/frameworks/supervisor/control.zeek" rel="noreferrer" target="_blank">https://github.com/zeek/zeek/blob/689a242836092fba7818ba24724b74a7a7902e48/scripts/base/frameworks/supervisor/control.zeek</a><br>
_______________________________________________<br>
Zeek-Dev mailing list<br>
<a href="mailto:Zeek-Dev@zeek.org" target="_blank">Zeek-Dev@zeek.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek-dev" rel="noreferrer" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek-dev</a><br>
</blockquote></div>
</div>