Where Does Zeek Store Config and Logs?
Zeek install prefix with node config, site scripts and logs.
Last updated
Zeek anchors everything under an install prefix. Node config plus site scripts live in etc and share beneath it. Logs rotate under the prefix by date.
Binary versus source builds choose different roots. Local site file survives upgrades deliberately. Keep etc plus site together.
Where Zeek stores this, by platform
/opt/zeek/etc/node.cfg
Prefix anchored node config with site-local scripts that survive upgrades. Date-rotated logs beneath. Binary versus source roots differ.
Frequently asked questions
How do I back up Zeek?
Copy the etc tree plus site scripts with Zeek stopped. Logs rotate beneath the prefix and need no backup. Restoring means putting etc back before start.
Which prefix is live?
Binary packages root at opt while source builds use local share trees. Site-local script stays put across upgrades by design. Match the running prefix before scripting.
Notice an outdated path? Let us know.