Bug #11461


zeek package - Web Interface does not display any log content Package/Zeek/Alerts/Real Time Inspection

Added by Felix S over 3 years ago. Updated over 2 years ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:


Pfsense 2.5.0 - Release, Zeek 3.0.6_1
Confirmed that zeek is working properly by inspecting process list as well as ensuring that logs are written and available in /usr/local/logs/current.

However, the web interface does not show any log contents when selecting any of the logs (Package/Zeek/Alerts/Real Time Inspection) in the drop down menu.

Actions #1

Updated by Felix S over 3 years ago

Further investigation seems to show that the web gui is leveraging zeek_alert_data.php for getting the data. However, this references /usr/local/spool/zeek/ for the log files while they are actually located in /usr/local/logs/current.

So the solution would be to correct the path for $log in zeek_alert_data.php or otherwise perform changes in the zeek configuration that the logs end up in the directory /usr/local/spool/zeek/.

Actions #2

Updated by Felix S over 3 years ago

Further problems identified in the zeek_alerts.php:
The content is updated every 10 seconds however, the results in the current log file selection are being discarded and hence no logs are displayed anymore.
A solution might be to leverage the php code from suricata_alerts.php to implement the same sort of filtering capability as well as updating the content in the web gui from changes in the log file.

Actions #4

Updated by Jim Pingle about 3 years ago

  • Status changed from New to Pull Request Review
Actions #5

Updated by Renato Botelho about 3 years ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Renato Botelho

PR has been merged to 2.5.1, 2.5.2-RC and 2.6.0-DEVELOPMENT. Thanks!

Actions #6

Updated by Alhusein Zawi over 2 years ago

the web interface shows Logs.

2.6.0-RELEASE (amd64)
built on Tue Jan 25 19:18:35 UTC 2022

Actions #7

Updated by Viktor Gurov over 2 years ago

  • Status changed from Feedback to Resolved
  • Affected Version deleted (2.5.x)

Also available in: Atom PDF