Common Logs

This section walks through Zeek’s most popular logs, giving examples of their use. Zeek features many others, including diagnostic ones that report on its internal state. Please refer to the complete reference of logs included in the Zeek distribution, and keep in mind that Zeek packages add many more.

• conn.log
• dns.log
• http.log
• files.log
• ftp.log
• ssl.log
• x509.log
• smtp.log
• ssh.log
• pe.log
• dhcp.log
• ntp.log
• SMB Logs (plus DCE-RPC, Kerberos, NTLM)
• irc.log
• ldap.log and ldap_search.log
• postgresql.log
• quic.log
• rdp.log
• traceroute.log
• tunnel.log
• known_*.log and software.log
• weird.log and notice.log
• DPD & analyzer.log
• capture_loss.log and reporter.log