Kakfa plugin fails under FreeBSD 13.1 about zeek-kafka HOT 7 OPEN

If you just run zeek -NN does it work?

from zeek-kafka.

Yes. Here it is:
......
Zeek::XMPP - XMPP analyzer (StartTLS only) (built-in)
[Analyzer] XMPP (ANALYZER_XMPP, enabled)
[Event] xmpp_starttls

Zeek::ZIP - Generic ZIP support analyzer (built-in)
[Analyzer] ZIP (enabled)

Corelight::CommunityID - "Community ID" flow hash support in the connection log (dynamic, version 3.2.0)
[Function] CommunityID::hash_conn

Seiso::Kafka - Writes logs to Kafka (dynamic, version 0.3.0)
[Writer] KafkaWriter (Log::WRITER_KAFKAWRITER)
[Constant] Kafka::kafka_conf
[Constant] Kafka::additional_message_values
[Constant] Kafka::topic_name
[Constant] Kafka::max_wait_on_shutdown
[Constant] Kafka::tag_json
[Constant] Kafka::json_timestamps
[Constant] Kafka::debug
[Constant] Kafka::mock
[Event] kafka_topic_resolved_event

Zeek::Netmap - Packet acquisition via Netmap (dynamic, version 1.0.0)
[Packet Source] NetmapReader (interface prefix "netmap"; supports live input)
[Packet Source] NetmapReader (interface prefix "vale"; supports live input)

Also installation goes well:
root@fbsdzeekmgmt:~ # zpkg install zeek/seisollc/zeek-kafka
The following packages will be INSTALLED:
zeek/seisollc/zeek-kafka (v1.0.0)

Verify the following REQUIRED external dependencies:
(Ensure their installation on all relevant systems before proceeding):
from zeek/seisollc/zeek-kafka (v1.0.0):
librdkafka ~1.4.2-RC1

Proceed? [Y/n] y
zeek/seisollc/zeek-kafka asks for LIBRDKAFKA_ROOT (Path to librdkafka installation tree root) ? [/usr/local]
Saved answers to config file: /opt/zeek/etc/zkg/config
Running unit tests for "zeek/seisollc/zeek-kafka"
Installing "zeek/seisollc/zeek-kafka"..............................
Installed "zeek/seisollc/zeek-kafka" (v1.0.0)
Loaded "zeek/seisollc/zeek-kafka"

from zeek-kafka.

I'm at a loss, I don't know, unless it is deployed incorrectly across the cluster I'm not sure why it would fail.
If you can zeek -NN on each of the cluster nodes, then it was deployed correctly. to all nodes.
I'm asking on Slack as you can see there

from zeek-kafka.

Good morning,

One thing: "zeek -NN" only works on the manager but not in the workers:

root@fbsdnsm01:/opt/zeek/lib/zeek/plugins/packages # /opt/zeek/bin/zeek -NN
internal error: Failed to find variable named: Kafka::kafka_conf
Abort
root@fbsdnsm01:/opt/zeek/lib/zeek/plugins/packages #

from zeek-kafka.

@clopmz it looks like you're running an old version of the package, can you attempt an update?

from zeek-kafka.

Hi @JonZeolla ,

Uhmm ... older? Release installed in all zeek workers and manager are 1.8.2 ... According to https://github.com/edenhill/librdkafka/releases, latest release is 1.9.0 released 6 days ago ...

I will try it .... but I have serious doubts that this is it.

from zeek-kafka.

Oops ... sorry ... My zeek-kafka package is release 1.0.0, and 1.1.0-rc1 was released 19 hours ago .....

from zeek-kafka.