Compile packetbeat on Centos6.8

meng_liu · July 16, 2019, 3:50am

I have installed libpcap in Centos6.8, but when i compile packetbeat, it occurs a error, as flows:

go build -i -ldflags "-X github.com/elastic/beats/libbeat/version.buildTime=2019-07-16T03:40:29Z -X github.com/elastic/beats/libbeat/version.commit=72291e21ce9b6b6fb4fc8320d2d4be24e22bf20b"
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
../vendor/github.com/tsg/gopacket/pcap/pcap_poll_linux.go:22:34: could not determine kind of name for C.TPACKET_V3
make: *** [packetbeat] Error 2

Michal_Pristas · July 16, 2019, 9:15am

do you have libpcap present ?

meng_liu · July 16, 2019, 9:18am

I have installed libpcap1.5.3 in Centos6.8! But i am very confused about this error!

[root@9861b46f9fee /]# find / -name "libpcap.*"
/usr/local/lib/libpcap.so.1.5.3
/usr/local/lib/libpcap.so.1
/usr/local/lib/libpcap.a
/usr/local/lib/libpcap.so
/root/libpcap-1.5.3/libpcap.so.1.5.3
/root/libpcap-1.5.3/Win32/Prj/libpcap.dsw
/root/libpcap-1.5.3/Win32/Prj/libpcap.dsp
/root/libpcap-1.5.3/libpcap.a

Michal_Pristas · July 16, 2019, 9:27am

it is indeed weird. have you by any chance modified sources?
the error suggests that it does not know TPACKET_V3 struct which is part of pcap. so there's either a code error, or maybe a version mismatch.

try installing libpcap 0.8

meng_liu · July 16, 2019, 10:18am

But it doesn't work! I have installed libpcap 0.8.1:

Errors:

go build -i -ldflags "-X github.com/elastic/beats/libbeat/version.buildTime=2019-07-16T10:05:02Z -X github.com/elastic/beats/libbeat/version.commit=07ed6f1cd32d774b4470d55512fe06c57ec589cd"
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
../vendor/github.com/tsg/gopacket/pcap/pcap.go:609:29: could not determine kind of name for C.PCAP_D_IN
../vendor/github.com/tsg/gopacket/pcap/pcap.go:611:29: could not determine kind of name for C.PCAP_D_INOUT
../vendor/github.com/tsg/gopacket/pcap/pcap.go:610:29: could not determine kind of name for C.PCAP_D_OUT
../vendor/github.com/tsg/gopacket/pcap/pcap.go:296:19: could not determine kind of name for C.PCAP_ERROR_ACTIVATED
../vendor/github.com/tsg/gopacket/pcap/pcap.go:300:19: could not determine kind of name for C.PCAP_ERROR_IFACE_NOT_UP
../vendor/github.com/tsg/gopacket/pcap/pcap.go:298:19: could not determine kind of name for C.PCAP_ERROR_NO_SUCH_DEVICE
../vendor/github.com/tsg/gopacket/pcap/pcap.go:299:19: could not determine kind of name for C.PCAP_ERROR_PERM_DENIED
../vendor/github.com/tsg/gopacket/pcap/pcap.go:297:19: could not determine kind of name for C.PCAP_WARNING_PROMISC_NOTSUP
../vendor/github.com/tsg/gopacket/pcap/pcap.go:659:23: could not determine kind of name for C.pcap_activate
../vendor/github.com/tsg/gopacket/pcap/pcap.go:760:19: could not determine kind of name for C.pcap_can_set_rfmon
../vendor/github.com/tsg/gopacket/pcap/pcap.go:687:10: could not determine kind of name for C.pcap_create
../vendor/github.com/tsg/gopacket/pcap/pcap.go:619:44: could not determine kind of name for C.pcap_direction_t
../vendor/github.com/tsg/gopacket/pcap/pcap.go:405:8: could not determine kind of name for C.pcap_free_datalinks
../vendor/github.com/tsg/gopacket/pcap/pcap.go:501:9: could not determine kind of name for C.pcap_offline_filter
../vendor/github.com/tsg/gopacket/pcap/pcap.go:599:11: could not determine kind of name for C.pcap_sendpacket
../vendor/github.com/tsg/gopacket/pcap/pcap.go:776:15: could not determine kind of name for C.pcap_set_buffer_size
../vendor/github.com/tsg/gopacket/pcap/pcap.go:709:15: could not determine kind of name for C.pcap_set_promisc
../vendor/github.com/tsg/gopacket/pcap/pcap.go:768:15: could not determine kind of name for C.pcap_set_rfmon
../vendor/github.com/tsg/gopacket/pcap/pcap.go:696:15: could not determine kind of name for C.pcap_set_snaplen
../vendor/github.com/tsg/gopacket/pcap/pcap.go:720:15: could not determine kind of name for C.pcap_set_timeout
../vendor/github.com/tsg/gopacket/pcap/pcap.go:619:15: could not determine kind of name for C.pcap_setdirection
../vendor/github.com/tsg/gopacket/pcap/pcap.go:644:31: could not determine kind of name for C.pcap_statustostr

gcc errors for preamble:
../vendor/github.com/tsg/gopacket/pcap/pcap.go: In function 'pcap_set_immediate_mode':
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35: error: 'PCAP_ERROR' undeclared (first use in this function)
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35: error: (Each undeclared identifier is reported only once
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35: error: for each function it appears in.)
../vendor/github.com/tsg/gopacket/pcap/pcap.go: In function 'pcap_tstamp_type_name_to_val':
../vendor/github.com/tsg/gopacket/pcap/pcap.go:47: error: 'PCAP_ERROR' undeclared (first use in this function)

make: *** [packetbeat] Error 2

[root@052ead9c9486 usr]# find / -name "pcap*"
/usr/include/pcap.h
/usr/include/pcap-namedb.h
/usr/include/pcap-bpf.h
/usr/man/man3/pcap.3
/root/libpcap-0.8.1/pcap-linux.c
/root/libpcap-0.8.1/pcap.3
/root/libpcap-0.8.1/packaging/pcap.spec
/root/libpcap-0.8.1/packaging/pcap.spec.in
/root/libpcap-0.8.1/pcap-stdinc.h
/root/libpcap-0.8.1/pcap-win32.c
/root/libpcap-0.8.1/pcap.h
/root/libpcap-0.8.1/pcap-pf.c
/root/libpcap-0.8.1/pcap-bpf.c
/root/libpcap-0.8.1/pcap-dag.c
/root/libpcap-0.8.1/pcap-namedb.h
/root/libpcap-0.8.1/pcap-bpf.h
/root/libpcap-0.8.1/pcap-null.c
/root/libpcap-0.8.1/pcap-pf.h
/root/libpcap-0.8.1/pcap-snoop.c
/root/libpcap-0.8.1/pcap-linux.o
/root/libpcap-0.8.1/pcap-snit.c
/root/libpcap-0.8.1/pcap.c
/root/libpcap-0.8.1/pcap-int.h
/root/libpcap-0.8.1/pcap-enet.c
/root/libpcap-0.8.1/pcap-nit.h
/root/libpcap-0.8.1/pcap-dlpi.c
/root/libpcap-0.8.1/pcap.o
/root/libpcap-0.8.1/pcap-dag.h
/root/libpcap-0.8.1/pcap-nit.c

Michal_Pristas · July 16, 2019, 10:20am

will try to setup the same env as you have, what version of beats are you trying to build. also do you use 32 or 64 bit version of centos.
which version of Go do you use?

Michal_Pristas · July 16, 2019, 12:27pm

ok I guess I know what the problem is. TPACKET_V3 was introduced in kernel 3.2 but centos 6.8 uses kernel version 2.6 so it will not get compiled.
have you tried using prebuilt binary distributed as tar ball, this worked fine for me?

elan · August 6, 2019, 5:39pm

Thanks for the solution

tellthebell

system · September 3, 2019, 5:41pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.