Packetbeat on i586 Alix Board with ArchLinux

Elastic Stack Beats
1

Hello,

I installed ArchLinux on a Alix2d13 Board (http://www.pcengines.ch/alix2d13.htm) which runs with an i586 AMD Geode LX800 CPU. I also configured a bridge with two of the three nics. My goal is to use such devices as taps for capturing traffic with Packetbeat.
Unfortunately I can't install Packetbeat 1.2.1 either from the Arch Aur Repos (https://aur.archlinux.org/packages/packetbeat/) or via source code from the git repo, running make. In both cases a get the same error:

$ make
go build
../libbeat/scripts/Makefile:63: recipe for target 'build' failed
make: *** [build] Illegal instruction (core dumped)

I also tried the Arch Aur Repo with the precompiled binary (https://aur.archlinux.org/packages/packetbeat-bin/) , with this solution I get the following error:
● packetbeat.service - Open Source Real-Time Packet Analyzer
Loaded: loaded (/usr/lib/systemd/system/packetbeat.service; enabled; vendor preset: disabled)
Active: failed (Result: core-dump) since Tue 2016-05-17 13:13:12 CEST; 2s ago
Docs: https://www.elastic.co/guide/en/beats/packetbeat/current
Process: 11461 ExecStart=/usr/bin/packetbeat -c /etc/packetbeat/packetbeat.yml (code=dumped, signal=ILL)
Main PID: 11461 (code=dumped, signal=ILL)

May 17 13:13:12 Bridge systemd[1]: Started Open Source Real-Time Packet Analyzer.
May 17 13:13:12 Bridge systemd[1]: packetbeat.service: Main process exited, code=dumped, status=4/ILL
May 17 13:13:12 Bridge systemd[1]: packetbeat.service: Unit entered failed state.
May 17 13:13:12 Bridge systemd[1]: packetbeat.service: Failed with result 'core-dump'.

Do you have any idea if libbeat/packetbeat is incomatible with the i586 architecture?

Cheers

2

No idea about ArchLinux packages. Did you try to contact the container about the package?

Can you try to run packetbeat on console:

/usr/bin/packetbeat -e -v -c /etc/packetbeat/packetbeat.yml

3

Yepp, it gives the same output:
/usr/bin/packetbeat -e -v -c /etc/packetbeat/packetbeat.yml
Illegal instruction (core dumped)

Until now not but I will do that.

4

Hey @LetMeSurf, I'm the maintainer of the package. :raised_hands:

The -bin packages definitely won't work since those are precompiled against i686 and x64.

I would assume that go can compile programs as long as the language has been compiled for the architecture, so I'm not sure what step may be failing in the go build. The only documentation I found referencing i586 pertains to gccgo which is probably unrelated.

The next step I'd probably try is to get go build to output more verbose messages to try and see why the compilation is failing.

5

Hey Tyler

Thank you for your reply:-)

Unfortunately I wasn't able to get verbose output of go build. I tried to modify the ../libbeat/scripts/Makefile vor getting verbose like:

.PHONY: build
build: $(GOFILES)
go build -v

or

.PHONY: build
build: $(GOFILES)
go build --debug

But this has no inpact on the ouput. Event if I change it to

.PHONY: build
build: $(GOFILES)
go help

I get the same output. Can someone explain me please how to modify the Makefile to get verbose output from go build? Thanks

6

changes to the line build: $(GOFILES) ended in an error like:
make: *** No rule to make target '--debug', needed by 'build'. Stop.

7

Can you please provide the output of go env and go version for this system.

How about just running go build -x -v from the packetbeat directory without any Makefile changes.

$ pwd
/Users/me/go/src/github.com/elastic/beats/packetbeat
$ go build -x -v
8

It seems that there is in generall something wrong with the go installation:

go env
Illegal instruction (core dumped)
$ go version
Illegal instruction (core dumped)
$ cd beats/packetbeat/
$ go build -x -v
Illegal instruction (core dumped)

9

$sudo pacman -S go
warning: go-2:1.6.2-2 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...

Packages (1) go-2:1.6.2-2

Total Installed Size: 160.40 MiB
Net Upgrade Size: 0.00 MiB

:: Proceed with installation? [Y/n] y
(1/1) checking keys in keyring [######################] 100%
(1/1) checking package integrity [######################] 100%
(1/1) loading package files [######################] 100%
(1/1) checking for file conflicts [######################] 100%
(1/1) checking available disk space [######################] 100%
:: Processing package changes...
(1/1) reinstalling go [######################] 100%
/tmp/alpm_u66Q7a/.INSTALL: line 16: 462 Illegal instruction (core dumped) go install std 2> /dev/null
$ go version
Illegal instruction (core dumped)

10

So I crosscompiled go now for the i586 plattform and installed it. When I now run make in the packetbeat folder, I get the following error:

$ make
go build
go tool: no such tool "compile"
../libbeat/scripts/Makefile:63: recipe for target 'build' failed
make: *** [build] Error 3

Has someone and idea how ti fix that?

11

I found the problem, I had to copy the whole go directory, not only the binaries... Finally the compilation of packetbeat worked:-) Now i will install it

12

The boards processor (AMD Geode LX800) seems to be 32bit. Are the ArchLinux packages for go and packetbeat 32bit or 64bit? Did you try to get the 32bit binaries from packetbeat download page?

I see ArchLinux providing packages for i686 and x86_64 only? Is your board well supported by ArchLinux? The boards vendor has a list of supported distributions here.

13

Arch Linux isn't on the list of supported distribtuions. However, I found this article: https://www.reddit.com/r/archlinux/comments/1syd1n/archlinux_on_embedded_devices_help_needed/

"The Alix computers are using an i586-compatible processor, and is missing one instruction in order to be i686-compatible. Fortunately, modern compilers can fix this so that any i686 program will run on these processors."

I was able to install Arch Linux and various software packages without any problem, for example also tcpdump works. After crosscompiling the go toolchain, installing it on the Alix Board and compiling packetbeat, I can run packetbeat now:-)

1 Like