Hey folks 👋 , I'm new around here, so please forgive me if I'm not posting in the right place. I'm trying to build osquery locally on a Mac (Apple silicon chip, on MacOS 15.1), specifically to be able to experiment a bit with how the

homebrew_packages

table is being populated . I am able to build and run osquery, without much trouble, with these steps:

cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=15.1 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .. 
cmake --build . -j $(sysctl -n hw.ncpu)

I'm then running the daemon with

sudo ./osquery/osqueryd --allow-unsafe 
I1110 16:14:50.047987 -423413696 eventfactory.cpp:156] Event publisher not enabled: endpointsecurity: EndpointSecurity is disabled via configuration
I1110 16:14:50.048516 -423413696 eventfactory.cpp:156] Event publisher not enabled: endpointsecurity_fim: EndpointSecurity is disabled via configuration
I1110 16:14:50.048527 -423413696 eventfactory.cpp:156] Event publisher not enabled: openbsm: Publisher disabled via configuration
I1110 16:14:50.048534 -423413696 eventfactory.cpp:156] Event publisher not enabled: scnetwork: Publisher not used
I1110 16:14:50.048542 -423413696 eventfactory.cpp:156] Event publisher not enabled: event_tapping: Publisher disabled via configuration

and running the shell with

./osquery/osqueryi
Using a virtual database. Need help, type '.help'
osquery>

Unfortunately, when querying the DB, the

homebrew_packages

table is empty, where the

apps

table, for example, is fully populated:

osquery> select count(*) from homebrew_packages;
+----------+
| count(*) |
+----------+
| 0        |
+----------+
osquery> select count(*) from apps;
+----------+
| count(*) |
+----------+
| 523      |
+----------+

I probably did miss a step, either at compile time, or some configuration at runtime, but I can't find the info in the docs 😢

That seems more an issue with the table itself; the table searches these two prefixes on the filesystem:

const std::set<std::string> kHomebrewPrefixes = {
    "/usr/local",
    "/opt/homebrew",
};

You can also run the shell with

--verbose

to see if additional information is printed out

Ok, thanks, I actually got it working with the unmodified version of the code facepalm . So my changes were breaking the

homebrew_packages.cpp

file, but silently. Is there any easy way to add debugging / logging output when iterating quickly on the codebase ? Thanks

If you see the table is using

TLOG

, it's an "alias" for

VLOG(1)