https://github.com/osquery/osquery logo
Title
n

Nico

06/29/2021, 8:32 AM
Hi everyone. I have a newbie question about creating a table. I followed the instructions to create a simple uptime table (I called test). At the end of the building process, I got this error : no rule to build the target " ../specs/test.table", needed for "specs/native/test.cpp". I created 2 files : test.table file and put it in osquery/specs/linux/; and test.cpp and put it in osquery/osquery/tables/utility/. I also added : test.cpp line in the function generateTablesUtilityUtilitytable() in osquery/osquery/tables/utility/CMakeLists.txt; and added android.table line in the function generateNativeTables() in osquery/specs/CMakeLists.txt. I don't see where is the problem here. Why the rule is not found?
s

Stefano Bonicatti

06/29/2021, 9:13 AM
Can you show the full build error log? Then, you talk about a
test.table
but also an
android.table
and, by the description, it seems you haven't put both in all the same places? Or it's just a "typo" and they are the same table?
Also you say that you added the table in generateNativeTables, but where exactly? Can you show us the code?
s

seph

06/29/2021, 10:22 AM
TBH I always grep the code base for another table to make sure I get all the cmake corrections.
👍 1
n

Nico

06/29/2021, 11:12 AM
Ok thanks for the advice, I think I will do this afterward
Sorry, it is in french
Yes there is no android.table at all, I made of mistake. Just 2 files : osquery/specs/linux/test.table and osquery/osquery/tables/utility/test.cpp
s

Stefano Bonicatti

06/29/2021, 11:28 AM
Ah I see now. The table doesn't have the correct path. Putting only the name it means the path prefixed to it is the folder where the CMakeLists.txt currently resides, so under the
specs
folder, but the table is under
specs/linux
. So you should put it as
linux/test.table
. Additionally, that table is not really platform independent, so you might want to put it in the Linux branch below
👌 1
I guess we should be adding a check that verifies that a file exists at that path, to avoid having an error much later
Sorry with "Linux branch" I mean, in the
platform_dependent_spec_files
variable, with the format you can see we use for the other tables that are Linux only.
n

Nico

06/29/2021, 11:36 AM
Ok I see. So I put it in platform_dependent_spec_files() like this "linux/test.table:linux" in the file osquery/specs/CMakeLists.txt
s

Stefano Bonicatti

06/29/2021, 11:37 AM
yes! :)
n

Nico

06/29/2021, 11:37 AM
I m building now. Thank you for the quick answers !
Now I have this error message : "Table description must end with a period !"
s

Stefano Bonicatti

06/29/2021, 12:06 PM
Yeah that's referred to the content of the test.table file
n

Nico

06/29/2021, 12:12 PM
Ok
It is fine now but I had to start from an existing table and I modified it. I still don't know why I got the last errors. Thank you @Stefano Bonicatti and @seph
s

Stefano Bonicatti

06/29/2021, 1:46 PM
The description of the table, "My first table" was missing a final period/dot. Should've been "My first table."
👿 1
n

Nico

06/29/2021, 1:48 PM
Ok ! That's evil!!
s

seph

06/29/2021, 1:49 PM
Evil? It’s meant to be english… Is there a way the error should have been clearer?
n

Nico

06/29/2021, 1:54 PM
I meant this was really tricky, or "the devil is in the detail"
s

seph

06/29/2021, 1:57 PM
Ah, yes… I always end up looking up a prior works so I remember all the details.