Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

hello , i have enabled in the cmakefiles the osquery_logger_kafka to use it with windows , is there a painless way to instruct the cmake to build osqueryd against librdkafka.dll ?

I don't think so.

I'm interpreting "painless" as (1) there's a concrete example of something attempting this, (2) generally the steps for porting a new third-party to build on Windows is straightforward.

There are examples for other third-party migrations, meaning it builds on Linux, the migration means also building on Windows. Do you have a lot of experience in this area?

not realy , but i can port most apps under wine or cygwin. (not the google search type :slightly_smiling_face: ) , i have ~10 years to deal with visual c++ and a lot has changed(dll hell is the same ) . But i have compiled librdkafka from source and added it to a windows build of osquery and it talks to kafka ! . The issue rn is how to make it more standardised in the repo. I mean what is the appropriate approach repo wise  to host librdkafka for windows ?

Awesome, I can definitely help later tonight by providing examples!

You'll have to make a change similar to this: <https://github.com/osquery/osquery/commit/76720bea2fbf307d070ece6b35ba0ba6c568dbd1#diff-2a1baad03b82c00db59052da94d575a5>

First look at the added `libraries/cmake/source_migration/modules/Findthrift.cmake`, you'll have to add a similar one for librdkafka.

Then you'll have to update: <https://github.com/osquery/osquery/blob/master/libraries/cmake/source/librdkafka/CMakeLists.txt> so that it builds on macOS and Windows. Right now it is only building on Linux.

The most difficult step is creating the right `config.h` and storing it alongside: <https://github.com/osquery/osquery/blob/master/libraries/cmake/source/librdkafka/config/config.h>

Here is an example from libmagic: <https://github.com/osquery/osquery/commit/58ea43f53693d7fa95ed775f48c03c7b379a5baa#diff-550d742961671466d104ab3e933c790d>

When the existing config.h was moved into a ./linux/config.h and an equivalent was added for macOS.

I am not sure how librdkafka builds on Windows but you'll most likely need one there too.

greeeeeat , ill get right on it :slightly_smiling_face:

<https://github.com/osquery/osquery/pull/6095> :slightly_smiling_face: