First time I’m building osquery since endpoint security merged, and I’m running into issues…. This is a Big Sur 11.4 machine, with whatever Xcode came from the apple store.

[ 87%] Building CXX object osquery/events/CMakeFiles/osquery_events.dir/darwin/openbsm.cpp.o
/Users/seph/checkouts/osquery/osquery/osquery/events/darwin/endpointsecurity.cpp:179:35: error: no member named 'global_seq_num' in 'es_message_t'
    ec->global_seq_num = message->global_seq_num;
                         ~~~~~~~  ^
/Users/seph/checkouts/osquery/osquery/osquery/events/darwin/endpointsecurity.cpp:213:57: error: no member named 'cwd' in 'es_event_exec_t'
      ec->cwd = getStringFromToken(&message->event.exec.cwd->path);
                                    ~~~~~~~~~~~~~~~~~~~ ^
2 errors generated.

taking a look, give me a bit

I was building as:

cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.12 ..
cmake --build . -j $(sysctl -n hw.ncpu)

Are you building with just the command line tools, or the full Xcode intall?

Should be the full ones. Pretty sure the dev tools errored out much sooner, so I had to upgrade

(ideas from the 'maybe it will work department') Are you using an older ./build from months ago? Sometimes I find that a

mv ./build ./build2; mkdir build; cd build; cmake ..

sort of thing fixes bugs.

Shouldn’t be, I spun up this Big Sur machine when I started. But it’s an easy thing to try.

Okay, I am downloading 11.4 RC/beta, but my internet is slow today and taking a while

:scratches head: I don’t get it. I rm’ed build and rebuilt. This time it worked. So, clearly some kind of user error. But I’m pretty sure I’d started afresh

I've also encountered this same error when building on a Mac But since Mac ci builds seem to work i assumed it was an issue on my system or something else on my system I tried multiple different SDK types I'm pretty sure I also tried removing the build dir But I will try deleting that again

What version is your Mac? We recently started needing Catalina or later for the builds

Big sur

no member named 'global_seq_num' in 'es_message_t'

I think that field specifically was added in Big Sur, so, this might be an issue of linking or building with Catalina

Okay, I was successfully able to build latest osquery, without any issues, on fresh installs of 10.15 latest (catalina), 11.3.1 (big sur) and 11.5 Beta (11.4 is in RC and apple just kept redirecting me to 11.5). I also tested those with XCode 12.3, 12.4 and 12.5 Beta, and it worked across all versions.