Title
#general
j

Jshi

11/24/2022, 9:15 AM
I get error when build in MacOS, can anybody know how to fix this? [ 52%] Building CXX object plugins/config/parsers/CMakeFiles/plugins_config_parsers.dir/feature_vectors.cpp.o/Users/shijunyan/Documents/code/osquery/osquery/events/darwin/endpointsecurity.cpp:102:35: error: no member named 'global_seq_num' in 'es_message_t' ec->global_seq_num = message->global_seq_num; ~~~~~~~ ^ 1 error generated. make[2]: * [osquery/events/CMakeFiles/osquery_events.dir/darwin/endpointsecurity.cpp.o] Error 1 make[2]: * Waiting for unfinished jobs.... [ 52%] Building CXX object osquery/tables/utility/CMakeFiles/osquery_tables_utility_utilitytable.dir/file.cpp.o [ 52%] Building CXX object libs/src/aws-sdk-cpp/CMakeFiles/thirdparty_aws-cpp-sdk-ec2.dir/src/aws-sdk-cpp/aws-cpp-sdk-ec2/source/model/CreateInstanceExportTaskResponse.cpp.o [ 52%] Building CXX object plugins/config/parsers/CMakeFiles/plugins_config_parsers.dir/file_paths.cpp.o [ 52%] Building CXX object osquery/carver/CMakeFiles/osquery_carver.dir/carver.cpp.o [ 52%] Building CXX object libs/src/aws-sdk-cpp/CMakeFiles/thirdparty_aws-cpp-sdk-ec2.dir/src/aws-sdk-cpp/aws-cpp-sdk-ec2/source/model/CreateInternetGatewayRequest.cpp.o/Users/shijunyan/Documents/code/osquery/osquery/events/darwin/endpointsecurity_fim.cpp:160:35: error: no member named 'global_seq_num' in 'es_message_t' ec->global_seq_num = message->global_seq_num; ~~~~~~~ ^ 1 error generated. make[2]: * [osquery/events/CMakeFiles/osquery_events.dir/darwin/endpointsecurity_fim.cpp.o] Error 1 make[1]: * [osquery/events/CMakeFiles/osquery_events.dir/all] Error 2 make[1]: * Waiting for unfinished jobs....
s

sharvil

11/24/2022, 1:36 PM
What version of macOS are you building this on?
1:38 PM
You might have to specify
-DCMAKE_OSX_DEPLOYMENT_TARGET=10.14
during the configure step when building..there are more details on how to do this here: https://osquery.readthedocs.io/en/stable/development/building/
j

Jshi

11/25/2022, 12:21 AM
@sharvil Thank you for reply, and this is my configure: cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.14 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Release ..
12:23 AM
And my MacOS is intel and version is Ventura 13.0.1 (22A400) . Is there any more information you need?
12:38 AM
cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.14 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Release .. -- The C compiler identification is AppleClang 12.0.0.12000026 -- The CXX compiler identification is AppleClang 12.0.0.12000026 -- Detecting C compiler ABI info -- Detecting C compiler ABI info - done -- Check for working C compiler: /usr/bin/clang - skipped -- Detecting C compile features -- Detecting C compile features - done -- Detecting CXX compiler ABI info -- Detecting CXX compiler ABI info - done -- Check for working CXX compiler: /usr/bin/clang++ - skipped -- Detecting CXX compile features -- Detecting CXX compile features - done -- The ASM compiler identification is Clang with GNU-like command-line -- Found assembler: /Library/Developer/CommandLineTools/usr/bin/clang -- The OBJCXX compiler identification is AppleClang 12.0.0.12000026 -- Detecting OBJCXX compiler ABI info -- Detecting OBJCXX compiler ABI info - done -- Check for working OBJCXX compiler: /Library/Developer/CommandLineTools/usr/bin/clang++ - skipped -- Found Git: /usr/bin/git (found version "2.24.3 (Apple Git-128)") -- osquery version: 5.6.0-14-ga5bc1a33f -- Found ccache: /usr/local/bin/ccache -- Found clang-format: /usr/local/bin/clang-format -- Found Python3: /usr/local/Frameworks/Python.framework/Versions/3.10/bin/python3.10 (found suitable version "3.10.8", minimum required is "3.5") found components: Interpreter -- Build type: Release -- Shared libraries: OFF -- Importing: source/augeas/gnulib -- Importing: source/augeas -- Importing: source/boost -- Performing Test CMAKE_HAVE_LIBC_PTHREAD -- Performing Test CMAKE_HAVE_LIBC_PTHREAD - Success -- Found Threads: TRUE -- osquery: boost::context is using the fcontext backend -- Importing: source/bzip2 -- Importing: source/gflags -- Importing: source/glog -- Importing: source/googletest -- Found Python: /usr/local/Frameworks/Python.framework/Versions/3.10/bin/python3.10 (found version "3.10.8") found components: Interpreter -- Importing: source/libarchive -- Importing: source/libmagic -- Importing: source/librdkafka -- Importing: source/libxml2 -- Importing: source/linenoise-ng -- Importing: source/lzma -- Importing: source/popt -- Importing: source/rapidjson -- Importing: source/rocksdb -- Importing: source/sleuthkit -- Importing: source/sqlite -- Disabling the SQLite R*Tree module -- Disabling the SQLite FTS extensions -- Importing: source/thrift -- Importing: source/yara -- Importing: source/zlib -- Importing: source/zstd -- Importing formula: formula/openssl CMake Warning (dev) at /Applications/CMake.app/Contents/share/cmake-3.25/Modules/ExternalProject.cmake:3075 (message): The DOWNLOAD_EXTRACT_TIMESTAMP option was not given and policy CMP0135 is not set. The policy's OLD behavior will be used. When using a URL download, the timestamps of extracted files should preferably be that of the time of extraction, otherwise code that depends on the extracted contents might not be rebuilt if the URL changes. The OLD behavior preserves the timestamps from the archive instead, but this is usually not what you want. Update your project to the NEW behavior or specify the DOWNLOAD_EXTRACT_TIMESTAMP option with a value of true to avoid this robustness issue. Call Stack (most recent call first): /Applications/CMake.app/Contents/share/cmake-3.25/Modules/ExternalProject.cmake:4185 (_ep_add_download_command) libraries/cmake/formula/openssl/CMakeLists.txt:194 (ExternalProject_Add) libraries/cmake/formula/openssl/CMakeLists.txt:225 (opensslMain) This warning is for project developers. Use -Wno-dev to suppress it. -- Importing: source/aws-sdk-cpp -- Found cppcheck: /usr/local/bin/cppcheck (found version "2.9") -- cppcheck: Enabled with /usr/local/bin/cppcheck -- Configuring done -- Generating done
12:47 AM
configure have already set but have error when build. But the error still the same.
s

sharvil

11/25/2022, 4:45 AM
Have you downloaded the full Xcode and not just the command line tools?
j

Jshi

11/25/2022, 5:26 AM
Yes, I have download from app store and updated to the newest version 14.1
6:01 AM
Hi, @sharvil! I have just tested in a MacOS with M1. And the same steps that M1 MacOS can build succeed, and the intel MacOS can not and have the problem above.
6:02 AM
Do you require more information about this?
s

sharvil

11/25/2022, 2:39 PM
I am not sure why it builds on M1 but not on Intel, that shouldn’t be the case. I only thing I can think of is making sure xcode path is updated to the full Xcode one, and probably cleaning up the build directory and trying again