Support for Centos

[bigZeroEndian]

Please consider supporting Centos 7/8.

Provide instruction to build from source against Centos or binary (rpm) for this distribution.

Thanks.

[RiotNrrrd]

I know it's not CentOS 7 or 8, but I got Procmon for Linux to build on Fedora 33.

Unfortunately it crashes pretty quickly.

[root@Fedora33 Procmon-for-Linux]# ls -l build/procmon
-rwxr-xr-x 1 root root 103M Dec 27 00:56 build/procmon*

[root@Fedora33 Procmon-for-Linux]# file build/procmon
build/procmon: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=cf51014b9bbd597ebfc8b599941c50747cdf7e4b, for GNU/Linux 3.2.0, with debug_info, not stripped, too many notes (256)

[root@Fedora33 Procmon-for-Linux]# gdb build/procmon
GNU gdb (GDB) Fedora 10.1-2.fc33
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from build/procmon...
(gdb) run
Starting program: /root/src/Procmon-for-Linux/build/procmon 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
: CommandLine Error: Option 'no-x86-call-frame-opt' registered more than once!
LLVM ERROR: inconsistency in registered CommandLine options

Program received signal SIGABRT, Aborted.
__GI_raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:49
49	  return ret;

(gdb) bt
#0  __GI_raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  0x00007ffff4d9a8a4 in __GI_abort () at abort.c:79
#2  0x00000000022c01ca in llvm::report_fatal_error(llvm::Twine const&, bool) ()
#3  0x00000000022c02fa in llvm::report_fatal_error(char const*, bool) ()
#4  0x00000000022abf84 in (anonymous namespace)::CommandLineParser::addOption(llvm::cl::Option*, llvm::cl::SubCommand*) ()
#5  0x00000000022ac183 in llvm::cl::Option::addArgument() ()
#6  0x00000000006e2f55 in _GLOBAL__sub_I_X86CallFrameOptimization.cpp ()
#7  0x00000000023cf91d in __libc_csu_init ()
#8  0x00007ffff4d9c12e in __libc_start_main (main=0x74d0f8 <main(int, char**)>, argc=1, argv=0x7fffffffe368, init=0x23cf8d0 <__libc_csu_init>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe358)`
       at ../csu/libc-start.c:270
#9  0x000000000074cf8e in _start ()
(gdb) 

🤷

[RiotNrrrd]

Update:

I made this small change and now it runs, but it doesn't seem to do anything.

The banner comes up but if I run it with -p to attach it to a running persistent process, I get no output.

[root@Fedora33 build]# diff -rC 1 CMakeCache.txt.dist CMakeCache.txt
*** CMakeCache.txt.dist	2020-12-27 01:29:20.515116300 -0800
--- CMakeCache.txt	        2020-12-27 01:45:45.961636962 -0800
***************
*** 384,386 ****
  //Enable linking LLVM as a shared library
! ENABLE_LLVM_SHARED:BOOL=OFF
  
--- 384,386 ----
  //Enable linking LLVM as a shared library
! ENABLE_LLVM_SHARED:BOOL=ON

But hey, at least it prints the help message!

[root@Fedora33 build]# uname -a
Linux Fedora33 5.8.18-300.fc33.x86_64 #1 SMP Mon Nov 2 19:09:05 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[root@Fedora33 build]# cat /etc/fedora-release
Fedora release 33 (Thirty Three)

[root@Fedora33 build]# ./procmon -h
procmon [OPTIONS...]
   OPTIONS
      -h/--help                Prints this help screen
      -p/--pids                Comma separated list of process ids to monitor
      -e/--events              Comma separated list of system calls to monitor
      -c/--collect [FILEPATH]  Option to start Procmon in a headless mode
      -f/--file FILEPATH       Open a Procmon trace file

Maybe this will help someone else. BTW this is using LLVM 11.0 on Fedora 33.

[damirdev]

@RiotNrrrd - thx for advice with llvm!
I'm also tried build & run procmon on fedora 33. Can't build bcc from sources (clang issues). I have installed bcc using dnf sudo dnf install bcc bcc-devel.
Logging procmon to file doesn't work (0 events, empty sqlite database), but without file option some events logged:

Export logs to file (F6) doesn't work.
Also some warnings in terminal:

./procmon -p 743932
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from ./include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:76:
include/linux/compiler-clang.h:43:9: warning: '__HAVE_BUILTIN_BSWAP32__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP32__
        ^
<command line>:4:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP32__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from ./include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:76:
include/linux/compiler-clang.h:44:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP64__
        ^
<command line>:5:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP64__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from ./include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:76:
include/linux/compiler-clang.h:45:9: warning: '__HAVE_BUILTIN_BSWAP16__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP16__
        ^
<command line>:3:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP16__ 1
        ^
3 warnings generated.

[damirdev]

Just now another capture to file worked successfully (another program).

[MarioHewardt]

We are reworking procmon a bit to be able to more easily support new distros. We are well on our way to getting it enabled. Stay tuned.

[MarioHewardt]

Duplicate of #70