easybutton-singlehost fails compiling moloch-capture

[cclements]

Hi, sorry if this has been reported before, but I can't get easybutton-singlehost to compile moloch-capture:

root@auditor1 ~/t/g/moloch# ./easybutton-singlehost.sh Looking for java /usr/bin/java Use pfring? ('yes' enables) [no] no ./easybutton-build.sh --dir /data/moloch MOLOCH: Installing Dependencies Reading package lists... Done Building dependency tree
Reading state information... Done Note, selecting 'libpng12-dev' instead of 'libpng-dev' bison is already the newest version. flex is already the newest version. g++ is already the newest version. gettext is already the newest version. libbz2-dev is already the newest version. libffi-dev is already the newest version. libgeoip-dev is already the newest version. libjson-perl is already the newest version. libpcre3-dev is already the newest version. libpng12-dev is already the newest version. libwww-perl is already the newest version. make is already the newest version. pkg-config is already the newest version. uuid-dev is already the newest version. wget is already the newest version. xz-utils is already the newest version. zlib1g-dev is already the newest version. curl is already the newest version. libmagic-dev is already the newest version. 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. MOLOCH: Downloading and building static thirdparty libraries MOLOCH: Not rebuilding glib MOLOCH: Not rebuilding yara MOLOCH: Not rebuilding libGeoIP MOLOCH: Not rebuilding libnids MOLOCH: Building capture ./configure --prefix=/data/moloch --with-libnids=thirdparty/libnids-1.24 --with-yara=thirdparty/yara-1.7 --with-GeoIP=thirdparty/GeoIP-1.4.8 --with-glib2=thirdparty/glib-2.34.3 checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... none checking for g++... g++ checking whether we are using the GNU C++ compiler... yes checking whether g++ accepts -g... yes checking dependency style of g++... none checking for main in -lpcre... yes checking for main in -luuid... yes checking for main in -lmagic... yes checking for main in -lrt... yes checking for main in -lnet... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for pfring... no checking for libpcap... yes checking for nl_socket_alloc in -lnl-3... no checking for nl_socket_alloc in -lnl... no checking for nl_handle_alloc in -lnl... no checking for libnids... thirdparty/libnids-1.24 checking for yara... thirdparty/yara-1.7 checking for GeoIP... thirdparty/GeoIP-1.4.8 checking for glib2... thirdparty/glib-2.34.3 configure: creating ./config.status config.status: creating Makefile config.status: creating capture/Makefile config.status: creating capture/plugins/Makefile config.status: creating capture/parsers/Makefile config.status: creating db/Makefile config.status: creating tests/plugins/Makefile config.status: creating viewer/Makefile config.status: creating viewer/version.js config.status: creating capture/molochconfig.h config.status: capture/molochconfig.h is unchanged config.status: executing depfiles commands Makefile:219: warning: overriding commands for target capture/plugins/Makefile' Makefile:217: warning: ignoring old commands for targetcapture/plugins/Makefile' Making all in capture make[1]: Entering directory /root/tools/git/moloch/capture' gcc -fPIC -O2 -ggdb -Wall -Wextra -D_GNU_SOURCE -c main.c db.c nids.c yara.c http.c config.c parsers.c plugins.c field.c trie.c \ -I/usr/include/pcap \ -Ithirdparty -I/root/tools/git/moloch/thirdparty/glib-2.34.3/glib -I/root/tools/git/moloch/thirdparty/glib-2.34.3 -I/root/tools/git/moloch/thirdparty/glib-2.34.3/gmodule -I/root/tools/git/moloch/thirdparty/glib-2.34.3/gobject -I/root/tools/git/moloch/thirdparty/yara-1.7/libyara -I/root/tools/git/moloch/thirdparty/GeoIP-1.4.8/libGeoIP -I/root/tools/git/moloch/thirdparty/libnids-1.24/src nids.c: In function ‘moloch_nids_output_cb’: nids.c:395:13: warning: ignoring return value of ‘ftruncate’, declared with attribute warn_unused_result [-Wunused-result] (void)ftruncate(dumperFd, filelen); ^ nids.c: In function ‘moloch_nids_output_thread’: nids.c:473:17: warning: ignoring return value of ‘ftruncate’, declared with attribute warn_unused_result [-Wunused-result] (void)ftruncate(dumperFd, filelen); ^ gcc -rdynamic -ggdb main.o db.o nids.o yara.o http.o config.o parsers.o plugins.o field.o trie.o -o moloch-capture \ -u g_checksum_update \ -lpcap \ /root/tools/git/moloch/thirdparty/libnids-1.24/src/libnids.a /root/tools/git/moloch/thirdparty/glib-2.34.3/gio/.libs/libgio-2.0.a /root/tools/git/moloch/thirdparty/glib-2.34.3/gobject/.libs/libgobject-2.0.a /root/tools/git/moloch/thirdparty/glib-2.34.3/gthread/.libs/libgthread-2.0.a /root/tools/git/moloch/thirdparty/glib-2.34.3/gmodule/.libs/libgmodule-2.0.a /root/tools/git/moloch/thirdparty/glib-2.34.3/glib/.libs/libglib-2.0.a /root/tools/git/moloch/thirdparty/yara-1.7/libyara/.libs/libyara.a /root/tools/git/moloch/thirdparty/GeoIP-1.4.8/libGeoIP/.libs/libGeoIP.a -lnet -lrt -lmagic -luuid -lpcre thirdparty/http_parser.o thirdparty/js0n.o thirdparty/patricia.o -ldl -lpthread \ -lm -lresolv -lffi -lz nids.o: In functionmoloch_nids_root_init': /root/tools/git/moloch/capture/nids.c:1395: undefined reference to dlt_to_linktype' collect2: error: ld returned 1 exit status make[1]: *** [all] Error 1 make[1]: Leaving directory/root/tools/git/moloch/capture' make: *\ [all-recursive] Error 1 MOLOCH: make failed

[awick]

Hmm, I don't see the "MOLOCH: Building libpcap without pfring" line. You didn't delete the libpcap stuff from easybutton-build did you?

Thanks, Andy

[cclements]

Argh, you are correct. I was trying to compile it with a newer version of pfring. Reinstated that section and all is well again. Sorry for the hassle.