Building sysdig

Building Sysdig

Below versions of Sysdig are available in respective distributions at the time of creation of these build instructions:

• Ubuntu 18.04 has 0.24.1
• Ubuntu 20.04 has 0.26.4
• Ubuntu 21.10 has 0.27.1
• Ubuntu 22.04 has 0.27.1
• SLES 12 SP5 has 0.15.1

The instructions provided below specify the steps to build Sysdig version 0.29.3 on Linux on IBM Z for following distributions:

• RHEL (7.8, 7.9, 8.4, 8.5, 8.6)
• SLES (12 SP5, 15 SP3)
• Ubuntu (18.04, 20.04, 21.10, 22.04)

General Notes:

• When following the steps below please use a standard permission user unless otherwise specified.
• A directory /<source_root>/ will be referred to in these instructions, this is a temporary writable directory anywhere you'd like to place it.

Step 1: Build using script

If you want to build Sysdig using manual steps, go to step 2.

Use the following commands to build Sysdig using the build script. Please make sure you have wget installed.

wget https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Sysdig/0.29.3/build_sysdig.sh

# Run bash build_sysdig.sh 
bash build_sysdig.sh  [Provide -t option for executing build with tests] 

In case of error, check logs for more details or go to Step 2 to follow manual build steps.

Step 2: Install dependencies

  export SOURCE_ROOT=/<source_root>/

• RHEL (7.8, 7.9)

  sudo yum install -y devtoolset-7 devtoolset-7-elfutils-libelf-devel libtool automake curl glibc-static libcurl-devel rh-git227-git.s390x pkgconfig wget patch kernel-devel-$(uname -r) kmod
  
  #switch to GCC 7   
  source /opt/rh/devtoolset-7/enable
  #Enable git 2.27
  source /opt/rh/rh-git227/enable

• RHEL (8.4, 8.5, 8.6)

  sudo yum install -y gcc gcc-c++ git make cmake autoconf automake pkg-config libtool wget patch curl elfutils-libelf-devel kernel-devel-$(uname -r) glibc-static libstdc++-static kmod libarchive openssl-devel

• SLES (12 SP5)

  sudo zypper install -y gcc7 gcc7-c++ git make automake autoconf libtool zlib-devel wget pkg-config curl patch glibc-devel-static libelf-devel "kernel-default-devel=$(uname -r | sed 's/-default//g')" kmod libexpat-devel tcl gettext-tools libcurl-devel tar
  
  #switch to GCC 7
  sudo update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-7 40
  sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-7 40
  sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-7 40
  sudo update-alternatives --install /usr/bin/c++ c++ /usr/bin/g++-7 40

• SLES (15 SP3)

  sudo zypper install -y gcc gcc-c++ git cmake patch automake autoconf libtool wget pkg-config curl glibc-devel-static libelf-devel "kernel-default-devel=$(uname -r | sed 's/-default//g')" kmod libexpat-devel tcl-devel gettext-tools tar libopenssl-devel libcurl-devel

• Ubuntu (18.04, 20.04, 21.10, 22.04)

  sudo apt-get update
  sudo apt-get install -y git cmake build-essential pkg-config autoconf wget curl patch libtool libelf-dev linux-headers-$(uname -r) kmod libz-dev libssl-dev libcurl4-gnutls-dev libexpat1-dev gettext gcc libgrpc++-dev protobuf-compiler-grpc libprotobuf-dev

• Build OpenSSL (Only on RHEL 7.x and SLES 12 SP5)

  cd $SOURCE_ROOT
  wget https://www.openssl.org/source/openssl-1.1.1l.tar.gz --no-check-certificate
  tar -xzf openssl-1.1.1l.tar.gz
  cd openssl-1.1.1l
  ./config --prefix=/usr/local --openssldir=/usr/local
  make
  sudo make install
  
  sudo mkdir -p /usr/local/etc/openssl
  sudo wget https://curl.se/ca/cacert.pem --no-check-certificate -P /usr/local/etc/openssl
  
  LD_LIBRARY_PATH=/usr/local/lib/:/usr/local/lib64/${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
  export LD_LIBRARY_PATH
  export SSL_CERT_FILE=/usr/local/etc/openssl/cacert.pem

• Install CMake v3.20.3 (Only on RHEL 7.x and SLES 12 SP5)

  cd $SOURCE_ROOT
  wget https://github.com/Kitware/CMake/releases/download/v3.20.3/cmake-3.20.3.tar.gz --no-check-certificate
  tar -xvzf cmake-3.20.3.tar.gz
  cd cmake-3.20.3
  ./bootstrap
  make
  sudo make install
  sudo ln -s /usr/local/bin/cmake /usr/bin/cmake  #Only on SLES 12 SP5
  cmake --version

• Install Protobuf v3.17.3 (Only on RHEL and SLES)

  cd $SOURCE_ROOT
  git clone https://github.com/protocolbuffers/protobuf.git
  cd protobuf
  git checkout v3.17.3
  git submodule update --init --recursive
  ./autogen.sh
  ./configure
  make -j$(nproc)
  sudo make install
  sudo ldconfig  #Only on SLES
  export LD_LIBRARY_PATH=/usr/local/lib/:/usr/local/lib64/${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}  #Only on RHEL 8.x
  sudo ln -s /usr/local/lib/libprotobuf.so.28 /usr/lib64/libprotobuf.so.28  #Only on RHEL
  protoc --version

• Install gRPC v1.44.0 (Only on RHEL and SLES)

  cd $SOURCE_ROOT
  git clone --recurse-submodules -b v1.44.0 --depth 1 --shallow-submodules https://github.com/grpc/grpc
  cd grpc 
  mkdir build
  cd build
  cmake -DgRPC_INSTALL=true -DgRPC_BUILD_TESTS=OFF \
          -DgRPC_SSL_PROVIDER=OpenSSL -DgRPC_PROTOBUF_PROVIDER=package \
          -DCMAKE_INSTALL_PREFIX=/usr/local ..
  make -j$(nproc)
  sudo make install

Step 3: Download source code

  cd $SOURCE_ROOT
  git clone https://github.com/draios/sysdig.git
  cd sysdig
  git checkout 0.29.3
  mkdir build

Step 4: Configure, build and install Sysdig

Step 4.1: Configure

  cd $SOURCE_ROOT/sysdig/build
  cmake -DUSE_BUNDLED_PROTOBUF=Off -DUSE_BUNDLED_GRPC=Off \
        -DCREATE_TEST_TARGETS=ON -DSYSDIG_VERSION=0.29.3 ..

• Install googletest 1.12.0 (For All except UBUNTU 18.04)

  cd $SOURCE_ROOT/sysdig/build
  mv googletest-src googletest-src_old
  git clone https://github.com/google/googletest.git
  cd googletest
  git checkout release-1.12.0
  cd ..
  mv googletest googletest-src
  

Step 4.2: Build Sysdig

  make
  sudo make install

Step 5: Insert Sysdig driver module

  #Unload any existing module
  sudo rmmod scap || true
    
  #Insert Sysdig kernel module
  cd $SOURCE_ROOT/sysdig/build/driver/
  sudo insmod scap.ko

Step 6: Testing (Optional)

• To run the whole unit test suite

  cd $SOURCE_ROOT/sysdig/build/
  make run-unit-test-libsinsp

All the test cases should pass.

Step 7: Validate installation (optional)

• Validate Sysdig's version

  sysdig --version

  The output should be:

  sysdig version 0.29.3

• Validate sysdig and csysdig binaries

  sudo /usr/local/bin/sysdig
  sudo /usr/local/bin/csysdig

Note:

• Refer to this for more information on running Sysdig as a non-root user.

Reference:

• http://www.sysdig.com/
• https://github.com/draios/sysdig
• https://github.com/draios/sysdig/wiki/How-to-Install-Sysdig-from-the-Source-Code