Building sysdig - linux-on-ibm-z/docs GitHub Wiki
Building Sysdig
Below versions of Sysdig are available in respective distributions at the time of creation of these build instructions:
- Ubuntu 20.04 has
0.26.4
- Ubuntu 22.04 has
0.27.1
- Ubuntu 24.04 has
0.36.0
The instructions provided below specify the steps to build Sysdig version 0.38.0 on Linux on IBM Z for following distributions:
- RHEL (8.8, 8.10, 9.2, 9.4)
- Ubuntu (20.04, 22.04, 24.04)
General Notes:
- When following the steps below please use a standard permission user unless otherwise specified.
- A directory
/<source_root>/
will be referred to in these instructions, this is a temporary writable directory anywhere you'd like to place it.
Step 1: Build using script
If you want to build Sysdig using manual steps, go to step 2.
Use the following commands to build Sysdig using the build script. Please make sure you have wget installed.
wget https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Sysdig/0.38.0/build_sysdig.sh
# Run bash build_sysdig.sh
bash build_sysdig.sh [Provide -t option for executing build with tests]
In case of error, check logs for more details or go to Step 2 to follow manual build steps.
Step 2: Install dependencies
export SOURCE_ROOT=/<source_root>/
-
RHEL (8.8, 8.10, 9.2, 9.4)
sudo yum install -y wget tar patch gcc gcc-c++ git bpftool clang cmake pkg-config elfutils-libelf-devel kernel-devel kmod llvm perl
-
Ubuntu (20.04)
sudo apt-get update sudo apt-get install -y git g++ linux-headers-generic cmake libelf-dev pkg-config kmod patch wget
-
Ubuntu (22.04, 24.04)
sudo apt-get update sudo apt-get install -y git g++ linux-headers-generic cmake libelf-dev pkg-config kmod g++-11 clang llvm wget zlib1g patch wget sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 11 sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-11 11
-
Install clang-14 and llvm-14 (For Ubuntu-20.04 only)
cd $SOURCE_ROOT sudo apt-get update sudo apt install -y lsb-release wget software-properties-common gnupg wget https://apt.llvm.org/llvm.sh sed -i 's,add-apt-repository "${REPO_NAME}",add-apt-repository "${REPO_NAME}" -y,g' llvm.sh chmod +x llvm.sh sudo ./llvm.sh 14 rm ./llvm.sh export CC=clang-14 export CXX=clang++-14 sudo ln -sf /usr/bin/clang-14 /usr/bin/clang sudo ln -sf /usr/bin/clang++-14 /usr/bin/clang++ sudo update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config-14 200 sudo update-alternatives --install /usr/bin/llvm-strip llvm-strip /usr/bin/llvm-strip-14 200
-
Install bpftool (For Ubuntu only)
cd $SOURCE_ROOT git clone --recurse-submodules https://github.com/libbpf/bpftool.git cd bpftool && cd src CLANG=Nope make #For Ubuntu 20.04 make #For Ubuntu 22.04, 24.04 sudo make install
Some features uses "skeletons" (feature-clang-bpf-co-re compilation option) which require kernel 5.15 or more recent, to compile bpftool, hence CLANG-flag is set to CLANG=Nope while compiling for Kernel versions < 5.15. Refer to this.
Step 3: Download source code
cd $SOURCE_ROOT
git clone https://github.com/draios/sysdig.git
cd sysdig
git checkout 0.38.0
mkdir build
# For RHEL 9.x and Ubuntu-24.04, due to kernel issues, need to upgrade the drivers
sed -i 's,7.0.0+driver,7.1.0+driver,g' $SOURCE_ROOT/sysdig/cmake/modules/driver.cmake
sed -i 's,9f2a0f14827c0d9d1c3d1abe45b8f074dea531ebeca9859363a92f0d2475757e,ec493d549d7dc6d9a5534e91e0350aa06827f91c7119818d88c22e8a2820f416,g' $SOURCE_ROOT/sysdig/cmake/modules/driver.cmake
Step 4: Configure, build and install Sysdig
Step 4.1: Configure
cd $SOURCE_ROOT/sysdig/build
cmake -DCREATE_TEST_TARGETS=ON -DUSE_BUNDLED_DEPS=ON -DSYSDIG_VERSION=0.38.0 ..
Step 4.2: Build Sysdig
cd $SOURCE_ROOT/sysdig/build
sed -i 's,c-ares.haxx.se/download/,github.com/c-ares/c-ares/releases/download/cares-1_19_1/,g' ./c-ares-prefix/src/c-ares-stamp/download-c-ares.cmake
sed -i 's,c-ares.haxx.se/download/,github.com/c-ares/c-ares/releases/download/cares-1_19_1/,g' ./falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/cmake/modules/cares.cmake
make
sudo make install
Step 5: Insert Sysdig driver module
#Unload any existing module
sudo rmmod scap || true
#Insert Sysdig kernel module
cd $SOURCE_ROOT/sysdig/build/driver/
sudo insmod scap.ko
Step 6: Testing (Optional)
- Some test cases may fail due to big-endian architecture of s390x. Apply patch -
cd $SOURCE_ROOT/sysdig/build/falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs
wget https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Sysdig/0.38.0/patch/sysdig.patch
patch -p1 < sysdig.patch
rm -f sysdig.patch
- To run the whole unit test suite
cd $SOURCE_ROOT/sysdig/build/
make run-unit-test-libsinsp
All the test cases should pass.
Step 7: Validate installation (optional)
-
Validate Sysdig's version
sysdig --version
The output should be:
sysdig version 0.38.0
-
Validate sysdig and csysdig binaries
sudo /usr/local/bin/sysdig sudo /usr/local/bin/csysdig
Note:
- Refer to this for more information on running Sysdig as a non-root user.