Compiling Zeek-3.1.x using devtoolset-7 to generate a binary package for use in CentOS-7

Development
1

Hi,

We have been using Zeek-3.0.x RPM packages for CentOS-7 which are compiled using spec file derived from zeek src package and they worked well.

Now we are considering upgrading to Zeek-3.1.x but that requires newer GCC compilers. We tried to use devtoolset-7 on the compiling machine to generate packages. The packages were generated successfully but when we tried to run them on our CentOS-7 sensors, we had the following error

zeekctl status

Error: running “zeek -v” failed with output:
/opt/zeek/bin/zeek: symbol lookup error: /opt/zeek/bin/zeek: undefined symbol: _ZdlPvm

The linked libraries are

ldd /opt/zeek/bin/zeek

linux-vdso.so.1 => (0x00007ffe73b7c000)
libbinpac.so.0 => not found
libpcap.so.1 => /lib64/libpcap.so.1 (0x00007feab99db000)
libssl.so.10 => /lib64/libssl.so.10 (0x00007feab9769000)
libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007feab9306000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00007feab90ed000)
libz.so.1 => /lib64/libz.so.1 (0x00007feab8ed7000)
libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007feab8bee000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007feab89d2000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007feab87ce000)
libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007feab84c6000)
libm.so.6 => /lib64/libm.so.6 (0x00007feab81c4000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007feab7fae000)
libc.so.6 => /lib64/libc.so.6 (0x00007feab7be0000)
/lib64/ld-linux-x86-64.so.2 (0x00007feab9c1c000)
libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007feab7993000)
libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007feab778f000)
libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007feab755c000)
libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007feab734c000)
libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007feab7148000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x00007feab6f21000)
libpcre.so.1 => /lib64/libpcre.so.1 (0x00007feab6cbf000)

How do we get Zeek-3.1.x to run from RPM packages on CentOS-7? I already tried installing devtoolset-7 on the sensor but that didn’t work. Any help will be appreciated.

Regards,
Dheeraj

2

Hi,

I have no clue why your specific error happens - a few bugs on the Internet indicate some OS/compiler incompatibilities.

That being said - my suggestion is to try using devtoolset-6. The compilers in it are still new enough to compile Zeek 3.1, we use it for the packages that we distribute - and it seems to work.

Johanna

3

Hi,

Thanks for your reply.

As it turns out, I had some packaging issue so that all packages were not updated. After deploying new packages, the libbinpac.so of old 3.0.x line was still in use and that led to a conflict as it was compiled with GCC-4.8

Reinstalling all the packages led to new libbinpac.so being picked up and the issue disappeared. Zeek-3.1.1 compiled with devtoolset-7 is functioning on CentOS-7.

Thanks again,
Dheeraj