How to build Bro on RH 67 (instructions)

Zeek
1

Since RH67 does not support a c++11 compiler by default, you have to do several things to build the PF_RING plugin, and bro itself. These are the step by step instructions needed.

  1. sudo rpm --import http://ftp.scientificlinux.org/linux/scientific/5x/x86_64/RPM-GPG-KEYs/RPM-GPG-KEY-cern

  2. wget -O /etc/yum.repos.d/slc6-devtoolset.repo http://linuxsoft.cern.ch/cern/devtoolset/slc6-devtoolset.repo

  3. sudo yum install devtoolset-2 (This is a LOT of packages, be prepared to wait a while. This deployed something like 300 packages to my system)

  4. Pull bro

  5. export “CMAKE_CXX_COMPILER=/opt/rh/devtoolset-2/root/usr/bin/g++”

  6. sh configure (with what you need)

  7. make && make install

  8. cd aux/plugins/pf_ring/build

  9. mv CMakeCache.txt CMakeCache.txt.out

  10. cd CMakeFiles && mv 2.8.12.2 2.8.12.2.out

  11. cd …/…/ && sh configure --with-pfring=$yourpfringhere

I was able to perform this repeatedly. You MUST compile all parts of this with the devtoolset, or you will get segfaults and all sorts of things. This means I had to build pfring, geoip pe_xor with the devtoolset before I could build bro.

Note: Shamelessly stole two steps from https://gist.github.com/stephenturner/e3bc5cfacc2dc67eca8b for installing devtoolset-2.

Erik

2

Excellent answer!

Can we have that included in official bro documentation?
Like it or not, RHEL 6 is not going anywhere for a while. Also shows how to build packages on any other old system, granted that you can get an new toolchain.