How to add mongocxx libraries into Osquery

Question

I'm trying to save the result (JSON) of the scheduled query of osqueryd to MongoDB using mongocxx driver within osquery, however I am getting the below error while building the source code using make command

Error : [ 83%] Built target libosquery_testing [ 83%] Linking CXX executable osquery_additional_tests /usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::instance::instance()

referenced by insert_mongo.cpp:27 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:27) /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert (std::__1::basic_string, std::__1::allocator > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::uri::k_default_uri
>>> referenced by view_or_value.hpp:69 (/home/tg1/osquery/include/bsoncxx/string/view_or_value.hpp:69)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::uri::uri(bsoncxx::v_noabi::string::view_or_value)
>>> referenced by insert_mongo.cpp:28 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:28)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::client::client(mongocxx::v_noabi::uri const&,     mongocxx::v_noabi::options::client const&)
>>> referenced by insert_mongo.cpp:28 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:28)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::uri::~uri()
>>> referenced by insert_mongo.cpp:28 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:28)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: bsoncxx::v_noabi::builder::core::core(bool)
>>> referenced by document.hpp:43 (/home/tg1/osquery/include/bsoncxx/builder/stream/document.hpp:43)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::client::database(bsoncxx::v_noabi::string::view_or_value) const &
>>> referenced by client.hpp:239 (/home/tg1/osquery/include/mongocxx/client.hpp:239)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::database::collection(bsoncxx::v_noabi::string::view_or_value) const
>>> referenced by database.hpp:322 (/home/tg1/osquery/include/mongocxx/database.hpp:322)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::database::~database()
>>> referenced by insert_mongo.cpp:32 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:32)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: bsoncxx::v_noabi::builder::core::key_owned(std::__1::basic_string<char,     std::__1::char_traits<char>, std::__1::allocator<char> >)
>>> referenced by key_context.hpp:84 (/home/tg1/osquery/include/bsoncxx/builder/stream/key_context.hpp:84)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: bsoncxx::v_noabi::builder::core::view_document() const
>>> referenced by document.hpp:49 (/home/tg1/osquery/include/bsoncxx/builder/stream/document.hpp:49)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::collection::insert_one    (bsoncxx::v_noabi::view_or_value<bsoncxx::v_noabi::document::view, bsoncxx::v_noabi::document::value>, mongocxx::v_noabi::options::insert const&)
>>> referenced by insert_mongo.cpp:35 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:35)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: bsoncxx::v_noabi::types::value::~value()
>>> referenced by insert_one.hpp:29 (/home/tg1/osquery/include/mongocxx/result/insert_one.hpp:29)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: bsoncxx::v_noabi::document::view::view()
>>> referenced by view_or_value.hpp:51 (/home/tg1/osquery/include/bsoncxx/view_or_value.hpp:51)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::collection::find(bsoncxx::v_noabi::view_or_value<bsoncxx::v_noabi::document::view, bsoncxx::v_noabi::document::value>, mongocxx::v_noabi::options::find const&)
>>> referenced by insert_mongo.cpp:36 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:36)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::cursor::begin()
>>> referenced by insert_mongo.cpp:38 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:38)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::cursor::end()
>>> referenced by insert_mongo.cpp:38 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:38)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::operator!=(mongocxx::v_noabi::cursor::iterator const&,         mongocxx::v_noabi::cursor::iterator const&)
>>> referenced by insert_mongo.cpp:38 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:38)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: mongocxx::v_noabi::cursor::iterator::operator*() const
>>> referenced by insert_mongo.cpp:38 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:38)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert    (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: undefined symbol: bsoncxx::v_noabi::to_json(bsoncxx::v_noabi::document::view,     bsoncxx::v_noabi::ExtendedJsonMode)
>>> referenced by insert_mongo.cpp:39 (/home/tg1/osquery/osquery/logger/plugins/insert_mongo.cpp:39)
>>>               /home/tg1/osquery/build/centos7/cache/llvmcache-6394EFF0D08516CB88568DF6DBFA8D472A356497:(osquery::startInsert        (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&))

/usr/local/osquery/bin/ld.lld: error: too many errors emitted, stopping now (use -error-limit=0 to see all errors)
clang-6.0: error: linker command failed with exit code 1 (use -v to see invocation)
make[3]: *** [osquery/osquery_additional_tests] Error 1
make[2]: *** [osquery/CMakeFiles/osquery_additional_tests.dir/all] Error 2
make[1]: *** [all] Error 2
make: *** [all] Error 2

Can someone help me to figure out how to deal with this...?

After adding the variable in CMakeList.txt I got the following error :                    
-- Dependent library 'mongocxx' installed locally (beware!)
-- Dependent library 'bsoncxx' installed locally (beware!)
[ 83%] Linking CXX executable osquery_additional_tests
/usr/local/osquery/bin/ld.lld: error: undefined symbol:     bsoncxx::v_noabi::builder::core::key_owned(std::__1::basic_string<char,     std::__1::char_traits<char>, std::__1::allocator<char> >)
>>> referenced by key_context.hpp:84     (/home/tg1/osquery/include/bsoncxx/builder/stream/key_context.hpp:84)
>>>                   /home/tg1/osquery/build/centos7/cache/llvmcache-    6394EFF0D08516CB88568DF6DBFA8D472A356497:    (osquery::startInsert(std::__1::basic_string<char,     std::__1::char_traits<char>, std::__1::allocator<char> > const&))
clang-6.0: error: linker command failed with exit code 1 (use -v to see     invocation)
make[3]: *** [osquery/osquery_additional_tests] Error 1
make[2]: *** [osquery/CMakeFiles/osquery_additional_tests.dir/all] Error 2
make[1]: *** [all] Error 2
make: *** [all] Error 2

No way to diagnose this just based on the errors. Can you include the linker invocation: My suspicion is that you have included the mongocxx headers, but not linked to the required libraries. — acm, Jun 28 '18 at 12:20
Hi @acm, I am new to c++ and I am little confused on how to link libraries. I have added ADD_OSQUERY_LINK_ADDITIONAL("mongocxx") ADD_OSQUERY_LINK_ADDITIONAL("bsoncxx") variables in CMakeList.txt — Austin D'souza, Jun 29 '18 at 07:43
Unfortunately, I have no idea what osquery is or what those macros do. Do a verbose build and see if `-lmongocxx` and `-lbsoncxx` show up on the link line. If not, you haven't set it up right. — acm, Jun 29 '18 at 20:31

How to add mongocxx libraries into Osquery

0 Answers0