Debugging Tracee

[cdelzotti]

Hello,

While successfully building Tracee with the make command, I've been unsuccessfully trying to run Tracee with a debugger. I'm currently on VSCode with the following configuration:

 "configurations": [
        {
            "name": "Launch Package",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "cwd": "${workspaceRoot}",
            "program": "${workspaceRoot}/cmd/tracee-ebpf/main.go",
            "env": {
                "CGO_LDFLAGS" : "-lelf -lbpf -lz /home/user/tracee/dist/libbpf/libbpf.a",
                "CGO_CFLAGS" : "-I/home/user/tracee/dist/libbpf",
                "GO_ENV_EBPF" : "GOOS=linux CC=clang GOARCH=amd64 CGO_CFLAGS=-I/home/user/tracee/dist/libbpf CGO_LDFLAGS=-lelf -lz /home/user/tracee/dist/libbpf/libbpf.a",
                "GO_ENV_RULES" : "GOOS=linux CC=clang GOARCH=amd64",
                "GO_ARCH" : "amd64",
                "GO_TAGS_EBPF" : "core,ebpf"
            },
            "asRoot": true,
        }
    ]

I filled env variables based on make env result but it doesn't work. It keeps showing these errors :

Build Error: go build -o /home/user/tracee/cmd/tracee-ebpf/__debug_bin -gcflags all=-N -l ./main.go
# command-line-arguments
./main.go:156:10: undefined: ensureCapabilities
./main.go:601:12: undefined: tracee.BPFBundleInjected
./main.go:627:18: undefined: tracee.BPFBundleInjected
./main.go:633:15: cannot assign error to err in multiple assignment (exit status 2)

I saw that there is a section in the documentation called "Setup Development Machine with Vagrant" but it doesn't seem to work due to the ubuntu/impish64 release being unavailable on Vagrant Cloud. Can I replace it with another release ?

[cdelzotti]

Found a related issue allowing debug with delve : #1318

[rafaeldtinoco]

I filled env variables based on make env result but it doesn't work. It keeps showing these errors :

Build Error: go build -o /home/user/tracee/cmd/tracee-ebpf/__debug_bin -gcflags all=-N -l ./main.go
# command-line-arguments
./main.go:156:10: undefined: ensureCapabilities
./main.go:601:12: undefined: tracee.BPFBundleInjected
./main.go:627:18: undefined: tracee.BPFBundleInjected
./main.go:633:15: cannot assign error to err in multiple assignment (exit status 2)

This happens because you're not building with the correct build flags. When you execute the makefile target you will see:

GOOS=linux CC=clang GOARCH=amd64 CGO_CFLAGS="-I/home/rafaeldtinoco/work/ebpf/tracee/dist/libbpf" CGO_LDFLAGS="-lelf -lz /home/rafaeldtinoco/work/ebpf/tracee/dist/libbpf/libbpf.a" go build \
	-tags core,ebpf \
	-ldflags="-w \
		-extldflags \"\" \
		-X main.version=\"v0.8.0-31-gfdc4e7fc\" \
		" \
	-v -o dist/tracee-ebpf \
	./cmd/tracee-ebpf

You need to set "ebpf" tag to golang build cmdline in order to have embedded-ebpf.go file built together (solving your issue).

[cdelzotti]

Thank you very much ! Now it works with Goland 👍

[rafaeldtinoco]

I saw that there is a section in the documentation called "Setup Development Machine with Vagrant" but it doesn't seem to work due to the ubuntu/impish64 release being unavailable on Vagrant Cloud. Can I replace it with another release ?

I believe that was addressed by:

commit cd0db36
Author: Rafael David Tinoco [email protected]
Date: Sun Jul 24 01:45:34 2022

ubuntu: impish is EOL, move things to jammy (LTS) (#2004)

No ?