Execsnoop misses libclang-cpp.so.14

Not sure if its a bug, or where to report it. But after installing bcc-tools

  1. /usr/share/bcc/tools/execsnoop was not added to $PATH
  2. When running /usr/share/bcc/tools/execsnoop, I got:
Traceback (most recent call last):
  File "/usr/share/bcc/tools/execsnoop", line 21, in <module>
    from bcc import BPF
  File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 26, in <module>
    from .libbcc import lib, bcc_symbol, bcc_symbol_option, bcc_stacktrace_build_id, _SYM_CB_TYPE
  File "/usr/lib/python3.11/site-packages/bcc/libbcc.py", line 17, in <module>
    lib = ct.CDLL("libbcc.so.0", use_errno=True)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/ctypes/__init__.py", line 376, in __init__
    self._handle = _dlopen(self._name, mode)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
OSError: libclang-cpp.so.14: cannot open shared object file: No such file or directory

Thank you a lot for any help!

On fedora 36 I have to execute that particular command as root or I have to use options to tell it to only monitor my user processes.

Remember that 37 is still in beta and problems should be identified to the development team.

If it’s a binary that users are expected to execute, it probably shouldn’t live in /usr/share/ in the first place. It should live in /usr/bin and so on as per the FHS:

https://www.pathname.com/fhs/pub/fhs-2.3.html

Do you have libclang-cpp.so.14 on your system? It’s provided by the clang-libs package. bcc-tools depends on bcc which does depend on clang-libs, so this file should be available on your system:

$ sudo dnf --release=37 whatprovides '*/libclang-cpp.so.14'
[sudo] password for asinha: 
Last metadata expiration check: 1:13:03 ago on Mon 17 Oct 2022 09:16:35 BST.
clang-libs-14.0.5-1.fc36.x86_64 : Runtime library for clang
Repo        : @System
Matched from:
Filename    : /usr/lib64/libclang-cpp.so.14

clang-libs-14.0.5-6.fc37.i686 : Runtime library for clang
Repo        : fedora
Matched from:
Filename    : /usr/lib/libclang-cpp.so.14

clang-libs-14.0.5-6.fc37.x86_64 : Runtime library for clang
Repo        : fedora
Matched from:
Filename    : /usr/lib64/libclang-cpp.so.14

These are both issues that should be reported to the maintainers:

https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&component=bcc&list_id=12969998&product=Fedora&query_format=advanced

You are getting some outdated information due to file renames. The version of clang in F37 is 15, and the 14 version of the libraries is provided by clang14-libs, but they are no longer in /usr/lib{,64}.

But in any case, this is still a bug in bcc, which needs to look for v15 now.

1 Like