我在机器A上编译suricata成功,且在机器A上能正常运行suricata;如果把在机器A上编译的suricata拷贝到机器B上运行,就会报错:Illegal instruction。这让我百思不得其解,随后上网苦找了一番资料,介绍“Illegal instruction”错误的文章也不少,其中有一点说到了我这种情况,那就是CPU架构选择的选项“-march”。
于是我查看了下我编译suricata时的选项,其中并没有指定-march选项,随后我又关注了make时的日志,下面是部分日志:
gcc -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/usr/include -I/usr/include/nspr -I/usr/include/nss/ -I/usr/local/include/luajit-2.0/ -DLOCAL_STATE_DIR=\"/var\" -O2 -DRELEASE -Wextra -Werror-implicit-function-declaration -D_GNU_SOURCE -fno-tree-pre -Wall -fno-strict-aliasing -Wno-unused-parameter -std=gnu99 -march=native -DNFQ -DHAVE_LIBNET11 -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DHAVE_LIBCAP_NG -MT alert-unified2-alert.o -MD -MP -MF .deps/alert-unified2-alert.Tpo -c -o alert-unified2-alert.o alert-unified2-alert.c
mv -f .deps/alert-unified2-alert.Tpo .deps/alert-unified2-alert.Po
gcc -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/usr/include -I/usr/include/nspr -I/usr/include/nss/ -I/usr/local/include/luajit-2.0/ -DLOCAL_STATE_DIR=\"/var\" -O2 -DRELEASE -Wextra -Werror-implicit-function-declaration -D_GNU_SOURCE -fno-tree-pre -Wall -fno-strict-aliasing -Wno-unused-parameter -std=gnu99 -march=native -DNFQ -DHAVE_LIBNET11 -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DHAVE_LIBCAP_NG -MT app-layer.o -MD -MP -MF .deps/app-layer.Tpo -c -o app-layer.o app-layer.c
mv -f .deps/app-layer.Tpo .deps/app-layer.Po
gcc -DHAVE_CONFIG_H -I. -I.. -I../libhtp -I/usr/include -I/usr/include/nspr -I/usr/include/nss/ -I/usr/local/include/luajit-2.0/ -DLOCAL_STATE_DIR=\"/var\" -O2 -DRELEASE -Wextra -Werror-implicit-function-declaration -D_GNU_SOURCE -fno-tree-pre -Wall -fno-strict-aliasing -Wno-unused-parameter -std=gnu99 -march=native -DNFQ -DHAVE_LIBNET11 -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I/usr/include -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DHAVE_LIBCAP_NG -MT app-layer-dcerpc.o -MD -MP -MF .deps/app-layer-dcerpc.Tpo -c -o app-layer-dcerpc.o app-layer-dcerpc.c
mv -f .deps/app-layer-dcerpc.Tpo .deps/app-layer-dcerpc.Po
其中就指定-march=native,而该选项的意思是: ‘native’