Skip to content

Build

Prerequisites

  • Rust 2024 edition (1.85+)
  • For Windows cross-compilation from Linux: cargo install cargo-xwin (auto-downloads Windows SDK)

Linux / macOS

# Build the Linux binary
cargo build --release -p sigmacatch-lnx

# Lint
cargo clippy -- -W warnings

Produces sigmacatch-linux (default features auditd + builtin). It runs, in parallel, the auditd collector when /var/log/audit/audit.log exists and the builtin syslog collectors (every existing file among central /var/log/messages, /var/log/syslog; authpriv /var/log/secure, /var/log/auth.log; cron /var/log/cron, /var/log/cron.log). No Sysmon source: the -sysmon and -ebpf flavour binaries add it (see below). Bail at startup if no source is found. Full specification of the three collectors: architecture.md.

The two extended Linux flavours additionally embed a Sysmon source, selected by cargo feature:

cargo build --release -p sigmacatch-lnx --no-default-features --features auditd,builtin,sysmon  # sigmacatch-linux-sysmon
cargo build --release -p sigmacatch-lnx --no-default-features --features auditd,builtin,ebpf   # sigmacatch-linux-ebpf (root/CAP_BPF+CAP_PERFMON required)

On Linux/macOS the Windows collectors are no-op stubs — the pipeline still runs end-to-end for testing (cargo build -p sigmacatch-win).

Windows

cargo build --release -p sigmacatch-win

One binary is produced with the Winevt collector (feature winevt, enabled by default):

  • sigmacatch-channel (winevt): native Winevt API (EvtQueryW → EvtNext → EvtRender) on resolved channels. Requires admin rights for Security and System channels.

Isolated build:

# Winevt only
cargo build --release --bin sigmacatch-channel --no-default-features --features winevt

The diagnostic subcommands (check-filter, list-rules) are always compiled into the binary — no extra feature is required. The [[bin]] target requires its collector feature (winevt) via required-features.

Linux equivalent isolated builds:

cargo build --release -p sigmacatch-lnx --no-default-features --features auditd,builtin

Windows cross-compilation (from Linux)

cargo xwin build --release --target x86_64-pc-windows-msvc -p sigmacatch-win

The resulting binary is at target/x86_64-pc-windows-msvc/release/sigmacatch-channel.exe. GitHub Actions CI builds natively on windows-latest.

Binary size

Optimized release build: ~10 MB per binary (observed on the x86_64-pc-windows-msvc cross: sigmacatch-channel.exe ~10.4 MB).

Applied profile:

  • strip = true
  • lto = true
  • codegen-units = 1
  • tokio features: rt, rt-multi-thread, macros, sync, time, signal

Diagnostic subcommands

The check-filter and list-rules subcommands are always compiled into both sigmacatch-channel and sigmacatch-linux — no dedicated cargo feature is required (the tools feature has been removed).

Regression validation (check) is no longer a subcommand: it is the standalone regressiondata-check binary (regressiondata-check), cross-platform, which needs no collector and no extra feature:

# Linux
cargo build --release -p regressiondata-check
# Windows
cargo xwin build --release --target x86_64-pc-windows-msvc -p regressiondata-check

Details and sample output → cli.md.