Skip to main content
Version: v4.14

Build from source

Tenzir uses CMake as build system. Aside from a modern C++20 compiler, you need to ensure availability of the dependencies in the table below.

Deterministic Builds via Nix

We provide a Nix flake to setup an environment in which all dependencies are available. Run nix develop inside the main source directory. You can also delegate the entire build process to Nix by invoking nix build, but be aware that this method does not support incremental builds.


Every release of Tenzir includes an SBOM in SPDX format that lists all dependencies and their versions.

C++ CompilerC++20 requiredTenzir is tested to compile with GCC >= 12.0 and Clang >= 15.0.
CMake>= 3.19Cross-platform tool for building, testing and packaging software.
CAF>= 0.18.7Implementation of the actor model in C++. (Bundled as submodule.)
OpenSSLUtilities for secure networking and cryptography.
FlatBuffers>= 2.0.8Memory-efficient cross-platform serialization library.
Boost>= 1.81.0Required as a general utility library.
Apache Arrow>= 13.0.0Required for in-memory data representation. Must be built with Compute, Filesystem, S3, Zstd and Parquet enabled. For the gcs plugin, GCS needs to be enabled.
re2Required for regular expressione evaluation.
yaml-cpp>= 0.6.2Required for reading YAML configuration files.
simdjson>= 3.1.0Required for high-performance JSON parsing. (Bundled as submodule.)
spdlog>= 1.5Required for logging.
fmt>= 8.1.1Required for formatted text output.
xxHash>= 0.8.0Required for computing fast hash digests.
robin-map>= 0.6.3Fast hash map and hash set using robin hood hashing. (Bundled as subtree.)
fast_float>= 3.2.0Required for parsing floating point numbers. (Bundled as submodule.)
libmaxminddb>= 1.8.0Required for the geoip context.
libpcapRequired for building the pcap plugin.
librdkafkaRequired for building the kafka plugin.
http-parserRequired for building the web plugin.
cppzmqRequired for building the zmq plugin.
pfsRequired for the processes and sockets operators on Linux.
Protocol Buffers>= 1.4.1Required for building the velociraptor plugin.
gRPC>= 1.51Required for building the velociraptor plugin.
rabbitmq-cRequired for building the rabbitmq plugin.
yara>= 4.4.0Required for building the yara plugin.
poetryRequired for building the Python bindings.
DoxygenRequired to build documentation for libtenzir.
PandocRequired to build the manpage for Tenzir.
bash>= 4.0.0Required to run the integration tests.
bats>= 1.8.0Required to run the integration tests.

The minimum specified versions reflect those versions that we use in CI and manual testing. Older versions may still work in select cases.


On macOS, we recommend using Clang from the Homebrew llvm@17 package with the following settings:

export LLVM_PREFIX="$(brew --prefix llvm@17)"
export PATH="${LLVM_PREFIX}/bin:${PATH}"
export CC="${LLVM_PREFIX}/bin/clang"
export CXX="${LLVM_PREFIX}/bin/clang++"
export LDFLAGS="-Wl,-rpath,${LLVM_PREFIX} ${LDFLAGS}"
export CPPFLAGS="-isystem ${LLVM_PREFIX}/include ${CPPFLAGS}"
export CXXFLAGS="-isystem ${LLVM_PREFIX}/include/c++/v1 ${CXXFLAGS}"

Installing via CMake on macOS configures a launchd agent to ~/Library/LaunchAgents/com.tenzir.tenzir.plist. Use launchctl to spawn a node at login:

# To unload the agent, replace 'load' with 'unload'.
launchctl load -w ~/Library/LaunchAgents/com.tenzir.tenzir.plist


Building Tenzir involves the following steps:

Clone the repository recursively:

git clone
cd tenzir
git submodule update --init --recursive -- libtenzir plugins

Configure the build with CMake. For faster builds, we recommend passing -G Ninja to cmake.

cmake -B build
# CMake defaults to a "Debug" build. When performance matters, use "Release"
cmake -B build -DCMAKE_BUILD_TYPE=Release

Optionally, you can use the CMake TUI to visually configure the build:

ccmake build

The source tree also contains a set of CMake presets that combine various configuration options into curated build flavors. You can list them with:

cmake --list-presets

Build the executable:

cmake --build build --target all


After you have built the executable, run the unit and integration tests to verify that your build works as expected:

Run component-level unit tests:

ctest --test-dir build

Run the "black box" integration tests:

cmake --build build --target integration

Run end-to-end integration tests:

cmake --build build --target integration


Install Tenzir system-wide:

cmake --install build

If you prefer to install into a custom install prefix, install with --prefix /path/to/install/prefix.

To remove debug symbols from the installed binaries and libraries, pass --strip.

To install only files relevant for running Tenzir and not for plugin development pass --component Runtime.


In case you want to make changes to your build environment, we recommend deleting the build tree entirely:

rm -rf build

This avoids subtle configuration glitches of transitive dependencies. For example, CMake doesn't disable assertions when switching from a Debug to a Release build, but would do so when starting with a fresh build of type Release.