{"record":{"id":"22e6c6acd3ed5a49","repo":"prometheus/node_exporter","slug":"failed-to-open-sysfs-w-22e6c6","errorCode":null,"errorMessage":"failed to open sysfs: %w","messagePattern":"failed to open sysfs: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"collector/cpu_vulnerabilities_linux.go","lineNumber":50,"sourceCode":"\t\t[]string{\"codename\", \"state\", \"mitigation\"},\n\t\tnil,\n\t)\n)\n\ntype cpuVulnerabilitiesCollector struct{}\n\nfunc init() {\n\tregisterCollector(cpuVulnerabilitiesCollectorSubsystem, defaultDisabled, NewVulnerabilitySysfsCollector)\n}\n\nfunc NewVulnerabilitySysfsCollector(_ *slog.Logger) (Collector, error) {\n\treturn &cpuVulnerabilitiesCollector{}, nil\n}\n\nfunc (v *cpuVulnerabilitiesCollector) Update(ch chan<- prometheus.Metric) error {\n\tfs, err := sysfs.NewFS(*sysPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open sysfs: %w\", err)\n\t}\n\n\tvulnerabilities, err := fs.CPUVulnerabilities()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get vulnerabilities: %w\", err)\n\t}\n\n\tfor _, vulnerability := range vulnerabilities {\n\t\tch <- prometheus.MustNewConstMetric(\n\t\t\tvulnerabilityDesc,\n\t\t\tprometheus.GaugeValue,\n\t\t\t1.0,\n\t\t\tvulnerability.CodeName,\n\t\t\tsysfs.VulnerabilityHumanEncoding[vulnerability.State],\n\t\t\tvulnerability.Mitigation,\n\t\t)\n\t}\n\treturn nil","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/prometheus/node_exporter/blob/17ddd77c59ba27e1508e9f7894b1e55b44d6aed3/collector/cpu_vulnerabilities_linux.go#L32-L68","documentation":"The cpu_vulnerabilities collector reads CPU vulnerability exposés from sysfs (/sys/devices/system/cpu/vulnerabilities/*). Its Update method opens the sysfs filesystem at --path.sysfs first and returns this wrapped error if the filesystem cannot be opened, aborting the scrape for this collector.","triggerScenarios":"sysfs.NewFS(*sysPath) errors during Update: --path.sysfs points to a nonexistent, non-sysfs, or unreadable location.","commonSituations":"Containers without /sys mounted or with host sysfs at /host/sys and no --path.sysfs override; running the Linux collector build on non-Linux; broken bind mounts in Kubernetes.","solutions":["Mount /sys read-only into the container or set --path.sysfs correctly (e.g. /host/sys)","Verify the path is a real sysfs mount readable by the exporter user","Disable the cpu_vulnerabilities collector if sysfs access cannot be provided"],"exampleFix":"// before\nnode_exporter --collector.cpu.vulnerabilities  # in container without /sys\n// after\ndocker run -v /sys:/host/sys:ro node_exporter --path.sysfs=/host/sys --collector.cpu.vulnerabilities","handlingStrategy":"validation","validationCode":"// Go: check vulnerabilities sysfs dir before enabling the collector\nif fi, err := os.Stat(filepath.Join(*sysPath, \"devices/system/cpu/vulnerabilities\")); err != nil || !fi.IsDir() {\n    log.Info(\"cpu vulnerability info not available\")\n}","typeGuard":null,"tryCatchPattern":"if err := v.Update(ch); err != nil {\n    if strings.Contains(err.Error(), \"failed to open sysfs\") {\n        log.Warn(\"sysfs unavailable; skipping cpu_vulnerabilities\", \"err\", err)\n        return nil\n    }\n    return err\n}","preventionTips":["Mount /sys read-only in containers and set --path.sysfs","Ensure the exporter user can traverse /sys/devices/system/cpu","Disable cpu_vulnerabilities where sysfs is not available"],"tags":["sysfs","cpu","linux"],"backgroundTag":"file-open-failed","analyzedSha":"17ddd77c59ba27e1508e9f7894b1e55b44d6aed3","analyzedAt":"2026-09-07T17:54:06.211Z","contentChangedAt":"2026-09-07T17:54:06.211Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}