{"record":{"id":"66dfc335a56ca0f5","repo":"cilium/cilium","slug":"initializing-events-map-w","errorCode":null,"errorMessage":"initializing events map: %w","messagePattern":"initializing events map: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/maps/eventsmap/cell.go","lineNumber":41,"sourceCode":"\nvar (\n\tMaxEntries int\n)\n\ntype Map any\n\nfunc newEventsMap(lifecycle cell.Lifecycle) bpf.MapOut[Map] {\n\teventsMap := &eventsMap{}\n\n\tlifecycle.Append(cell.Hook{\n\t\tOnStart: func(context cell.HookContext) error {\n\t\t\tcpus, err := ebpf.PossibleCPU()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to get number of possible CPUs: %w\", err)\n\t\t\t}\n\t\t\terr = eventsMap.init(cpus)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"initializing events map: %w\", err)\n\t\t\t}\n\t\t\treturn nil\n\t\t},\n\t\tOnStop: func(context cell.HookContext) error {\n\t\t\t// We don't currently care for cleaning up.\n\t\t\treturn nil\n\t\t},\n\t})\n\n\treturn bpf.NewMapOut(Map(eventsMap))\n}\n","sourceCodeStart":23,"sourceCodeEnd":53,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/maps/eventsmap/cell.go#L23-L53","documentation":"After successfully obtaining the CPU count, the eventsmap cell calls eventsMap.init(cpus) to create the cilium_events perf event ring buffer (one per-CPU perf array). Any failure from init — opening perf events, creating the BPF map, missing perf_event_open support — is wrapped as 'initializing events map'. This aborts the events-map cell's startup.","triggerScenarios":"eventsMap.init(cpus) returns an error during hive OnStart: e.g. ebpf.NewPerfEventRing failing to create the per-CPU ring buffer, perf_event_open blocked, or map creation/pinning failures.","commonSituations":"Kernel without BPF_MAP_TYPE_PERF_EVENT_ARRAY support (very old kernels); perf_event_open blocked by seccomp/pod security policies; RLIMIT_MEMLOCK too low to allocate ring buffers on many CPUs; privilege loss (missing CAP_BPF/CAP_PERFMON/CAP_SYS_ADMIN).","solutions":["Read the wrapped inner error (errors.Unwrap / logs) for the root cause","Raise the memlock limit: set ulimit -l unlimited or LimitMEMLOCK=infinity in the systemd unit (older kernels)","Ensure the container has CAP_BPF, CAP_PERFMON (or CAP_SYS_ADMIN) and isn't blocked by seccomp from perf_event_open","Run on a supported kernel (>=4.9; >=5.8 with the new BPF caps) and check perf_event_paranoid settings","Reduce the agent's CPU footprint test: run on a host with fewer CPUs to confirm memory pressure was the cause"],"exampleFix":"// before (systemd unit)\n[Service]\n# no memlock config\n// after\n[Service]\nLimitMEMLOCK=infinity\nAmbientCapabilities=CAP_BPF CAP_PERFMON CAP_SYS_ADMIN","handlingStrategy":"try-catch","validationCode":"// shell, before startup\nulimit -l  # must be unlimited or large on kernels <5.11\ntest -w /proc/sys/kernel/perf_event_paranoid && cat /proc/sys/kernel/perf_event_paranoid\ncapsh --print | grep -E 'cap_bpf|cap_perfmon|cap_sys_admin'","typeGuard":null,"tryCatchPattern":"if err := eventsMap.init(cpus); err != nil {\n    var pe ebpf.Error\n    if errors.As(err, &pe) {\n        // log wrapped perf/map error before aborting\n    }\n    return fmt.Errorf(\"initializing events map: %w\", err)\n}","preventionTips":["Set LimitMEMLOCK=infinity for agents on kernels <5.11","Grant CAP_BPF/CAP_PERFMON (or CAP_SYS_ADMIN) to the agent container","Check seccomp policies allow perf_event_open","Deploy only on kernels supporting BPF_MAP_TYPE_PERF_EVENT_ARRAY (>=4.3)"],"tags":["ebpf","perf-ring-buffer","eventsmap","memlock","agent-startup"],"backgroundTag":"bpf-map-create-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}