{"record":{"id":"9eb6418e33917250","repo":"go-delve/delve","slug":"error-creating-tracepoint-in-function-s","errorCode":null,"errorMessage":"error creating tracepoint in function %s","messagePattern":"error creating tracepoint in function (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"service/debugger/debugger.go","lineNumber":1517,"sourceCode":"\t\t\t\t\tdisasm, err := proc.Disassemble(t.Memory(), regs, t.Breakpoints(), tgt.BinInfo(), pc, pc+maxInstLen)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn false, fmt.Errorf(\"failed to disassemble instruction: %w\", err)\n\t\t\t\t\t}\n\n\t\t\t\t\t// Extract address from the decoded instruction's destination location\n\t\t\t\t\tvar addr uint64\n\t\t\t\t\tif len(disasm) > 0 && disasm[0].DestLoc != nil {\n\t\t\t\t\t\taddr = disasm[0].DestLoc.PC\n\t\t\t\t\t} else {\n\t\t\t\t\t\treturn false, fmt.Errorf(\"failed to extract call destination from instruction at PC %#x\", pc)\n\t\t\t\t\t}\n\t\t\t\t\tfn := tgt.BinInfo().PCToFunc(addr)\n\t\t\t\t\tif fn == nil {\n\t\t\t\t\t\treturn false, fmt.Errorf(\"PCToFunc returned nil\")\n\t\t\t\t\t}\n\t\t\t\t\terr = createFunctionTracepoints(d, fn.Name, rootstr, followCalls)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn false, fmt.Errorf(\"error creating tracepoint in function %s\", fn.Name)\n\t\t\t\t\t}\n\t\t\t\t\tdynchildren, err := d.traverse(t, fn, sdepth+1, followCalls, rootstr)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn false, fmt.Errorf(\"error calling traverse on dynamic children\")\n\t\t\t\t\t}\n\t\t\t\t\tfor _, child := range dynchildren {\n\t\t\t\t\t\terr := createFunctionTracepoints(d, child, rootstr, followCalls)\n\t\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t\treturn false, fmt.Errorf(\"error creating tracepoint in function %s\", child)\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\treturn false, nil\n\t\t\t\t}\n\t\t\t\tfor _, dynBrklet := range dynbp.Breaklets {\n\t\t\t\t\tdynBrklet.SetCallback(dynCallback)\n\t\t\t\t}\n\t\t\t}\n","sourceCodeStart":1499,"sourceCodeEnd":1535,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/service/debugger/debugger.go#L1499-L1535","documentation":"After resolving the destination function, Delve installs eBPF uprobes/tracepoints on it via createFunctionTracepoints. This error is returned when that call fails, wrapped only with the function name — the underlying cause (e.g. probe limit, permission problem, unsupported symbol) is discarded because fmt.Errorf does not wrap err. It indicates the kernel/ebpf layer refused the tracepoint for the resolved function.","triggerScenarios":"createFunctionTracepoints(d, fn.Name, rootstr, followCalls) returned an error during the dynCallback in traverse; the callback re-wraps it as 'error creating tracepoint in function %s' without %w.","commonSituations":"Missing CAP_BPF/CAP_PERFMON or unprivileged BPF disabled; too many uprobes attached (kernel limit hit while following many calls); tracing functions on unsupported pages (e.g. non-Go code that slipped through); kernel without ringbuf support.","solutions":["Run dlv with elevated capabilities (sudo or CAP_BPF/CAP_PERFMON/CAP_SYS_RESOURCE) as documented for eBPF tracing.","Check kernel version supports BPF ringbuf (>= 5.8) and uprobes are enabled.","Reduce --follow-calls depth to attach fewer probes and stay under per-process uprobe limits.","If authoring Delve code, wrap with %w so the underlying ebpf error is visible: fmt.Errorf(\"error creating tracepoint in function %s: %w\", fn.Name, err)."],"exampleFix":"// before\nreturn false, fmt.Errorf(\"error creating tracepoint in function %s\", fn.Name)\n// after (preserve root cause)\nreturn false, fmt.Errorf(\"error creating tracepoint in function %s: %w\", fn.Name, err)","handlingStrategy":"retry","validationCode":"// pre-flight: verify eBPF tracepoint permission before launching dlv\nif os.Geteuid() != 0 {\n\tout, _ := exec.Command(\"capsh\", \"--print\").Output()\n\tif !strings.Contains(string(out), \"cap_bpf\") {\n\t\tlog.Fatal(\"eBPF tracing needs CAP_BPF/CAP_PERFMON; run with sudo or grant capabilities\")\n\t}\n}","typeGuard":"func isTracepointCreateError(err error, fn string) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"error creating tracepoint in function \"+fn)\n}","tryCatchPattern":"err := runTrace()\nfor attempt := 1; err != nil && isTracepointCreateError(err, fnName) && attempt <= 3; attempt++ {\n\ttime.Sleep(time.Duration(attempt) * 500 * time.Millisecond) // let kernel free probes\n\terr = runTrace()\n}\nif err != nil { log.Fatalf(\"tracepoint creation failed: %v\", err) }","preventionTips":["Run eBPF tracing with sudo or granted CAP_BPF/CAP_PERFMON/CAP_SYS_RESOURCE.","Use a kernel >= 5.8 with BPF ringbuf support.","Keep --follow-calls small to stay under uprobe attachment limits.","Check for leftover probes from crashed sessions (bpftool probe / perf probe -l) and clean them up."],"tags":["ebpf","tracepoint","permissions","follow-calls"],"backgroundTag":"uprobe-attach-failed","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}