{"record":{"id":"aa9f535ce220eb3b","repo":"slimtoolkit/slim","slug":"unexpected-app-signalled","errorCode":null,"errorMessage":"unexpected app signalled","messagePattern":"unexpected app signalled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/monitor/ptrace/ptrace.go","lineNumber":574,"sourceCode":"\twaitStatus, ok := app.cmd.ProcessState.Sys().(syscall.WaitStatus)\n\tif ok {\n\t\tlogger.Debugf(\"Target process wait status - %v (Exited=%v Signaled=%v Signal='%v' Stopped=%v StopSignal='%v' TrapCause=%v)\",\n\t\t\twaitStatus,\n\t\t\twaitStatus.Exited(),\n\t\t\twaitStatus.Signaled(),\n\t\t\twaitStatus.Signal(),\n\t\t\twaitStatus.Stopped(),\n\t\t\twaitStatus.StopSignal(),\n\t\t\twaitStatus.TrapCause())\n\n\t\tif waitStatus.Exited() {\n\t\t\tlogger.Debug(\"unexpected app exit\")\n\t\t\treturn fmt.Errorf(\"unexpected app exit\")\n\t\t}\n\n\t\tif waitStatus.Signaled() {\n\t\t\tlogger.Debug(\"unexpected app signalled\")\n\t\t\treturn fmt.Errorf(\"unexpected app signalled\")\n\t\t}\n\n\t\t//we should be in the Stopped state\n\t\tif waitStatus.Stopped() {\n\t\t\tsigEnum := SignalEnum(int(waitStatus.StopSignal()))\n\t\t\tlogger.Debugf(\"Process Stop Signal - code=%d enum=%s str=%s\",\n\t\t\t\twaitStatus.StopSignal(), sigEnum, waitStatus.StopSignal())\n\t\t} else {\n\t\t\t//TODO:\n\t\t\t//check for Exited or Signaled process state (shouldn't happen)\n\t\t\t//do it for context indicating that we are in a failed state\n\t\t}\n\t} else {\n\t\tlogger.WithError(err).Error(\"process status error\")\n\t\treturn fmt.Errorf(\"process status error\")\n\t}\n\n\tapp.pgid, err = syscall.Getpgid(app.cmd.Process.Pid)","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/monitor/ptrace/ptrace.go#L556-L592","documentation":"ptrace.App.start returns this error when the traced application process terminates via a signal rather than exiting normally. waitStatus.Signaled() means the kernel killed or signaled the process to death (e.g. SIGKILL, SIGSEGV), so the sensor cannot continue tracing it. It is a sentinel wrapper indicating the trace target died abnormally.","triggerScenarios":"During trace() -> start(), the ptrace waitpid loop observes a wait status with Signaled() set — the child process was killed by a signal before it could stop or exit normally.","commonSituations":"App crashes with SIGSEGV/SIGBUS due to a bug; OOM killer sends SIGKILL; user or orchestrator kills the traced process; container runtime terminates the PID.","solutions":["Check dmesg/journal for OOM kills or segfault messages around the failure time","Run the app under the tracer manually to reproduce the signal (e.g. SIGSEGV) and fix the app bug","Ensure no external supervisor (systemd, k8s liveness probe, watchdog) is killing the process during tracing","Raise container/app memory limits if OOM-killed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := tracer.Trace(cmd); if err != nil && strings.Contains(err.Error(), \"unexpected app signalled\") { // inspect app crash: dmesg, core dumps, exit signal\n    log.Errorf(\"traced app killed by signal: %v\", err)\n}","preventionTips":["Monitor dmesg/journal for OOM-killer and segfault events","Prevent external supervisors from killing the process mid-trace","Set adequate memory limits for the traced app","Test the app under tracing before production runs"],"tags":["ptrace","process-signalled","process-termination"],"backgroundTag":"process-killed-by-signal","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}