{"record":{"id":"aadd2440b5aa8926","repo":"slimtoolkit/slim","slug":"unexpected-app-exit","errorCode":null,"errorMessage":"unexpected app exit","messagePattern":"unexpected app exit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/monitor/ptrace/ptrace.go","lineNumber":569,"sourceCode":"\tlogger.Debugf(\"Target process state info - Exited=%v ExitCode=%v SysWaitStatus=%v\",\n\t\tapp.cmd.ProcessState.Exited(),\n\t\tapp.cmd.ProcessState.ExitCode(),\n\t\tapp.cmd.ProcessState.Sys())\n\n\twaitStatus, ok := app.cmd.ProcessState.Sys().(syscall.WaitStatus)\n\tif ok {\n\t\tlogger.Debugf(\"Target process wait status - %v (Exited=%v Signaled=%v Signal='%v' Stopped=%v StopSignal='%v' TrapCause=%v)\",\n\t\t\twaitStatus,\n\t\t\twaitStatus.Exited(),\n\t\t\twaitStatus.Signaled(),\n\t\t\twaitStatus.Signal(),\n\t\t\twaitStatus.Stopped(),\n\t\t\twaitStatus.StopSignal(),\n\t\t\twaitStatus.TrapCause())\n\n\t\tif waitStatus.Exited() {\n\t\t\tlogger.Debug(\"unexpected app exit\")\n\t\t\treturn fmt.Errorf(\"unexpected app exit\")\n\t\t}\n\n\t\tif waitStatus.Signaled() {\n\t\t\tlogger.Debug(\"unexpected app signalled\")\n\t\t\treturn fmt.Errorf(\"unexpected app signalled\")\n\t\t}\n\n\t\t//we should be in the Stopped state\n\t\tif waitStatus.Stopped() {\n\t\t\tsigEnum := SignalEnum(int(waitStatus.StopSignal()))\n\t\t\tlogger.Debugf(\"Process Stop Signal - code=%d enum=%s str=%s\",\n\t\t\t\twaitStatus.StopSignal(), sigEnum, waitStatus.StopSignal())\n\t\t} else {\n\t\t\t//TODO:\n\t\t\t//check for Exited or Signaled process state (shouldn't happen)\n\t\t\t//do it for context indicating that we are in a failed state\n\t\t}\n\t} else {","sourceCodeStart":551,"sourceCodeEnd":587,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/monitor/ptrace/ptrace.go#L551-L587","documentation":"During ptrace-based tracing, start waits on the tracee; if the wait status reports the process exited normally instead of stopping at a breakpoint/syscall, the tracer cannot continue and returns \"unexpected app exit\". The application terminated before the monitoring session completed.","triggerScenarios":"The traced application exits (returns from main / os.Exit) while the tracer expected it to keep running and hit traced events.","commonSituations":"App crashes or exits early due to its own config error, monitoring wrapper incompatible with the app's runtime (e.g. static binary, seccomp blocking ptrace), or container lacking SYS_PTRACE capability causing app misbehavior.","solutions":["Run the app manually first and fix any early-exit (crash, bad config, missing args) before tracing.","Ensure the container/runtime grants ptrace (SYS_PTRACE capability, /proc/sys/kernel/yama/ptrace_scope).","Verify the monitored binary is compatible with the tracer (arch, dynamic vs static linking)."],"exampleFix":"// before\n// docker run --cap-add= (no SYS_PTRACE) -> app misbehaves under ptrace\n// after\ndocker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined myimage","handlingStrategy":"retry","validationCode":"// pre-flight: run the target briefly and confirm it stays alive\nif err := exec.Command(binPath, args...).Run(); err != nil {\n    return fmt.Errorf(\"app exits on its own before tracing: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"err := trace(binPath, args)\nif err != nil && strings.Contains(err.Error(), \"unexpected app exit\") {\n    // inspect app logs/core dump, fix app-side early exit, retry trace\n}","preventionTips":["Verify the app runs standalone without crashing before attaching ptrace","Grant SYS_PTRACE and relax seccomp in containers","Match tracer support to binary arch/linkage"],"tags":["ptrace","process","monitoring","linux"],"backgroundTag":"process-unexpected-exit","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}