{"record":{"id":"d9eb6164c50b0113","repo":"slimtoolkit/slim","slug":"start-monitor-error-v","errorCode":null,"errorMessage":"start monitor error: %v","messagePattern":"start monitor error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/app/master/inspectors/pod/pod_inspector.go","lineNumber":656,"sourceCode":"\n\t\t\treturn err\n\t\t}\n\n\t\tif evt == nil || evt.Name == \"\" {\n\t\t\ti.logger.Debug(\"empty event waiting for the slim container to start (trying again)...\")\n\t\t\tcontinue\n\t\t}\n\n\t\tif evt.Name == event.StartMonitorDone {\n\t\t\ti.xc.Out.Info(\"event.startmonitor.done\",\n\t\t\t\tovars{\n\t\t\t\t\t\"status\": \"received\",\n\t\t\t\t})\n\t\t\treturn nil\n\t\t}\n\n\t\tif evt.Name == event.Error {\n\t\t\treturn fmt.Errorf(\"start monitor error: %v\", evt.Data)\n\t\t}\n\n\t\tif evt.Name != event.StartMonitorDone {\n\t\t\ti.xc.Out.Info(\"event.startmonitor.done\",\n\t\t\t\tovars{\n\t\t\t\t\t\"status\": \"received.unexpected\",\n\t\t\t\t\t\"data\":   fmt.Sprintf(\"%+v\", evt),\n\t\t\t\t})\n\n\t\t\t//TODO: dump temp container logs\n\t\t\treturn event.ErrUnexpectedEvent\n\t\t}\n\t}\n\n\treturn errors.New(\"start monitor timeout\")\n}\n\nfunc (i *Inspector) sensorCommandStop() error {","sourceCodeStart":638,"sourceCodeEnd":674,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/app/master/inspectors/pod/pod_inspector.go#L638-L674","documentation":"The pod inspector's monitor (sensor) startup protocol expects a StartMonitorDone event from the sensor process inside the pod. If the sensor emits an Error event instead, sensorCommandStart (called from RunPod) surfaces the event payload as \"start monitor error\". This means the in-pod monitor failed to start, not the slim process itself.","triggerScenarios":"RunPod -> sensorCommandStart receives evt.Name == event.Error from the sensor: bad sensor binary/arch for the pod's platform, missing RBAC/permissions, sensor crashing on startup, or misconfigured monitor options.","commonSituations":"Running slim on Kubernetes with a sensor image that doesn't match the node architecture (arm64 vs amd64); security policies (PSP/OPA) blocking the sensor container; pod restarted mid-monitor; insufficient service account permissions.","solutions":["Inspect evt.Data in the full log output — it carries the underlying sensor error cause.","Verify the sensor/slim image matches the cluster's CPU architecture and the runtime.","Check the pod's events/logs (kubectl describe pod, kubectl logs) and service account RBAC for the sensor.","Ensure no admission policies block the sensor container; update slim to the latest release."],"exampleFix":"// before: debugging blind\nreturn fmt.Errorf(\"start monitor error: %v\", evt.Data)\n// after: capture full pod diagnostics first\nkubectl describe pod <sensor-pod>; kubectl logs <sensor-pod> --previous\n// then re-run slim with debug logging:\ndocker-slim build --debug ...","handlingStrategy":"try-catch","validationCode":"// pre-check the pod/sensor can run\nkubectl get pod <sensor-pod> -o jsonpath='{.status.containerStatuses[*].ready}'\nkubectl auth can-i create pods --as=system:serviceaccount:<ns>:<sa>","typeGuard":null,"tryCatchPattern":"if err := runPodInspector(); err != nil {\n    var startErr *StartMonitorError\n    if errors.As(err, &startErr) || strings.Contains(err.Error(), \"start monitor error\") {\n        log.Printf(\"sensor failed: %v — check pod logs, image arch, and RBAC\", err)\n    }\n}","preventionTips":["Match the slim/sensor image architecture to the cluster nodes (amd64 vs arm64).","Grant the service account permissions the sensor needs; verify with kubectl auth can-i.","Check admission policies (PSP/OPA/Kyverno) won't reject the sensor container."],"tags":["kubernetes","pod","monitor"],"backgroundTag":"monitor-start-failed","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}