{"record":{"id":"e5dd476116827772","repo":"prometheus/node_exporter","slug":"failed-to-get-vulnerabilities-w","errorCode":null,"errorMessage":"failed to get vulnerabilities: %w","messagePattern":"failed to get vulnerabilities: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"collector/cpu_vulnerabilities_linux.go","lineNumber":55,"sourceCode":"type cpuVulnerabilitiesCollector struct{}\n\nfunc init() {\n\tregisterCollector(cpuVulnerabilitiesCollectorSubsystem, defaultDisabled, NewVulnerabilitySysfsCollector)\n}\n\nfunc NewVulnerabilitySysfsCollector(_ *slog.Logger) (Collector, error) {\n\treturn &cpuVulnerabilitiesCollector{}, nil\n}\n\nfunc (v *cpuVulnerabilitiesCollector) Update(ch chan<- prometheus.Metric) error {\n\tfs, err := sysfs.NewFS(*sysPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open sysfs: %w\", err)\n\t}\n\n\tvulnerabilities, err := fs.CPUVulnerabilities()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get vulnerabilities: %w\", err)\n\t}\n\n\tfor _, vulnerability := range vulnerabilities {\n\t\tch <- prometheus.MustNewConstMetric(\n\t\t\tvulnerabilityDesc,\n\t\t\tprometheus.GaugeValue,\n\t\t\t1.0,\n\t\t\tvulnerability.CodeName,\n\t\t\tsysfs.VulnerabilityHumanEncoding[vulnerability.State],\n\t\t\tvulnerability.Mitigation,\n\t\t)\n\t}\n\treturn nil\n}\n","sourceCodeStart":37,"sourceCodeEnd":70,"githubUrl":"https://github.com/prometheus/node_exporter/blob/17ddd77c59ba27e1508e9f7894b1e55b44d6aed3/collector/cpu_vulnerabilities_linux.go#L37-L70","documentation":"The cpu_vulnerabilities collector calls sysfs.NewFS then fs.CPUVulnerabilities() to read /sys/devices/system/cpu/vulnerabilities/*. When that procfs/sysfs read or parse fails, Update wraps the underlying error with \"failed to get vulnerabilities: %w\" so scrape-level failures surface in the scrape error field.","triggerScenarios":"Update() on Linux when fs.CPUVulnerabilities() returns an error: sysfs mount unavailable, /sys/devices/system/cpu/vulnerabilities entries unreadable (permission or LSM restrictions), or unexpected content the procfs package cannot parse.","commonSituations":"Running node_exporter in a container without /sys mounted (or mounted read-only incorrectly); hardened kernels/SELinux denying read of vulnerability files; kernels or rootfs layouts where the vulnerabilities directory is absent; unusual kernel configurations producing unexpected file contents.","solutions":["Ensure /sys/devices/system/cpu/vulnerabilities exists and is readable by the node_exporter process (ls /sys/devices/system/cpu/vulnerabilities).","When running in a container, mount /sys into the container (e.g. docker run -v /sys:/sys:ro) and check for host-level SELinux/AppArmor denials in audit logs.","Check the wrapped error text (%w chain) for the concrete cause: read/permission errors vs parse errors; upgrade node_exporter/procfs if it is a parsing issue with a newer kernel.","Disable the cpu_vulnerabilities collector (--no-collector.cpu_vulnerabilities) if the metrics are not needed on that host."],"exampleFix":"// before\nvulnerabilities, err := fs.CPUVulnerabilities()\nif err != nil {\n    return fmt.Errorf(\"failed to get vulnerabilities: %w\", err)\n}\n// after (caller-side guard: check sysfs availability before scraping)\nif _, err := os.Stat(\"/sys/devices/system/cpu/vulnerabilities\"); os.IsNotExist(err) {\n    // disable or skip the cpu_vulnerabilities collector on this host\n}","handlingStrategy":"try-catch","validationCode":"if _, err := os.Stat(\"/sys/devices/system/cpu/vulnerabilities\"); err != nil {\n    // sysfs vulnerability entries unavailable: expect this collector to fail\n}","typeGuard":null,"tryCatchPattern":"if err := coll.Update(ch); err != nil {\n    var pathErr *fs.PathError\n    if errors.As(err, &pathErr) {\n        log.Printf(\"cpu_vulnerabilities unavailable (sysfs): %v\", pathErr)\n    } else {\n        log.Printf(\"cpu_vulnerabilities update failed: %v\", err)\n    }\n}","preventionTips":["Mount /sys read-only into containers running node_exporter.","Check /sys/devices/system/cpu/vulnerabilities readability before enabling the collector.","Keep node_exporter/procfs updated for newer kernel compatibility.","Alert on scrape errors rather than silently ignoring collector failures."],"tags":["linux","sysfs","procfs","collector"],"backgroundTag":"file-read-failed","analyzedSha":"17ddd77c59ba27e1508e9f7894b1e55b44d6aed3","analyzedAt":"2026-09-07T17:54:06.211Z","contentChangedAt":"2026-09-07T17:54:06.211Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}