{"record":{"id":"ef84f0a326fc0da0","repo":"slimtoolkit/slim","slug":"process-status-error","errorCode":null,"errorMessage":"process status error","messagePattern":"process status error","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/monitor/ptrace/ptrace.go","lineNumber":589,"sourceCode":"\n\t\tif waitStatus.Signaled() {\n\t\t\tlogger.Debug(\"unexpected app signalled\")\n\t\t\treturn fmt.Errorf(\"unexpected app signalled\")\n\t\t}\n\n\t\t//we should be in the Stopped state\n\t\tif waitStatus.Stopped() {\n\t\t\tsigEnum := SignalEnum(int(waitStatus.StopSignal()))\n\t\t\tlogger.Debugf(\"Process Stop Signal - code=%d enum=%s str=%s\",\n\t\t\t\twaitStatus.StopSignal(), sigEnum, waitStatus.StopSignal())\n\t\t} else {\n\t\t\t//TODO:\n\t\t\t//check for Exited or Signaled process state (shouldn't happen)\n\t\t\t//do it for context indicating that we are in a failed state\n\t\t}\n\t} else {\n\t\tlogger.WithError(err).Error(\"process status error\")\n\t\treturn fmt.Errorf(\"process status error\")\n\t}\n\n\tapp.pgid, err = syscall.Getpgid(app.cmd.Process.Pid)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tlogger.Debugf(\"started target app --> PID=%d PGID=%d\",\n\t\tapp.cmd.Process.Pid, app.pgid)\n\n\terr = syscall.PtraceSetOptions(app.cmd.Process.Pid, ptOptions)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":571,"sourceCodeEnd":607,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/monitor/ptrace/ptrace.go#L571-L607","documentation":"In ptrace.App.start, after waitpid reports the process stopped, the code queries the child's status via ptrace; if that syscall fails the sensor logs and wraps the error as 'process status error'. It means the PTRACE_GETSIGINFO/status inquiry on the tracee failed, so the tracer cannot inspect why the child stopped.","triggerScenarios":"trace() -> start(): the status-fetch syscall on the tracee PID returns a non-nil error (typically ESRCH because the tracee already exited or is not stopped).","commonSituations":"Race where the child exits between the wait and the status query; process killed concurrently by another signal; ptrace attach lost due to pid namespace/container issues.","solutions":["Verify the target process still exists (check /proc/<pid>) when the error occurs","Avoid racing the tracee with external kills during startup; start tracing immediately after fork/exec","Check ptrace permissions (yama/ptrace_scope, CAP_SYS_PTRACE in containers)","Retry the trace run; if reproducible, inspect kernel/ptrace restrictions"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// before tracing, ensure permissions and target liveness\nif _, err := os.Stat(\"/proc/<pid>\"); err != nil { return fmt.Errorf(\"target gone\") }\n// ensure ptrace permitted: cat /proc/sys/kernel/yama/ptrace_scope","typeGuard":null,"tryCatchPattern":"if err := tracer.Trace(app); err != nil {\n    if strings.Contains(err.Error(), \"process status error\") {\n        // retry once after brief delay; the tracee may have exited in a race\n        time.Sleep(100 * time.Millisecond)\n        err = tracer.Trace(app)\n    }\n}","preventionTips":["Avoid racing the tracee with external kills","Run with CAP_SYS_PTRACE in containers","Keep yama ptrace_scope permissive for the sensor user","Retry transient trace startups"],"tags":["ptrace","syscall","race-condition"],"backgroundTag":"ptrace-status-failure","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}