cilium/cilium · error

get mtime: %w

Error message

get mtime: %w

What it means

This error wraps a failure from bpf.GetMtime() inside the Cilium agent-liveness updater background job. The agent periodically reads the BPF host routing 'mtime' (a kernel-side timestamp marker) and publishes it into a config map so other components can detect agent liveness. If reading that mtime fails (e.g. the BPF map or filesystem backing it is unavailable), the job returns this wrapped error so the job framework can log/retry it. Because the job uses a discard logger, the error is intentionally quiet unless surfaced by the job registry health reporting.

Source

Thrown at pkg/datapath/agentliveness/agent_liveness.go:54

func (alc agentLivenessConfig) Flags(flags *pflag.FlagSet) {
	flags.Duration("agent-liveness-update-interval", alc.AgentLivenessUpdateInterval,
		"Interval at which the agent updates liveness time for the datapath")
}

func newAgentLivenessUpdater(
	jobRegistry job.Registry,
	health cell.Health,
	configMap configmap.Map,
	agentLivenessConfig agentLivenessConfig,
) {
	// Discard even debug logs since this particular job is very noisy
	log := slog.New(slog.DiscardHandler)
	group := jobRegistry.NewGroup(health, job.WithLogger(log))
	group.Add(job.Timer("agent-liveness-updater", func(_ context.Context) error {
		mtime, err := bpf.GetMtime()
		if err != nil {
			return fmt.Errorf("get mtime: %w", err)
		}

		err = configMap.Update(configmap.AgentLiveness, mtime)
		if err != nil {
			return fmt.Errorf("update config map: %w", err)
		}

		return nil
	}, agentLivenessConfig.AgentLivenessUpdateInterval))

}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the BPF filesystem is mounted: run `mount | grep bpf` and mount bpffs at /sys/fs/bpf if missing.
2. Check the agent container has CAP_BPF/CAP_SYS_ADMIN and access to /sys/fs/bpf.
3. Inspect the wrapped inner error in the message ('get mtime: <err>') for the exact syscall failure and fix that root cause.
4. Restart the Cilium agent to re-initialize the liveness state; check health via the job registry health cell.

Example fix

// before: job fails silently because logs are discarded
log := slog.New(slog.DiscardHandler)
// after: use a real logger (or configure it for debugging) so the wrapped error is visible
log := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug}))

// Pre-flight check before relying on the liveness updater:
if _, err := os.Stat("/sys/fs/bpf"); err != nil {
    return fmt.Errorf("bpffs not mounted: %w", err)
}

mtime, err := bpf.GetMtime()
if err != nil {
    return fmt.Errorf("get mtime: %w", err) // inspect wrapped cause
}

When it happens

Trigger: The periodic timer fires and bpf.GetMtime() returns an error — typically when the BPF filesystem (bpffs) is not mounted, the liveness state file/map is missing or has wrong permissions, or the underlying syscall (stat/read of the mtime pin) fails.

Common situations: Running Cilium on nodes where /sys/fs/bpf is not mounted or was cleaned up; containers lacking the BPF capabilities (CAP_BPF/CAP_SYS_ADMIN); a corrupted or manually deleted bpffs pin directory after node restarts.

Related errors

• update config map: %w
• failed to list maps with mapNamePattern %s: %w
• Unable to determine if BPF_FIB_LOOKUP_SRC is supported
• creating map base pinning directory: %w
• program %s has unspecified type: annotate with __section_ent

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/d792e1776059e13c. Report an issue: GitHub.