prometheus/node_exporter · error

failed to open sysfs

Error message

failed to open sysfs: %w

What it means

The cpu_vulnerabilities collector reads CPU vulnerability exposés from sysfs (/sys/devices/system/cpu/vulnerabilities/*). Its Update method opens the sysfs filesystem at --path.sysfs first and returns this wrapped error if the filesystem cannot be opened, aborting the scrape for this collector.

Solutions

1. Mount /sys read-only into the container or set --path.sysfs correctly (e.g. /host/sys)
2. Verify the path is a real sysfs mount readable by the exporter user
3. Disable the cpu_vulnerabilities collector if sysfs access cannot be provided

Example fix

// before
node_exporter --collector.cpu.vulnerabilities  # in container without /sys
// after
docker run -v /sys:/host/sys:ro node_exporter --path.sysfs=/host/sys --collector.cpu.vulnerabilities

// Go: check vulnerabilities sysfs dir before enabling the collector
if fi, err := os.Stat(filepath.Join(*sysPath, "devices/system/cpu/vulnerabilities")); err != nil || !fi.IsDir() {
    log.Info("cpu vulnerability info not available")
}

if err := v.Update(ch); err != nil {
    if strings.Contains(err.Error(), "failed to open sysfs") {
        log.Warn("sysfs unavailable; skipping cpu_vulnerabilities", "err", err)
        return nil
    }
    return err
}

When it happens

Trigger: sysfs.NewFS(*sysPath) errors during Update: --path.sysfs points to a nonexistent, non-sysfs, or unreadable location.

Common situations: Containers without /sys mounted or with host sysfs at /host/sys and no --path.sysfs override; running the Linux collector build on non-Linux; broken bind mounts in Kubernetes.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• failed to open sysfs
• Could not derive a human-readable chip type for
• failed to open sysfs
• failed to retrieve bcache stats
• failed to open sysfs

AI-assisted analysis of prometheus/node_exporter@17ddd77c59 (2026-09-07). Data as JSON: /api/errors/22e6c6acd3ed5a49. Report an issue: GitHub.

Appendix: source

Thrown at collector/cpu_vulnerabilities_linux.go:50

		[]string{"codename", "state", "mitigation"},
		nil,
	)
)

type cpuVulnerabilitiesCollector struct{}

func init() {
	registerCollector(cpuVulnerabilitiesCollectorSubsystem, defaultDisabled, NewVulnerabilitySysfsCollector)
}

func NewVulnerabilitySysfsCollector(_ *slog.Logger) (Collector, error) {
	return &cpuVulnerabilitiesCollector{}, nil
}

func (v *cpuVulnerabilitiesCollector) Update(ch chan<- prometheus.Metric) error {
	fs, err := sysfs.NewFS(*sysPath)
	if err != nil {
		return fmt.Errorf("failed to open sysfs: %w", err)
	}

	vulnerabilities, err := fs.CPUVulnerabilities()
	if err != nil {
		return fmt.Errorf("failed to get vulnerabilities: %w", err)
	}

	for _, vulnerability := range vulnerabilities {
		ch <- prometheus.MustNewConstMetric(
			vulnerabilityDesc,
			prometheus.GaugeValue,
			1.0,
			vulnerability.CodeName,
			sysfs.VulnerabilityHumanEncoding[vulnerability.State],
			vulnerability.Mitigation,
		)
	}
	return nil

View on GitHub (pinned to 17ddd77c59)