What causes "cannot create execution - open event file %q failed: %w" in slimtoolkit/slim?

Read the wrapped OS error and fix permissions/ownership on the event file (chmod 0644 / chown to sensor user).

cannot create execution - open event file

Error message

cannot create execution - open event file %q failed: %w

What it means

After successfully touching the event file, NewStandalone opens it with os.OpenFile using O_APPEND|O_WRONLY|O_SYNC to append events. If the OS refuses to open the file for writing, the execution cannot be created and this error wraps the OS error.

Solutions

Read the wrapped OS error and fix permissions/ownership on the event file (chmod 0644 / chown to sensor user).
Ensure eventFileName is a regular file, not a directory or symlink to an unwritable target.
Check ulimit -n / fs.file-max if the cause is 'too many open files'.

Example fix

// before
iface, err := execution.NewStandalone(cmdFile, "/var/run/sensor", hook) // path is a directory
// after
iface, err := execution.NewStandalone(cmdFile, "/var/run/sensor/events", hook) // regular file path

Defensive patterns

Strategy: validation

Validate before calling

func canOpenForAppend(path string) error {
    fi, err := os.Stat(path)
    if err == nil && fi.IsDir() {
        return fmt.Errorf("%s is a directory", path)
    }
    f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0644)
    if err != nil { return err }
    return f.Close()
}

Type guard

func isOpenFailure(err error) bool {
    var pe *fs.PathError
    return errors.As(err, &pe) && errors.Is(pe.Err, os.ErrPermission)
}

Try / catch

exec, err := execution.NewStandalone(cmdFile, eventFile, hook)
if err != nil && strings.Contains(err.Error(), "open event file") {
    log.Fatalf("cannot open event file for append: %v", err)
}

Prevention

Do not point eventFileName at a directory; use a dedicated file path.
Align file ownership between init containers and the sensor user.
Monitor open fd counts in long-running pods and raise ulimit -n.
Let the sensor create the file itself rather than pre-creating with restrictive modes.

When it happens

Trigger: Calling NewStandalone when eventFileName exists but cannot be opened for append/write: file owned by another user, no write permission, path is a directory, or too many open files (EMFILE).

Common situations: Event file pre-created by an init container with root ownership while sensor runs as non-root; eventFileName actually a directory; fd limit exhausted in long-running containers.

Related errors

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/d85d6d08673e9066. Report an issue: GitHub.

Appendix: source

Thrown at pkg/app/sensor/execution/standalone.go:44

}

func NewStandalone(
	ctx context.Context,
	commandFileName string,
	eventFileName string,
	lifecycleHookCommand string,
) (Interface, error) {
	// fsutil.Touch() creates (potentially missing) folder(s).
	if err := fsutil.Touch(eventFileName); err != nil {
		return nil, fmt.Errorf(
			"cannot create execution - touch event file %q failed: %w",
			eventFileName, err,
		)
	}

	eventFile, err := os.OpenFile(eventFileName, os.O_APPEND|os.O_WRONLY|os.O_SYNC, 0644)
	if err != nil {
		return nil, fmt.Errorf(
			"cannot create execution - open event file %q failed: %w",
			eventFileName, err,
		)
	}

	cmd, err := readCommandFile(commandFileName)
	if err != nil {
		return nil, fmt.Errorf(
			"cannot create execution - cannot read command file %q: %w",
			commandFileName, err,
		)
	}

	commandCh := make(chan command.Message, 10)
	commandCh <- &cmd

	go control.HandleControlCommandQueue(ctx, commandFileName, commandCh)

View on GitHub (pinned to 81940d17fa)