What causes "cannot create execution - open event file %q failed: %w" in slimtoolkit/slim?

Read the wrapped OS error and fix permissions/ownership on the event file (chmod 0644 / chown to sensor user).

cannot create execution - open event file %q failed: %w

Error message

cannot create execution - open event file %q failed: %w

What it means

After successfully touching the event file, NewStandalone opens it with os.OpenFile using O_APPEND|O_WRONLY|O_SYNC to append events. If the OS refuses to open the file for writing, the execution cannot be created and this error wraps the OS error.

Source

Thrown at pkg/app/sensor/execution/standalone.go:44

}

func NewStandalone(
	ctx context.Context,
	commandFileName string,
	eventFileName string,
	lifecycleHookCommand string,
) (Interface, error) {
	// fsutil.Touch() creates (potentially missing) folder(s).
	if err := fsutil.Touch(eventFileName); err != nil {
		return nil, fmt.Errorf(
			"cannot create execution - touch event file %q failed: %w",
			eventFileName, err,
		)
	}

	eventFile, err := os.OpenFile(eventFileName, os.O_APPEND|os.O_WRONLY|os.O_SYNC, 0644)
	if err != nil {
		return nil, fmt.Errorf(
			"cannot create execution - open event file %q failed: %w",
			eventFileName, err,
		)
	}

	cmd, err := readCommandFile(commandFileName)
	if err != nil {
		return nil, fmt.Errorf(
			"cannot create execution - cannot read command file %q: %w",
			commandFileName, err,
		)
	}

	commandCh := make(chan command.Message, 10)
	commandCh <- &cmd

	go control.HandleControlCommandQueue(ctx, commandFileName, commandCh)

View on GitHub (pinned to 81940d17fa)

Solutions

Read the wrapped OS error and fix permissions/ownership on the event file (chmod 0644 / chown to sensor user).
Ensure eventFileName is a regular file, not a directory or symlink to an unwritable target.
Check ulimit -n / fs.file-max if the cause is 'too many open files'.

Example fix

// before
iface, err := execution.NewStandalone(cmdFile, "/var/run/sensor", hook) // path is a directory
// after
iface, err := execution.NewStandalone(cmdFile, "/var/run/sensor/events", hook) // regular file path

Defensive patterns

Strategy: validation

Validate before calling

func canOpenForAppend(path string) error {
    fi, err := os.Stat(path)
    if err == nil && fi.IsDir() {
        return fmt.Errorf("%s is a directory", path)
    }
    f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0644)
    if err != nil { return err }
    return f.Close()
}

Type guard

func isOpenFailure(err error) bool {
    var pe *fs.PathError
    return errors.As(err, &pe) && errors.Is(pe.Err, os.ErrPermission)
}

Try / catch

exec, err := execution.NewStandalone(cmdFile, eventFile, hook)
if err != nil && strings.Contains(err.Error(), "open event file") {
    log.Fatalf("cannot open event file for append: %v", err)
}

Prevention

Do not point eventFileName at a directory; use a dedicated file path.
Align file ownership between init containers and the sensor user.
Monitor open fd counts in long-running pods and raise ulimit -n.
Let the sensor create the file itself rather than pre-creating with restrictive modes.

When it happens

Trigger: Calling NewStandalone when eventFileName exists but cannot be opened for append/write: file owned by another user, no write permission, path is a directory, or too many open files (EMFILE).

Common situations: Event file pre-created by an init container with root ownership while sensor runs as non-root; eventFileName actually a directory; fd limit exhausted in long-running containers.

Related errors

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/d85d6d08673e9066. Report an issue: GitHub.