slimtoolkit/slim · error

one or more monitors failed: fanotify.error=%q, ptrace.error

Error message

one or more monitors failed: fanotify.error=%q, ptrace.error=%q

What it means

CompositeMonitor.Status() aggregates reports from the fanotify and ptrace sub-monitors. If either sub-monitor's Status() returns an error, the composite returns a single wrapped error containing both error values. It signals that the combined monitoring status is unavailable because at least one monitor failed.

Source

Thrown at pkg/app/sensor/monitor/composite.go:329

	for {
		select {
		case <-timer:
			return errors

		case err := <-m.errorCh:
			errors = append(errors, err)
		}
	}
}

func (m *monitor) Status() (*CompositeReport, error) {
	// peReport, peErr := m.peMon.Status()
	fanReport, fanErr := m.fanMon.Status()
	ptReport, ptErr := m.ptMon.Status()

	if fanErr != nil || ptErr != nil {
		return nil, fmt.Errorf(
			"one or more monitors failed: fanotify.error=%q, ptrace.error=%q",
			fanErr, ptErr,
		)
	}

	return &CompositeReport{
		// PeReport: peReport,
		FanReport: fanReport,
		PtReport:  ptReport,
	}, nil
}

func NonCriticalError(err error) error {
	return fmt.Errorf("non-critical monitor error: %w", err)
}

// Using simple io.MultiWriter(os.Stdout, os.File) would make cmd.Wait()
// block until either the cmd's stdout is closed or the multi-writer is closed.

View on GitHub (pinned to 81940d17fa)

Solutions

1. Check the fanotify.error and ptrace.error fields in the message to see which monitor(s) failed and address the underlying cause.
2. Ensure both sub-monitors were started successfully (Start() returned nil) before calling Status().
3. Verify the process has sufficient privileges (root or CAP_SYS_PTRACE / fanotify permissions).
4. Handle partial failure gracefully: if one monitor's error is acceptable, call each sub-monitor's Status() individually instead of the composite.

report, err := mon.Status()
if err != nil {
    var pe *fanotify.StatusError // inspect sub-errors via the message fields
    log.Warnf("composite status unavailable: %v", err)
    // fall back to per-monitor status queries or continue with degraded monitoring
}

When it happens

Trigger: Calling Status() on a composite monitor when m.fanMon.Status() or m.ptMon.Status() returns a non-nil error — typically because the fanotify or ptrace monitor was never started, already terminated, or its internal state collection failed.

Common situations: Querying status after a monitor crashed or before Start(); running on a kernel/filesystem where fanotify is unavailable; ptrace target app already exited; permission restrictions (non-root without CAP_SYS_PTRACE).

Related errors

• insufficient permissions
• unexpected app exit
• ptmon: target app startup failed: %q
• ptmon: target app failed with state %q
• sensor shutdown before monitor stop

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/aa79f673b255b55b. Report an issue: GitHub.