slimtoolkit/slim · error

process status error

Error message

process status error

What it means

In ptrace.App.start, after waitpid reports the process stopped, the code queries the child's status via ptrace; if that syscall fails the sensor logs and wraps the error as 'process status error'. It means the PTRACE_GETSIGINFO/status inquiry on the tracee failed, so the tracer cannot inspect why the child stopped.

Source

Thrown at pkg/monitor/ptrace/ptrace.go:589

		if waitStatus.Signaled() {
			logger.Debug("unexpected app signalled")
			return fmt.Errorf("unexpected app signalled")
		}

		//we should be in the Stopped state
		if waitStatus.Stopped() {
			sigEnum := SignalEnum(int(waitStatus.StopSignal()))
			logger.Debugf("Process Stop Signal - code=%d enum=%s str=%s",
				waitStatus.StopSignal(), sigEnum, waitStatus.StopSignal())
		} else {
			//TODO:
			//check for Exited or Signaled process state (shouldn't happen)
			//do it for context indicating that we are in a failed state
		}
	} else {
		logger.WithError(err).Error("process status error")
		return fmt.Errorf("process status error")
	}

	app.pgid, err = syscall.Getpgid(app.cmd.Process.Pid)
	if err != nil {
		return err
	}

	logger.Debugf("started target app --> PID=%d PGID=%d",
		app.cmd.Process.Pid, app.pgid)

	err = syscall.PtraceSetOptions(app.cmd.Process.Pid, ptOptions)
	if err != nil {
		return err
	}

	return nil
}

View on GitHub (pinned to 81940d17fa)

Solutions

1. Verify the target process still exists (check /proc/<pid>) when the error occurs
2. Avoid racing the tracee with external kills during startup; start tracing immediately after fork/exec
3. Check ptrace permissions (yama/ptrace_scope, CAP_SYS_PTRACE in containers)
4. Retry the trace run; if reproducible, inspect kernel/ptrace restrictions

// before tracing, ensure permissions and target liveness
if _, err := os.Stat("/proc/<pid>"); err != nil { return fmt.Errorf("target gone") }
// ensure ptrace permitted: cat /proc/sys/kernel/yama/ptrace_scope

if err := tracer.Trace(app); err != nil {
    if strings.Contains(err.Error(), "process status error") {
        // retry once after brief delay; the tracee may have exited in a race
        time.Sleep(100 * time.Millisecond)
        err = tracer.Trace(app)
    }
}

When it happens

Trigger: trace() -> start(): the status-fetch syscall on the tracee PID returns a non-nil error (typically ESRCH because the tracee already exited or is not stopped).

Common situations: Race where the child exits between the wait and the status query; process killed concurrently by another signal; ptrace attach lost due to pid namespace/container issues.

Related errors

• insufficient permissions
• could not read command file %q: %w
• one or more monitors failed: fanotify.error=%q, ptrace.error
• ptmon: target app startup failed: %q
• ptmon: unexpected target app state %q

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/ef84f0a326fc0da0. Report an issue: GitHub.