slimtoolkit/slim · error

ptmon: target app startup failed: %q

Error message

ptmon: target app startup failed: %q

What it means

The ptrace monitor watches the target app's state channel during Start(). If the app transitions to ptrace.AppFailed, Start() aborts with this error instead of waiting for the done state. It indicates the traced application failed to start under ptrace supervision.

Source

Thrown at pkg/app/sensor/monitor/ptrace/monitor.go:120

		m.includeNew,
		m.origPaths,
		m.signalCh,
		m.errorCh,
	)
	if err != nil {
		return errors.SE("sensor.ptrace.Run/ptrace.Run", "call.error", err)
	}
	m.app = app

	appState := <-app.StateCh
	logger.
		WithField("state", appState).
		Debugf("pta state watcher - new target app state")

	if appState == ptrace.AppFailed {
		// Don't need to wait for the 'done' state.
		logger.Error("pta state watcher - target app failed")
		return fmt.Errorf("ptmon: target app startup failed: %q", appState)
	}
	if appState != ptrace.AppStarted {
		// Cannot really happen.
		logger.Error("pta state watcher - unexpected target app state")
		return fmt.Errorf("ptmon: unexpected target app state %q", appState)
	}

	// The sync part of the start was successful.

	// Tracking the completetion of the monitor.
	go func() {
		logger := m.logger.WithField("op", "sensor.pt.monitor.completetion.monitor")
		logger.Info("call")
		defer logger.Info("exit")

		appState := <-app.StateCh
		if appState == ptrace.AppDone {
			m.status.report = <-app.ReportCh

View on GitHub (pinned to 81940d17fa)

Solutions

1. Read the quoted state in the message and check the app's own stderr (captured in app stdout/stderr logs) for the root failure.
2. Run the sensor with sufficient privileges: root or docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined.
3. Verify the target binary exists, is executable, and its dependencies (dynamic linker, shared libs) are present.
4. If targeting a newer kernel with Yama, set ptrace_scope appropriately or run as root.

Example fix

// before (docker)
docker run myimage sensor myapp
// after (docker)
docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined myimage sensor myapp

if _, err := os.Stat(targetBinary); err != nil {
    return fmt.Errorf("target binary missing: %w", err)
}
if m, _ := os.Stat(targetBinary); m.Perm()&0o111 == 0 {
    return fmt.Errorf("target binary not executable")
}
if os.Geteuid() != 0 {
    log.Warn("ptrace typically requires root or CAP_SYS_PTRACE")
}

if err := ptMon.Start(ctx); err != nil {
    if strings.Contains(err.Error(), "target app startup failed") {
        log.Errorf("target failed under ptrace; check app stderr logs and ptrace privileges: %v", err)
        return err
    }
    return err
}

When it happens

Trigger: Calling Start() and receiving ptrace.AppFailed on app.StateCh — the traced binary failed to exec, crashed during startup, or ptrace attach was denied.

Common situations: Target binary missing or lacking execute permission; missing dynamic loader/libraries inside the container; seccomp/AppArmor blocking ptrace; running without CAP_SYS_PTRACE (e.g. non-root in Docker without --cap-add=SYS_PTRACE).

Related errors

• one or more monitors failed: fanotify.error=%q, ptrace.error
• ptmon: target app failed with state %q
• unexpected app exit
• insufficient permissions
• failed to set log-level: %v

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/d15e6f8d4002d301. Report an issue: GitHub.