slimtoolkit/slim · error

start monitor timeout

Error message

start monitor timeout

What it means

ErrStartMonitorTimeout is a sentinel in pkg/app/master/inspectors/container/container_inspector.go returned by RunContainer when the sensor's start monitor does not report readiness within the expected time window after launching the instrumented container. It means the slim sensor inside the target never confirmed it started monitoring.

Source

Thrown at pkg/app/master/inspectors/container/container_inspector.go:65

	fileArtifactsTar    = "files.tar"
	FileArtifactsOutTar = "files_out.tar"
	// FileArtifactsArchiveTar = "files_archive.tar"
	SensorMountPat       = "%s:/opt/_slim/bin/slim-sensor:ro"
	VolumeSensorMountPat = "%s:/opt/_slim/bin:ro"
	LabelName            = "_slim"
	MondelArtifactTar    = "mondel.tar"
)

type ovars = app.OutVars

var (
	cmdPortStrDefault  = fmt.Sprintf("%d", channel.CmdPort)
	cmdPortSpecDefault = dockerapi.Port(fmt.Sprintf("%d/tcp", channel.CmdPort))
	evtPortStrDefault  = fmt.Sprintf("%d", channel.EvtPort)
	evtPortSpecDefault = dockerapi.Port(fmt.Sprintf("%d/tcp", channel.EvtPort))
)

var ErrStartMonitorTimeout = errors.New("start monitor timeout")

const (
	sensorVolumeBaseName = "slim-sensor"
)

type NetNameInfo struct {
	Name     string
	FullName string
	Aliases  []string
}

// TODO(estroz): move all fields configured only after RunContainer is called
// to a InspectorRunResponse struct returned by RunContainer.

// Inspector is a container execution inspector
type Inspector struct {
	ContainerInfo         *dockerapi.Container
	ContainerPortsInfo    string

View on GitHub (pinned to 81940d17fa)

Solutions

1. Retry the run — transient startup slowness often resolves on a second attempt
2. Check that the sensor's IPC ports (CmdPort/EvtPort defaults) are free and not blocked by firewall/network policy
3. Verify the target image can execute the sensor binary (architecture match, required libc/libraries present)

// Go
if errors.Is(err, ErrStartMonitorTimeout) {
	// log, then retry the run once before failing
}

When it happens

Trigger: Running the container inspection when the sensor IPC channel fails to come up; the sensor binary can't start in the target image; the container's start event never arrives before the timeout elapses.

Common situations: Minimal/distroless target images missing the sensor's runtime dependencies; blocked ports (CmdPort/EvtPort) or firewall rules; very slow container startup under heavy load; SELinux/AppArmor restrictions.

Understand the failure class

• Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

Related errors

• start monitor timeout
• error waiting for sensor event: %w
• invalid context directory
• no service image
• unknown sensor mode

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/86960003e5990954. Report an issue: GitHub.