slimtoolkit/slim · error

unexpected app exit

Error message

unexpected app exit

What it means

During ptrace-based tracing, start waits on the tracee; if the wait status reports the process exited normally instead of stopping at a breakpoint/syscall, the tracer cannot continue and returns "unexpected app exit". The application terminated before the monitoring session completed.

Source

Thrown at pkg/monitor/ptrace/ptrace.go:569

	logger.Debugf("Target process state info - Exited=%v ExitCode=%v SysWaitStatus=%v",
		app.cmd.ProcessState.Exited(),
		app.cmd.ProcessState.ExitCode(),
		app.cmd.ProcessState.Sys())

	waitStatus, ok := app.cmd.ProcessState.Sys().(syscall.WaitStatus)
	if ok {
		logger.Debugf("Target process wait status - %v (Exited=%v Signaled=%v Signal='%v' Stopped=%v StopSignal='%v' TrapCause=%v)",
			waitStatus,
			waitStatus.Exited(),
			waitStatus.Signaled(),
			waitStatus.Signal(),
			waitStatus.Stopped(),
			waitStatus.StopSignal(),
			waitStatus.TrapCause())

		if waitStatus.Exited() {
			logger.Debug("unexpected app exit")
			return fmt.Errorf("unexpected app exit")
		}

		if waitStatus.Signaled() {
			logger.Debug("unexpected app signalled")
			return fmt.Errorf("unexpected app signalled")
		}

		//we should be in the Stopped state
		if waitStatus.Stopped() {
			sigEnum := SignalEnum(int(waitStatus.StopSignal()))
			logger.Debugf("Process Stop Signal - code=%d enum=%s str=%s",
				waitStatus.StopSignal(), sigEnum, waitStatus.StopSignal())
		} else {
			//TODO:
			//check for Exited or Signaled process state (shouldn't happen)
			//do it for context indicating that we are in a failed state
		}
	} else {

View on GitHub (pinned to 81940d17fa)

Solutions

1. Run the app manually first and fix any early-exit (crash, bad config, missing args) before tracing.
2. Ensure the container/runtime grants ptrace (SYS_PTRACE capability, /proc/sys/kernel/yama/ptrace_scope).
3. Verify the monitored binary is compatible with the tracer (arch, dynamic vs static linking).

Example fix

// before
// docker run --cap-add= (no SYS_PTRACE) -> app misbehaves under ptrace
// after
docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined myimage

// pre-flight: run the target briefly and confirm it stays alive
if err := exec.Command(binPath, args...).Run(); err != nil {
    return fmt.Errorf("app exits on its own before tracing: %v", err)
}

err := trace(binPath, args)
if err != nil && strings.Contains(err.Error(), "unexpected app exit") {
    // inspect app logs/core dump, fix app-side early exit, retry trace
}

When it happens

Trigger: The traced application exits (returns from main / os.Exit) while the tracer expected it to keep running and hit traced events.

Common situations: App crashes or exits early due to its own config error, monitoring wrapper incompatible with the app's runtime (e.g. static binary, seccomp blocking ptrace), or container lacking SYS_PTRACE capability causing app misbehavior.

Related errors

• one or more monitors failed: fanotify.error=%q, ptrace.error
• insufficient permissions
• ptmon: target app startup failed: %q
• ptmon: target app failed with state %q
• sensor shutdown before monitor stop

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/aadd2440b5aa8926. Report an issue: GitHub.