slimtoolkit/slim · error

unexpected app signalled

Error message

unexpected app signalled

What it means

ptrace.App.start returns this error when the traced application process terminates via a signal rather than exiting normally. waitStatus.Signaled() means the kernel killed or signaled the process to death (e.g. SIGKILL, SIGSEGV), so the sensor cannot continue tracing it. It is a sentinel wrapper indicating the trace target died abnormally.

Source

Thrown at pkg/monitor/ptrace/ptrace.go:574

	waitStatus, ok := app.cmd.ProcessState.Sys().(syscall.WaitStatus)
	if ok {
		logger.Debugf("Target process wait status - %v (Exited=%v Signaled=%v Signal='%v' Stopped=%v StopSignal='%v' TrapCause=%v)",
			waitStatus,
			waitStatus.Exited(),
			waitStatus.Signaled(),
			waitStatus.Signal(),
			waitStatus.Stopped(),
			waitStatus.StopSignal(),
			waitStatus.TrapCause())

		if waitStatus.Exited() {
			logger.Debug("unexpected app exit")
			return fmt.Errorf("unexpected app exit")
		}

		if waitStatus.Signaled() {
			logger.Debug("unexpected app signalled")
			return fmt.Errorf("unexpected app signalled")
		}

		//we should be in the Stopped state
		if waitStatus.Stopped() {
			sigEnum := SignalEnum(int(waitStatus.StopSignal()))
			logger.Debugf("Process Stop Signal - code=%d enum=%s str=%s",
				waitStatus.StopSignal(), sigEnum, waitStatus.StopSignal())
		} else {
			//TODO:
			//check for Exited or Signaled process state (shouldn't happen)
			//do it for context indicating that we are in a failed state
		}
	} else {
		logger.WithError(err).Error("process status error")
		return fmt.Errorf("process status error")
	}

	app.pgid, err = syscall.Getpgid(app.cmd.Process.Pid)

View on GitHub (pinned to 81940d17fa)

Solutions

1. Check dmesg/journal for OOM kills or segfault messages around the failure time
2. Run the app under the tracer manually to reproduce the signal (e.g. SIGSEGV) and fix the app bug
3. Ensure no external supervisor (systemd, k8s liveness probe, watchdog) is killing the process during tracing
4. Raise container/app memory limits if OOM-killed

err := tracer.Trace(cmd); if err != nil && strings.Contains(err.Error(), "unexpected app signalled") { // inspect app crash: dmesg, core dumps, exit signal
    log.Errorf("traced app killed by signal: %v", err)
}

When it happens

Trigger: During trace() -> start(), the ptrace waitpid loop observes a wait status with Signaled() set — the child process was killed by a signal before it could stop or exit normally.

Common situations: App crashes with SIGSEGV/SIGBUS due to a bug; OOM killer sends SIGKILL; user or orchestrator kills the traced process; container runtime terminates the PID.

Related errors

• insufficient permissions
• one or more monitors failed: fanotify.error=%q, ptrace.error
• ptmon: target app startup failed: %q
• ptmon: unexpected target app state %q
• ptmon: target app failed with state %q

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/aa9f535ce220eb3b. Report an issue: GitHub.