Initialization issues during scap_init

Communities Sysdig OSS
1

Hi!

I’m using sysdig via the Guix package, and since recently, it stopped working, printing:
```
$ sudo sysdig --modern-bpf
Initialization issues during scap_init
$ uname -r
6.16.12
```

Has someone encountered this problem? Any idea of how to fix it? I had commented on this bug, where someone else (on Fedora) seemed affected as well: Failed to install Sysdig in Fedora 42 · Issue #2165 · draios/sysdig · GitHub

Thank you! I look forward being able to use this useful tool again.

2

Thank you for the “uname -r” , can I request a “uname -a” ?

I see as well your comment https://github.com/draios/sysdig/issues/2165

Might be an issue with that specific kernel version. Can you try using a different version and see if the results are the same?

2 other ideas:

  • do you get the same issue with --universal-bpf ?
  • modern-bpf uses less kernel space memory and more user space memory. Try provisioning additional resources on the sysdig-agent daemonset kubectl edit daemonset -n sysdig-agent sysdig-agent

Those are some initial ideas for troubleshooting. I would love to see more from the agent logs as well! looking forward to your reply!

1 Like
3

Thanks for your reply!

uname -a returns Linux terra 6.16.12 #1 SMP PREEMPT_DYNAMIC 1 x86_64 GNU/Linux currently.
The oldest kernel I have around is 6.14.11 from last June. Next time I reboot I’ll select it and try!

Am I supposed to run sudo sysdig –universal-bpf to try that option? It prints sysdig: unrecognized option ‘–universal-bpf’, at least with my version, which issysdig version 0.40.1.

Thanks for the ideas! Meanwhile I tried to build a newer falcosecurity-libs package to use with sysdig, but anything newer than 0.20.0 is not compatible even with the latest commit of sysdig(that’s been reported here: Fails to build on 6.13 · Issue #2151 · draios/sysdig · GitHub ), so I’m at a loss :-).

Oh, by the way, I do not use Kubernetes or the sysdig-agent; I run sysdig directly on my workstation.

1 Like
4

Hey @apteryx , I think you’re hitting a bpf verifier issue that was fixed here, could you please provide the output of the following command?

sudo sysdig --modern-bpf --log-level trace
1 Like