-
-
Notifications
You must be signed in to change notification settings - Fork 492
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Log flooded with: ERR [eBPF events #1] error: unexpected EOF #1099
Comments
Hi @Selora , This could be a problem with mixed versions of the ebpf modules, i.e., v1.6.5 modules loaded by daemon v1.6.2. Could you post the output of : if in the output appears: sys_exit_execve/execveat, then the modules are for v1.6.5 version, no v1.6.2. Also check that you don't have other modules under /etc/opensnitchd/ or /usr/local/lib/opensnitchd/ebpf/ |
Ah-ah! You got it!! Haven't solved it yet, but here's what I got setup:
It looks like the arch package in the I'll update when I figure out how I want to deal with version mismatch, but everything coincides: the time of the 1.6.5 release, version mismatch, etc. Thanks a lot for the help, and thanks for maintaining this wonderful piece of software! |
Good catch! I was having the exact same issue as @Selora. I tried building the opensnitch PKGBUILD after a simple version-bump but that isn't working (linker error in the build stage... beyond me). Another solution is to rebuild opensnitch-ebpf-module from the 1.6.4 tag of the AUR package. That does work:
|
Hello, maintainer of the ebpf module AUR package here. Bumping the ebpf module without checking whether the main opensnitch package has been updated was my bad, and won't happen in the future. For now, I can't exactly downgrade the package so we'll just have to wait until the main package is updated. Those who have already upgraded should downgrade like the above comment mentions. Sorry about that! |
Hey @nnsee , thank you for maintaining that package!! I'll add a check to disable this module if there're more than n errors not to flood the logs, and display a visual warning to let the users know that the module is incompatible. |
A big thank you @gustavo-iniguez-goya for such a constructive and helpful response! I feel like a number of devs would have said "somebody else is messing up" and done nothing here. It's great that you're taking this as an opportunity to make things better on your end. Way to go! 👏 |
tried to downgrade but also thanks to @nnsee for chiming in here and handling the problem for the future |
@atomGit |
I've just pushed 1.6.5-2 of the ebpf module on the AUR, which is really 1.6.4 in disguise, and should fix most issues until 1.6.5 is actually released and the ebpf module package updated. Most people having issues right now should upgrade the |
perfect - thanks! |
i get this always when changing monitor method to ebpf on arch, why ? i get proc as default one always! here is daemon+ui versions i have opensnitch-ebpf-module 1.6.5-3 latest one on aur |
@molitona : you have different versions of opensnitch-ebpf-module and opensnitch. Your opensnitch is 1.6.0 and the module is 1.6.5. These have to be the same otherwise you'll get errors, as indicated clearly in the first response to this bug report : #1099 (comment) Also, this comment is pinned on the opensnitch-ebpf-module AUR page:
|
cloning doesn't work. downloaded snapshot don't contain .git |
@molitona this isn't really the right place to discuss this. The issue is closed because it was not an issue with opensnitch at all. It had to do with a premature version bump by the AUR package maintainer for opensitch-epbf-module. That whole situation is resolved now, so none of the above is relevant to your own problems. As I pointed out you had a mismatch between versions of opensnitch and the epbf-module. About this:
I have no idea what you mean. |
with latest opensitch on official repo + ur latest one on aur of ebpf i still get
|
type that cloning cmd in terminal and see i have latest opensnitch and the epbf-module now and got
cloning command don't clone anything test it |
I copied that from my own terminal months ago... And it works just fine now too. To reiterate though: this is not the place to debug your issues installing these tools. Please try IRC: ircs://irc.libera.chat/archlinux or the arch forums: https://bbs.archlinux.org/ |
for some reason i dunno cloning is stuck for me. i solved it by cloning in other machine. could u tell me what extra-x86_64-build do ? |
got this why @Marcool04 sorry i cannot use forum now and never used irc
|
Describe the bug
opensnitch.log gets flooded with the following message:
[2024-02-29 02:24:55] ERR [eBPF events #1] error: unexpected EOF
Include the following information:
1.6.2
Linux 6.7.6-arch1-1 #1 SMP PREEMPT_DYNAMIC Fri, 23 Feb 2024 16:31:48 +0000 x86_64 GNU/Linux
To Reproduce
Not sure what I can do. It spams several of these events. In a day, before the log files are rotated, they can easily grow to several dozen MB. Latest is 45MB.
These are the last events before my logs were flooded:
Additional context
Everything seems to be working. If I switch the interception backend to audit or process, then this goes away. However, with the eBPF backend, interception still works. I would like to provide more info but I have very little understanding of how eBPF programs works.
The text was updated successfully, but these errors were encountered: