Sometimes appear eBPF warning messages after reboot. #868
Comments
Tandaran3
changed the title
|
Hi @Tandaran3 , Please, set log level to DEBUG under Preferences -> Nodes, reproduce the issue again and post the logs. |
|
Sure. Sorry. I`m remove some IP for privacy purpose.
|
|
Thank you @Tandaran3 , You can delete everything after the lines I think there're some log lines missing, so could you empty the log ( there should be a few attempts to load the file but from: /usr/local/lib/opensnitchd/ebpf/opensnitch.o |
|
Here. I did "sudo truncate -s0 /var/log/opensnitchd.log ; sudo reboot" before have posibility reproduce bag.
�[2m[2023-03-01 09:06:22]�[0m �[97m�[104m IMP �[0m Got signal: quit |
|
Part 2
|
|
I have same problem in arch linux & Manjaro with kernel 6.1 |
|
thank you @Tandaran3 ! this is the error: I'll try to reproduce it. @Maziar123 , without logs, it's hard to determine if your problem is the same than this issue (different distro, different kernel) |
|
I've rebooted my Devuan Chimaera like 40 times, and it hasn't failed not a single time :( If I remember correctly (with v1.4.x), this issue ( |
|
Maybe you dig in a wrong place? I believe that "kretprobe/tcp_v4_connect" debag code that you think the problem, arose before last reboot, before appearing bug. |
|
Same issue in archlinux 6.3.9-arch1-1 after update opensnitch from 1.5.8-1 to 1.6.0-1 |
|
Same issue with archlinux |
|
Same here.. [2023-07-04 18:32:24] IMP Start writing logs to /var/log/opensnitchd.log
[2023-07-04 18:32:24] ERR
unable to load eBPF module (opensnitch.o). Your kernel version (6.3.3.15.realtime2-1-rt) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2023-07-04 18:32:24] ERR [eBPF]:
unable to load eBPF module (opensnitch.o). Your kernel version (6.3.3.15.realtime2-1-rt) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2023-07-04 18:32:24] WAR error starting ebpf monitor method:
unable to load eBPF module (opensnitch.o). Your kernel version (6.3.3.15.realtime2-1-rt) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2023-07-04 18:32:24] WAR Unable to set new process monitor (ebpf) method from disk:
unable to load eBPF module (opensnitch.o). Your kernel version (6.3.3.15.realtime2-1-rt) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2023-07-04 18:32:24] ERR [eBPF DNS]:
unable to load eBPF module (opensnitch-dns.o). Your kernel version (6.3.3.15.realtime2-1-rt) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2023-07-04 18:32:24] WAR EBPF-DNS: Unable to attach ebpf listener:
unable to load eBPF module (opensnitch-dns.o). Your kernel version (6.3.3.15.realtime2-1-rt) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2023-07-04 18:33:35] IMP UI connected, dispathing queued alerts: 0
[2023-07-04 18:33:35] WAR notification channel closed by the server
[2023-07-04 18:33:36] ERR Connection to the UI service lost.
[2023-07-04 18:33:37] IMP UI connected, dispathing queued alerts: 0$ opensnitchd --version
1.6.0
$ neofetch --off
alf@studio
----------
OS: EndeavourOS Linux x86_64
Host: B650 GAMING X AX
Kernel: 6.3.3.15.realtime2-1-rt
Uptime: 17 mins
Packages: 986 (pacman)
Shell: zsh 5.9
Resolution: 1920x1200, 1920x1200
DE: Cinnamon 5.8.3
WM: Mutter (Muffin)
WM Theme: CBlack (Adwaita)
Theme: CBlack [GTK2/3]
Icons: Adwaita [GTK2/3]
Terminal: terminator
CPU: AMD Ryzen 7 7700 (16) @ 3.800GHz
GPU: AMD ATI 0f:00.0 Raphael
Memory: 1849MiB / 31238MiB |
|
according to @red-gecko27's logs, the ebpf modules are not installed: You need those modules in order ebpf to work. |
|
You can download precompiled modules from the github Action (at the bottom of the page, opensnitch-ebpf-modules-6.0-master): https://github.com/evilsocket/opensnitch/actions/runs/5322202159 And copy the modules to /usr/lib/opensnitchd/ebpf/ (create the dirs if they don't exist). |
|
@gustavo-iniguez-goya Thanks, that worked very well for me |
|
If you're on Arch Linux, you need to install opensnitch-ebpf-module from AUR to make ebpf work (no idea why it's not part of the official package, seems broken). |
|
@jiripospisil |
|
I've changed the behaviour to send 2 errors: one if the module is not found in any of the paths, and another one if there have been any errors loading the module. Hopefully it'll help users to identify better what went wrong. Thank you everyone! |
Describe the bug
About once for ten reboots opensnitch show two warning messages about kernel incompatibility with eBPF. Despite this, opensnitch and gui works fine. If they did not appear immediately after reboot/cold start, then in the future during the high hours work they will not appear.
Include the following information:
To Reproduce
Whean DE fully loaded a few seconds after this, two warning messages appear.
Steps to reproduce the behavior:
Just reboot 10-15 times and messages appear.
Post error logs:
�[2m[2023-02-28 10:40:28]�[0m �[97m�[104m IMP �[0m Start writing logs to /var/log/opensnitchd.log
�[2m[2023-02-28 10:40:28]�[0m �[97m�[41m ERR �[0m
unable to load eBPF module (opensnitch.o). Your kernel version (5.10.0-21-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'
�[2m[2023-02-28 10:40:28]�[0m �[97m�[41m ERR �[0m [eBPF]:
unable to load eBPF module (opensnitch.o). Your kernel version (5.10.0-21-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'
�[2m[2023-02-28 10:40:28]�[0m �[97m�[43m WAR �[0m error starting ebpf monitor method:
unable to load eBPF module (opensnitch.o). Your kernel version (5.10.0-21-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'
�[2m[2023-02-28 10:40:28]�[0m �[97m�[43m WAR �[0m Unable to set new process monitor (ebpf) method from disk:
unable to load eBPF module (opensnitch.o). Your kernel version (5.10.0-21-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'
�[2m[2023-02-28 10:40:47]�[0m �[97m�[104m IMP �[0m UI connected, dispathing queued alerts: 0
�[2m[2023-02-28 10:40:47]�[0m �[97m�[43m WAR �[0m notification channel closed by the server
�[2m[2023-02-28 10:40:48]�[0m �[97m�[41m ERR �[0m Connection to the UI service lost.
�[2m[2023-02-28 10:40:49]�[0m �[97m�[104m IMP �[0m UI connected, dispathing queued alerts: 0
Screenshots
The text was updated successfully, but these errors were encountered: