"error opening device /dev/sysdig0" about sysdig HOT 41 CLOSED

I couldn't start, but after $ sudo sysdig-probe-loader it works.

from sysdig.

Thank you for your answer.It worked after i turned secure boot off.

from sysdig.

you need run this command:

$ whereis sysdig-probe-loader
sysdig-probe-loader: /usr/bin/sysdig-probe-loader
$ /usr/bin/sysdig-probe-loader

it's works.

from sysdig.

Looks like you have secure boot enabled on your system, and so your kernel refuses to load any module that didn't ship with the distribution. Would you be able to try disabling secure boot? You can use this thread as a reference:

http://unix.stackexchange.com/questions/157539/cant-load-zfs-kernel-module-on-fedora-with-secure-boot-required-key-not-avai

Unfortunately, unless the Fedora maintainers decide to ship sysdig in their distribution (and sign the precompiled module with their key) that seems like the only feasible solution.

from sysdig.

Upgraded to newest kernel, everything works, thanks @luca3m

from sysdig.

I just tried with a brand new fc21 and it worked out of the box for me.

Can you try and see what's the output for:

1. modprobe sysdig-probe

2. insmod /lib/modules/3.17.8-300.fc21.x86_64/extra/sysdig-probe.ko

3. After those two commands, verify if there's something related at the end of /var/log/messages

from sysdig.

Usually if your system is out-of-date it fails to download the exact version of kernel-headers because they may be not available anymore. In that case you can upgrade the kernel and relaunch manually dkms to let it recompile the module. Removing and installing sysdig did this I think.

from sysdig.

@magoo23 Have you installed kernel-headers? The package is called linux-headers, check that the installed version matched the version of the kernel you are running.

from sysdig.

Thanks for using sysdig!

Which distribution are you using, and can you send the output of uname -a?
The installer tries to guess what is more likely to be the kernel headers package name according to the distribution, but it can fail, especially if the kernel that you're currently running is out of date.

from sysdig.

Linux ---- 3.12.9-x86-linode56 #1 SMP Mon Feb 3 09:46:59 EST 2014 i686 GNU/Linux

(The dashes are the hostname, which I'm scrubbing.)

On Thu, Apr 3, 2014 at 2:12 PM, Gianluca Borello
[email protected]:

Thanks for using sysdig!

Which distribution are you using, and can you send the output of uname -a?
The installer tries to guess what is more likely to be the kernel headers
package name according to the distribution, but it can fail, especially if
the kernel that you're currently running is out of date.

Reply to this email directly or view it on GitHubhttps://github.com//issues/30#issuecomment-39492484
.

from sysdig.

Distribution? I might have to replicate it here and see if you're actually using a kernel version for which the headers are still available from the distro repo.

from sysdig.

Ubuntu 10.04

On Thu, Apr 3, 2014 at 2:16 PM, Gianluca Borello
[email protected]:

Distribution? I might have to replicate it here and see if you're actually
using a kernel version for which the headers are still available from the
distro repo.

Reply to this email directly or view it on GitHubhttps://github.com//issues/30#issuecomment-39492877
.

from sysdig.

It looks like the custom kernels distributed by Linode don't ship with kernel headers, and there's no trivial way to get them.
I haven't looked too deeply, so it might be possible that Linode support knows better, but I'm confident it won't work, it seems that those kernels also ship completely monholitical (/lib/modules/3.13.7-x86_64-linode38 is empty).

I managed to make it work on Ubuntu 10.04 on Linode by switching to a distribution-provided kernel (for which the kernel headers are correctly available from the Canonical repos) and enabling pv-grub under the linode console.

These are roughly the steps that I followed:

https://library.linode.com/custom-instances/pv-grub-howto#sph_ubuntu-10-04-lts-lucid

I understand this can be a pain in the ass, but unfortunately how cloud providers decide to ship kernels is totally out of our control, we can just advise to use the kernels from your original linux distribution in this case.

from sysdig.

Ouch, that's a bummer! I probably won't make that switch, sorry to say, but
if another solution comes up, please update this issue so I can check it
out.

Thanks for your help.

On Thu, Apr 3, 2014 at 4:44 PM, Gianluca Borello
[email protected]:

It looks like the custom kernels distributed by Linode don't ship with
kernel headers, and there's no trivial way to get them.
I haven't looked too deeply, so it might be possible that Linode support
knows better, but I'm confident it won't work, it seems that those kernels
also ship completely monholitical (/lib/modules/3.13.7-x86_64-linode38 is
empty).

I managed to make it work on Ubuntu 10.04 on Linode by switching to a
distribution-provided kernel (for which the kernel headers are correctly
available from the Canonical repos) and enabling pv-grub under the linode
console.

These are roughly the steps that I followed:

https://library.linode.com/custom-instances/pv-grub-howto#sph_ubuntu-10-04-lts-lucid

I understand this can be a pain in the ass, but unfortunately how cloud
providers decide to ship kernels is totally out of our control, we can just
advise to use the kernels from your original linux distribution in this
case.

Reply to this email directly or view it on GitHubhttps://github.com//issues/30#issuecomment-39508843
.

from sysdig.

Thanks!

If sysdig gets more traction, we'll put some more effort into improving the binary installation by providing precompiled modules for a bunch of kernel versions out there.

I see that those Linode kernels all have a /proc/config.gz, so in theory we might be able to regenerate them on our machines and build a sysdig-probe binary. That's definitely a whole lot of work.

In the meantime I'm closing the issue, please if you have a chance try sysdig on other machines :)

from sysdig.

I was excited to finally get a chance to use sysdig; a friend recommended it to me a couple of months back and I luckily haven't needed it until now. I unfortunately also ran into this issue (customer's server is Ubuntu 10.04 on Linode as well) so I'm still waiting for the chance to try out the product.

from sysdig.

I got the same error on fedora 21(Linux localhost.localdomain 3.17.8-300.fc21.x86_64 #1 SMP Thu Jan 8 23:32:49 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux)

from sysdig.

What version of the kernel-devel you currently have installed?

from sysdig.

my kernel-devel is kernel-devel-3.17.8-300.fc21.x86_64.

from sysdig.

So if this is installed it should work.

Please send the output of:

1. /usr/lib/dkms/dkms_autoinstaller start

2. ls /lib/modules

3. find /lib/modules | grep sysdig

Also, make sure to run sysdig as root

from sysdig.

All log, And it don't work, What happened?

[root@localhost chenhao]# dnf install sysdig
依赖关系解决。
==========================================================================================================================
 软件包                      架构                        版本                           仓库                         大小
==========================================================================================================================
安装:
 sysdig                      x86_64                      0.1.94-1                       draios                      549 k

事务概要
==========================================================================================================================
安装  1 Package

总下载：549 k
安装大小：1.8 M
确定吗？[y/N]：y
下载软件包：
sysdig-0.1.94-x86_64.rpm                                                                   58 kB/s | 549 kB     00:09    
--------------------------------------------------------------------------------------------------------------------------
总计                                                                                       58 kB/s | 549 kB     00:09     
运行事务检查
事务检查成功。
运行事务测试
事务测试成功。
运行事务
  安装: sysdig-0.1.94-1.x86_64                                                                                        1/1 

Creating symlink /var/lib/dkms/sysdig/0.1.94/source ->
                 /usr/src/sysdig-0.1.94

DKMS: add completed.

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
make KERNELRELEASE=3.17.8-300.fc21.x86_64 -C /lib/modules/3.17.8-300.fc21.x86_64/build M=/var/lib/dkms/sysdig/0.1.94/build...
cleaning build area...

DKMS: build completed.

sysdig-probe:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/3.17.8-300.fc21.x86_64/extra/
Adding any weak-modules

depmod...

DKMS: install completed.
  验证: sysdig-0.1.94-1.x86_64                                                                                        1/1 

已安装:
  sysdig.x86_64 0.1.94-1                                                                                                  

完毕！
[root@localhost chenhao]# sysdig
Unable to load the driver
error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.

[root@localhost chenhao]# rpm -qa|grep kernel
kernel-core-3.17.8-300.fc21.x86_64
abrt-addon-kerneloops-2.3.0-3.fc21.x86_64
kernel-headers-3.17.8-300.fc21.x86_64
libreport-plugin-kerneloops-2.3.0-5.fc21.x86_64
kernel-devel-3.17.8-300.fc21.x86_64
kernel-3.17.8-300.fc21.x86_64
kernel-modules-3.17.8-300.fc21.x86_64

[root@localhost chenhao]# /usr/lib/dkms/dkms_autoinstaller start
dkms: running auto installation service for kernel 3.17.8-300.fc21.x86_64
 Done. 

[root@localhost chenhao]# sysdig
Unable to load the driver
error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.

[root@localhost chenhao]# ls /lib/modules
3.17.8-300.fc21.x86_64

[root@localhost chenhao]# find /lib/modules | grep sysdig
/lib/modules/3.17.8-300.fc21.x86_64/extra/sysdig-probe.ko

from sysdig.

[root@localhost ~]# modprobe sysdig-probe
modprobe: ERROR: could not insert 'sysdig_probe': Required key not available
[root@localhost ~]# insmod /lib/modules/3.17.8-300.fc21.x86_64/extra/sysdig-probe.ko
insmod: ERROR: could not insert module /lib/modules/3.17.8-300.fc21.x86_64/extra/sysdig-probe.ko: Required key not available
[root@localhost ~]# cat /var/log/messages
cat: /var/log/messages: 没有那个文件或目录

from sysdig.

I'm having the same error on Amazon Linux

error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.

3.14.35-28.38.amzn1.x86_64

from sysdig.

Please make sure the kernel devel files were updated, and try to relaunch dkms and post the output if you got any error:

sudo yum -y install kernel-devel-$(uname -r)
sudo /usr/lib/dkms/dkms_autoinstaller start

from sysdig.

Thanks so much, Reeze! That solved it for me as well

from sysdig.

Thanks do much Reeze! It also solved my problem

from sysdig.

I ran into this error after attempting the "basic install" for Linux as outlined here. I'm running a Fedora 23 VM that hadn't been updated in probably 2 months. Anyway, it would have been nice if the basic install instructions had cautioned me to make sure my system was up to date before running the curl command.

It also wasn't clear to me how to fix things at this point. I ended up using the a package remove / install and now it appears to be working:

dnf remove sysdig
dnf install sysdig

from sysdig.

am also facing the same problem
$ sudo sysdig
error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.
when i run the command uname -a i get the following output Linux KaliLinuxOS 4.0.0-kali-686-pae #1 SMP Debian 4.0.4-1+kali2 (2015-06-03) i686 GNU/Linux any help please

from sysdig.

luca3m let me try and install the kernel headers

from sysdig.

😭

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04 LTS
Release:        16.04
Codename:       xenial
$ uname -r
4.4.0-24-generic
$ sudo /usr/bin/sysdig-probe-loader 
* Unloading sysdig-probe, if present
rmmod: ERROR: Module sysdig_probe is not currently loaded
* Running dkms autoinstall
* Trying to load a system sysdig-probe, if present
* Trying to load a dkms sysdig-probe, if present
* Trying to find precompiled sysdig-probe for 4.4.0-24-generic
Found kernel config at /boot/config-4.4.0-24-generic
Found precompiled module at ~/.sysdig/sysdig-probe-0.10.1-x86_64-4.4.0-24-generic-077d92578f5387745d54c23bd0771d34.ko, loading module
insmod: ERROR: could not insert module /home/samuel/.sysdig/sysdig-probe-0.10.1-x86_64-4.4.0-24-generic-077d92578f5387745d54c23bd0771d34.ko: Required key not available

from sysdig.

@ahjdzx you are apparently running in secure boot mode, so it really makes sense that a third party module doesn't work. I suggest to disable it from your BIOS, or follow the instructions at http://askubuntu.com/questions/762254/why-do-i-get-required-key-not-available-when-install-dkms-modules-in-ubuntu-16

Essentially, this comment still applies: #30 (comment)

from sysdig.

I am trying to run sysdig on https://www.scaleway.com/.

I am running into an error:

$ sysdig
Unable to load the driver
error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.

I have installed sysdig using:

rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public
curl -s -o /etc/yum.repos.d/draios.repo http://download.draios.com/stable/rpm/draios.repo
rpm -i http://mirror.us.leaseweb.net/epel/6/i386/epel-release-6-8.noarch.rpm
yum -y install kernel-devel-$(uname -r)

The following has failed:

$ yum -y install kernel-devel-$(uname -r)
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.nl.leaseweb.net
 * epel: mirror.1000mbps.com
 * extras: mirror.1000mbps.com
 * updates: mirror.1000mbps.com
No package kernel-devel-4.5.7-std-3 available.
Error: Nothing to do

I don't understand whats the reason the kernel version appears as "4.5.7-std-3":

$ uname -a
Linux k8s-master-0001 4.5.7-std-3 #1 SMP Tue Jul 12 09:56:30 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
$ cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

The installed kernel-header version is v3.10:

$ yum list kernel*
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.nl.leaseweb.net
 * epel: mirror.1000mbps.com
 * extras: mirror.1000mbps.com
 * updates: mirror.1000mbps.com
Installed Packages
kernel-devel.x86_64                                                  3.10.0-514.2.2.el7                                        @updates
kernel-headers.x86_64                                                3.10.0-514.2.2.el7                                        @updates
Available Packages
kernel.x86_64                                                        3.10.0-514.2.2.el7                                        updates
kernel-abi-whitelists.noarch                                         3.10.0-514.2.2.el7                                        updates
kernel-debug.x86_64                                                  3.10.0-514.2.2.el7                                        updates
kernel-debug-devel.x86_64                                            3.10.0-514.2.2.el7                                        updates
kernel-doc.noarch                                                    3.10.0-514.2.2.el7                                        updates
kernel-tools.x86_64                                                  3.10.0-514.2.2.el7                                        updates
kernel-tools-libs.x86_64                                             3.10.0-514.2.2.el7                                        updates
kernel-tools-libs-devel.x86_64                                       3.10.0-514.2.2.el7                                        updates

What am I missing?

from sysdig.

Never used Scaleway, but these are my comments:

• Their kernel is custom, and gets used regardless of your distribution, hence the discrepancy with yum. But since they provide the sources, you should be able with a few manual commands to compile sysdig probe manually. Pointers: https://github.com/scaleway/kernel-tools#how-to-build-a-custom-kernel-module (from scaleway). After you set up the kernel sources in the right location as pointed in the article, reinstalling sysdig should be enough so that dkms can compile the kernel module. If it works, you can report it here and we will add it to the list of kernels to precompile.

• Also make sure that you have access to the underlying kernel and can properly run "modprobe/insmod". Some providers virtualize VPS as containers, so if that's the case you might have to switch from the Scaleway VPS to the Scaleway dedicated server (most likely not, but just pointing this detail for completeness)

from sysdig.

Also make sure that you have access to the underlying kernel and can properly run "modprobe/insmod". Some providers virtualize VPS as containers, so if that's the case you might have to switch from the Scaleway VPS to the Scaleway dedicated server (most likely not, but just pointing this detail for completeness)

This is a dedicated server.

from sysdig.

Same issue here with CentOS 7

[root@dcosb tmp]# modprobe sysdig-probe
modprobe: FATAL: Module sysdig-probe not found.

[root@dcosb tmp]# uname -r
3.10.0-327.36.3.el7.x86_64

[root@dcosb tmp]# sudo yum -y install kernel-devel-$(uname -r)
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile

• base: mirror.spreitzer.ch
• epel: mirror.23media.de
• extras: mirror.yannic-bonenberger.com
• updates: mirror.yannic-bonenberger.com
  No package kernel-devel-3.10.0-327.36.3.el7.x86_64 available.
  Error: Nothing to do

[root@dcosb tmp]# /usr/lib/dkms/dkms_autoinstaller start
dkms: running auto installation service for kernel 3.10.0-327.36.3.el7.x86_64
Error! echo
Your kernel headers for kernel 3.10.0-327.36.3.el7.x86_64 cannot be found at
/lib/modules/3.10.0-327.36.3.el7.x86_64/build or /lib/modules/3.10.0-327.36.3.el7.x86_64/source.
Done.

BUT
[root@dcosb tmp]# yum install kernel-devel
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile

• base: mirror.spreitzer.ch
• epel: mirror.23media.de
• extras: mirror.yannic-bonenberger.com
• updates: mirror.yannic-bonenberger.com
  Package kernel-devel-3.10.0-514.2.2.el7.x86_64 already installed and latest version
  Nothing to do
  [root@dcosb tmp]#

from sysdig.

3.10.0-327 kernel headers are not available any more on centos repositories, you have two options:

1. grab the rpm from rpmfind.net or something similar and install it manually
2. upgrade your kernel to the latest version

from sysdig.

@luca3m I am getting the same problem with:

[root@k8s-worker ~]# uname -r
4.5.7-std-3

Here is the full installation log:

[root@k8s-worker ~]# curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash
* Detecting operating system
* Installing EPEL repository (for DKMS)
* Installing sysdig public key
* Installing sysdig repository
* Installing kernel headers
http://mirror.nl.leaseweb.net/epel/7/x86_64/repodata/144e5d4fbe6ca198e35c0de0ce21eb319bb7c55d15d44b41b4b2c79f33445a89-primary.sqlite.xz: [Errno 14] HTTP Error 404 - Not Found
Trying other mirror.
To address this issue please refer to the below knowledge base article

https://access.redhat.com/articles/1320623

If above article doesn't help to resolve this issue please create a bug on https://bugs.centos.org/

https://epel.mirror.wearetriple.com/7/x86_64/repodata/2306fbb3a104d881b2e44bd3f518f3b64abd165e0cbd86106558c99a888c45a3-updateinfo.xml.bz2: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
Error: Nothing to do
Unable to find kernel development files for the current kernel version 4.5.7-std-3
This usually means that your system is not up-to-date or you installed a custom kernel version.
The installation will continue but you'll need to install these yourself in order to use sysdig.
Please write to the mailing list at https://groups.google.com/forum/#!forum/sysdig
if you need further assistance.
* Installing sysdig
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
warning: /var/cache/yum/x86_64/7/epel/packages/dkms-2.3-1.20161202gitde1dca9.el7.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID 352c64e5: NOKEY
Public key for dkms-2.3-1.20161202gitde1dca9.el7.noarch.rpm is not installed
Importing GPG key 0x352C64E5:
 Userid     : "Fedora EPEL (7) <[email protected]>"
 Fingerprint: 91e9 7d7c 4a5e 96f1 7f3e 888f 6a2f aea2 352c 64e5
 Package    : epel-release-7-6.noarch (installed)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
Warning: RPMDB altered outside of yum.

Creating symlink /var/lib/dkms/sysdig/0.15.0/source ->
                 /usr/src/sysdig-0.15.0

DKMS: add completed.

Module build for the currently running kernel was skipped since the
kernel source for this kernel does not seem to be installed.

from sysdig.

@gianlucaborello

[..] If it works, you can report it here and we will add it to the list of kernels to precompile.

Has this been done?

from sysdig.

I have prepared the kernel, then exported KDIR=/lib/modules/$(uname -r)/build/ and then tried yum -y reinstall sysdig, which gives:

Transaction test succeeded
Running transaction
  Installing : sysdig-0.15.0-1.x86_64                                                                                1/1
Error! DKMS tree already contains: sysdig-0.15.0
You cannot add the same module/version combo more than once.

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
make -j4 KERNELRELEASE=4.5.7-std-3 -C /lib/modules/4.5.7-std-3/build M=/var/lib/dkms/sysdig/0.15.0/build...(bad exit status: 2)
Error! Bad return status for module build on kernel: 4.5.7-std-3 (x86_64)
Consult /var/lib/dkms/sysdig/0.15.0/build/make.log for more information.

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
make -j4 KERNELRELEASE=4.5.7-std-3 -C /lib/modules/4.5.7-std-3/build M=/var/lib/dkms/sysdig/0.15.0/build...(bad exit status: 2)
Error! Bad return status for module build on kernel: 4.5.7-std-3 (x86_64)
Consult /var/lib/dkms/sysdig/0.15.0/build/make.log for more information.
warning: %post(sysdig-0.15.0-1.x86_64) scriptlet failed, exit status 10
Non-fatal POSTIN scriptlet failure in rpm package sysdig-0.15.0-1.x86_64
  Verifying  : sysdig-0.15.0-1.x86_64                                                                                1/1

Installed:
  sysdig.x86_64 0:0.15.0-1

Complete!

Is it me missing something?

from sysdig.

Im using in WSL

"uname -a" : Linux BR2L11792L 4.4.0-17763-Microsoft #864-Microsoft Thu Nov 07 15:22:00 PST 2019 x86_64 x86_64 x86_64 GNU/Linux

and still getting the error output from sysdig:

"Unable to load the driver error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded."

from sysdig.

Hi @Josh7GAS. The issue you have chimed in on has been closed for longer than WSL has existed :)

The sysdig tool does not formally support WSL. WSL2 runs a Linux kernel inside a virtual machine (available here), so there's a possibility that sysdig might be able to run on top of WSL2 without too much major surgery, although it would come with the caveat that it would only monitor syscalls performed by the WSL virtual machine and not by the host Windows system.

However, all of the above is entirely speculative. I don't even have a Windows system to try to run it myself.

from sysdig.