search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.54k stars 1.7k forks source link

STAP fails #2650

Open robeving opened 5 years ago

robeving commented 5 years ago

Thanks for creating an issue! But first: did you read our community guidelines? https://cuckoo.sh/docs/introduction/community.html

My issue is:

Sometimes STAP fails to return results. After lots of debugging it looks like the process crashes. I've added some debugging and came back with the following error:

2019-02-08 13:55:23,643 [modules.auxiliary.stap] DEBUG: stap err ERROR: probe overhead exceeded threshold

My Cuckoo version and operating system are:

2.0.6

This can be reproduced by:

Difficult to say, sometimes it works fine, otherwise not. This might be related to lots of new processes being created.

The log, error, files etc can be found at:

In 2.0.6 there is NO ERROR on the agent side, the stap.log is never returned. I dumped stderr to get the debug out.

robeving commented 5 years ago

I think this might be because the buffer size is too small, I have tried to increase it with -b 10 in stap.py