[Rover] eBPF Access Log Module can not work : start module access_log failure: field IpListRcv:

[2005wind]

Search before asking

• I had searched in the issues and found no similar issues.

Apache SkyWalking Component

OAP server (apache/skywalking)

What happened

An exception occurred when using the eBPF function.
The version information used is as follows：
oap: 10.1.0
rover: 0.7.0
os：AlmaLinux release 8.6 (Sky Tiger)
kernel version: 5.4.242-1.el8.elrepo.x86_64

error details:

/skywalking # /skywalking-rover start --config /skywalking/configs/rover_configs.yaml
time="2025-03-28T08:32:29Z" level=info msg="module logger start successful" module=boot.starter
time="2025-03-28T08:32:29Z" level=info msg="module core start successful" module=boot.starter
time="2025-03-28T08:32:29Z" level=info msg="module process_discovery start successful" module=boot.starter
time="2025-03-28T08:32:29Z" level=info msg="module profiling start successful" module=boot.starter
time="2025-03-28T08:32:30Z" level=info msg="module profiling shutdown successful" module=boot.starter
time="2025-03-28T08:32:30Z" level=info msg="module process_discovery shutdown successful" module=boot.starter
time="2025-03-28T08:32:30Z" level=info msg="module core shutdown successful" module=boot.starter
time="2025-03-28T08:32:30Z" level=info msg="module logger shutdown successful" module=boot.starter
Error: start module access_log failure: field IpListRcv: program ip_list_rcv: load program: permission denied: invalid indirect read from stack off -32+8 size 16 (392 line(s) omitted)
Usage:
start [flags]

Flags:
-c, --config string the rover config file path (default "configs/rover_configs.yaml")
-h, --help help for start

start module access_log failure: field IpListRcv: program ip_list_rcv: load program: permission denied: invalid indirect read from stack off -32+8 size 16 (392 line(s) omitted)

What you expected to happen

The most likely reason is that rover does not support this kernel version

How to reproduce

If you use this kernel version, this exception may occur

Anything else

the daemonset config:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: skywalking-rover
  namespace: skywalking
spec:
  selector:
    matchLabels:
      name: skywalking-rover
  template:
    spec:
      volumes:
        - name: host
          hostPath:
            path: /
            type: Directory
        - name: sys
          hostPath:
            path: /sys
            type: Directory
      containers:
        - name: skywalking-rover
          image: apache/skywalking-rover
          env:
            - name: ROVER_PROCESS_DISCOVERY_KUBERNETES_ACTIVE
              value: 'true'
            - name: ROVER_PROCESS_DISCOVERY_KUBERNETES_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: ROVER_BACKEND_ADDR
              value: 172.24.133.xxx:11800
            - name: ROVER_HOST_MAPPING
              value: /host
            - name: ROVER_ACCESS_LOG_ACTIVE
              value: 'true'
          resources: {}
          volumeMounts:
            - name: host
              readOnly: true
              mountPath: /host
            - name: sys
              readOnly: true
              mountPath: /sys
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: Always
          securityContext:
            capabilities:
              add:
                - SYS_PTRACE
                - SYS_ADMIN
            privileged: true
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirstWithHostNet
      serviceAccountName: skywalking-rover
      serviceAccount: skywalking-rover
      hostNetwork: true
      hostPID: true
      securityContext: {}
      schedulerName: default-scheduler
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 0
  revisionHistoryLimit: 10

Are you willing to submit a pull request to fix on your own?

• Yes I am willing to submit a pull request on my own!

Code of Conduct

• I agree to follow this project's Code of Conduct

[senthilnathan-am]

I am too facing the same issue on Rover agent. Any update on this ?

[senthilnathan-am]

I have upgraded the kernel version and now the rover daemons are running fine with access_log.active

Linux 5.4.0-204-generic x86_64 (old kernel)

Linux 5.15.0-136-generic x86_64 (new kernel)

@2005wind You try to upgrade the kernel version.