#3737·falco

SIGSEGV when snapshotting metrics libs::metrics::libs_metrics_collector::snapshot

Author: argesCreated Nov 14, 2025Updated Sep 8, 2026
Labelskind/bug

Describe the bug

  • falco 0.42.1 crashes periodically
  • The issue seems to be related to metrics scraping

How to reproduce it

Change falco.yaml to include the following metrics configuration:

metrics:
  enabled: true
  interval: 1h
  output_rule: true
  rules_counters_enabled: true
  resource_utilization_enabled: false
  state_counters_enabled: true
  kernel_event_counters_enabled: true
  kernel_event_counters_per_cpu_enabled: false
  libbpf_stats_enabled: true
  plugins_metrics_enabled: false
  jemalloc_stats_enabled: false
  convert_memory_to_mb: true
  include_empty_values: false

Have prometheus periodically scrape the process.

Expected behaviour

  • I expect falco to not crash when metrics are being scraped.

Environment

{
  "machine": "x86_64",
  "nodename": "hostname",
  "release": "6.12.58",
  "sysname": "Linux",
  "version": "#1 SMP PREEMPT_DYNAMIC Mon Sep 27 00:00:00 UTC 2010"
}
  • Installation method: build from source + installed via debian

Built with the following cmake options

cmake -DUSE_BUNDLED_DEPS=ON -DBUILD_FALCO_MODERN_BPF=ON -DBUILD_BPF=OFF -DBUILD_DRIVER=OFF 

Additional context

Backtrace:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  std::__shared_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2>::get (this=0x55ef215a38ec) at /usr/include/c++/14/bits/shared_ptr_base.h:1666

warning: 1666   /usr/include/c++/14/bits/shared_ptr_base.h: No such file or directory
[Current thread is 1 (Thread 0x7fd3587b96c0 (LWP 3706095))]
(gdb) bt
#0  std::__shared_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2>::get (this=0x55ef215a38ec) at /usr/include/c++/14/bits/shared_ptr_base.h:1666
#1  std::__shared_ptr_access<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get (this=0x55ef215a38ec) at /usr/include/c++/14/bits/shared_ptr_base.h:1364
#2  std::__shared_ptr_access<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2, false, false>::operator* (this=0x55ef215a38ec) at /usr/include/c++/14/bits/shared_ptr_base.h:1351
#3  threadinfo_map_t::loop (this=<optimized out>, callback=...)
    at /tmp/build/falco-0.42.1/build/falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/userspace/libsinsp/threadinfo.h:731
#4  libs::metrics::libs_state_counters::libs_state_counters (this=0x7fd3587b1830, sinsp_stats_v2=..., thread_manager=<optimized out>)
    at /tmp/build/falco-0.42.1/build/falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/userspace/libsinsp/metrics_collector.cpp:259
#5  0x000055ea6ba9391a in libs::metrics::libs_metrics_collector::snapshot (this=this@entry=0x7fd3587b1a50)
    at /tmp/build/falco-0.42.1/build/falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/userspace/libsinsp/metrics_collector.cpp:425
#6  0x000055ea6b562f33 in falco_metrics::sources_to_text_prometheus[abi:cxx11](falco::app::state const&, libs::metrics::prometheus_metrics_converter&, std::vector<metrics_v2, std::allocator<metrics_v2> >&) (state=..., prometheus_metrics_converter=..., additional_wrapper_metrics=std::vector of length 2, capacity 2 = {...})
    at /tmp/build/falco-0.42.1/userspace/falco/falco_metrics.cpp:314
#7  0x000055ea6b566185 in falco_metrics::to_text_prometheus[abi:cxx11](falco::app::state const&) (state=...)
    at /tmp/build/falco-0.42.1/userspace/falco/falco_metrics.cpp:532
#8  0x000055ea6b515cf5 in operator() (__closure=<optimized out>, res=...) at /tmp/build/falco-0.42.1/userspace/falco/webserver.cpp:108
#9  std::__invoke_impl<void, falco_webserver::enable_prometheus_metrics(const falco::app::state&)::<lambda(const httplib::Request&, httplib::Response&)>&, const httplib::Request&, httplib::Response&> (__f=...) at /usr/include/c++/14/bits/invoke.h:61
#10 std::__invoke_r<void, falco_webserver::enable_prometheus_metrics(const falco::app::state&)::<lambda(const httplib::Request&, httplib::Response&)>&, const httplib::Request&, httplib::Response&> (__fn=...) at /usr/include/c++/14/bits/invoke.h:111
#11 std::_Function_handler<void(const httplib::Request&, httplib::Response&), falco_webserver::enable_prometheus_metrics(const falco::app::state&)::<lambda(const httplib::Request&, httplib::Response&)> >::_M_invoke(const std::_Any_data &, const httplib::Request &, httplib::Response &) (__functor=..., __args#0=..., __args#1=...)
    at /usr/include/c++/14/bits/std_function.h:290
#12 0x000055ea6b39190a in std::function<void(httplib::Request const&, httplib::Response&)>::operator() (this=0x55ea83348388, __args#0=..., __args#1=...)
    at /usr/include/c++/14/bits/std_function.h:591
#13 httplib::Server::dispatch_request (this=this@entry=0x55ea7ee0b7a0, req=..., res=..., handlers=...)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:7894
#14 0x000055ea6b3c68dd in httplib::Server::routing (this=this@entry=0x55ea7ee0b7a0, req=..., res=..., strm=...)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:7877
#15 0x000055ea6b3c8153 in httplib::Server::process_request (this=this@entry=0x55ea7ee0b7a0, strm=..., remote_addr="10.10.10.10", remote_port=remote_port@entry=59436, 
    local_addr="10.10.10.10", local_port=local_port@entry=3018, close_connection=<optimized out>, connection_closed=<optimized out>, setup_request=...)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:8145
#16 0x000055ea6b3c95d2 in httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1}::operator()(httplib::Stream&, bool, bool&) const (
    __closure=<synthetic pointer>, strm=..., close_connection=<optimized out>, connection_closed=@0x7fd3587b3278: false)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:8239
#17 httplib::detail::process_server_socket<httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1}>(std::atomic<int> const&, int, unsigned long, long, long, long, long, long, httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1})::{lambda(bool, bool&)#1}::operator()(bool, bool&) const (__closure=<synthetic pointer>, close_connection=false, connection_closed=@0x7fd3587b3278: false)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:3452
#18 httplib::detail::process_server_socket_core<httplib::detail::process_server_socket<httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1}>(std::atomic<int> const&, int, unsigned long, long, long, long, long, long, httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1})::{lambda(bool, bool&)#1}>(std::atomic<int> const&, int, unsigned long, long, httplib::detail::process_server_socket<httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1}>(std::atomic<int> const&, int, unsigned long, long, long, long, long, long, httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1})::{lambda(bool, bool&)#1}) (svr_sock=std::atomic<int> = { 4 }, sock=<optimized out>, keep_alive_max_count=<optimized out>, 
    keep_alive_timeout_sec=<optimized out>, callback=...) at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:3433
#19 httplib::detail::process_server_socket<httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1}>(std::atomic<int> const&, int, unsigned long, long, long, long, long, long, httplib::Server::process_and_close_socket(int)::{lambda(httplib::Stream&, bool, bool&)#1}) (svr_sock=std::atomic<int> = { 4 }, 
    sock=<optimized out>, keep_alive_max_count=<optimized out>, keep_alive_timeout_sec=<optimized out>, read_timeout_sec=<optimized out>, 
    read_timeout_usec=<optimized out>, write_timeout_sec=<optimized out>, write_timeout_usec=<optimized out>, callback=...)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:3447
#20 httplib::Server::process_and_close_socket (this=0x55ea7ee0b7a0, sock=<optimized out>)
    at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:8234
#21 0x000055ea6b518e9e in std::function<void()>::operator() (this=0x7fd3587b3890) at /usr/include/c++/14/bits/std_function.h:591
#22 httplib::ThreadPool::worker::operator() (this=0x7fd37c0081a8) at /tmp/build/falco-0.42.1/build/_deps/cpp-httplib-src/httplib.h:927
#23 std::__invoke_impl<void, httplib::ThreadPool::worker> (__f=...) at /usr/include/c++/14/bits/invoke.h:61
#24 std::__invoke<httplib::ThreadPool::worker> (__fn=...) at /usr/include/c++/14/bits/invoke.h:96
#25 std::thread::_Invoker<std::tuple<httplib::ThreadPool::worker> >::_M_invoke<0ul> (this=0x7fd37c0081a8) at /usr/include/c++/14/bits/std_thread.h:301
#26 std::thread::_Invoker<std::tuple<httplib::ThreadPool::worker> >::operator() (this=0x7fd37c0081a8) at /usr/include/c++/14/bits/std_thread.h:308
#27 std::thread::_State_impl<std::thread::_Invoker<std::tuple<httplib::ThreadPool::worker> > >::_M_run (this=0x7fd37c0081a0) at /usr/include/c++/14/bits/std_thread.h:253
#28 0x00007fd38a4e1224 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#29 0x00007fd38a17fb7b in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
#30 0x00007fd38a1fd7b8 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78