prometheus / prometheus/node_exporter
cpufreq exporter repeated fails to read cpu frequency without elevated permissions.
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13.8k
- Forks
- 2.7k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 8
Description
Host operating system: output of uname -a
Linux 5.10.58
node_exporter version: output of node_exporter --version
node_exporter, version 1.2.2 (branch: HEAD, revision: 26645363b486e12be40af7ce4fc91e731a33104e)
build user: root@b9cb4aa2eb17
build date: 20210806-13:44:18
go version: go1.16.7
platform: linux/amd64
(from quay.io/prometheus/node-exporter@sha256:a990408ed288669bbad5b5b374fe1584e54825cde4a911c1a3d6301a907a030c which is currently tagged latest)
node_exporter command line flags
Currently using only --web.listen-address=127.0.0.1:9100 --path.procfs=/host/proc --path.sysfs=/host/sys
but have tested other variations
Are you running node_exporter in Docker?
Primarily, but behavior was reproduced outside of the container.
What did you do that produced an error?
Run node exporter on a AMD EPYC 7642 without any elevated permissions
What did you expect to see?
I expect the metric to not exist as cpuinfo_cur_freq requires root to read
-r-------- 1 root root 4096 Oct 20 17:06 /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_cur_freq
What did you see instead?
The metric correctly does not exist, but an attempt to read this is made once per cpu core per update.
This can be highly impactful in environments with monitoring for failed attempts to open files such as through auditd with a rule like -a always,exit -S all -F exit=-13
It would be nice if there were a way to disable this specific metric, or if a failed attempt to read it would prevent future attempts.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the node_exporter cpufreq collector and reproduce the repeated permission-denied reads on Linux without elevated permissions, using the reported cpuinfo_cur_freq path and audit rule. Done means the unavailable metric remains absent and the collector no longer retries the failed read on every update, with regression coverage for the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability-sre
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100