filesystem scan error: scan error: scan failed: failed analysis: walk filesystem: walk dir error:

[shashank-gugalia-ck]

Description

2024-07-01T00:00:04-07:00 FATAL Fatal error filesystem scan error: scan error: scan failed: failed analysis: walk filesystem: walk dir error: unknown error with $filename: open filenamename : no such file or directory

We get this error on few different instance every day and than scanning fails

trivy -v
Version: 0.52.0
Vulnerability DB:
Version: 2
UpdatedAt: 2024-06-12 00:15:57.030512903 +0000 UTC
NextUpdate: 2024-06-12 06:15:57.030512632 +0000 UTC
DownloadedAt: 2024-06-12 00:53:53.016363 +0000 UTC

Desired Behavior

There are transient files with different formats, so identifying the skipping pattern would be reactive hence IMO we should log this error but not stop the scanning,

Actual Behavior

Process terminates after this error without logging the the findings

Reproduction Steps

1.Its hard to reproduce this, we are running trivy on 1000s of instances since last 4 days and so far every day we see 1 or 2 instance logging it but its never the same instance 
2. The understanding is that there are transient files, which exist when the scan start but are no longer available when that file is actually getting scanner for secrets by trivy 

...

Target

Filesystem

Scanner

Secret

Output Format

JSON

Mode

Standalone

Debug Output

Its hard to run the tool with -debug on all the instance. Given last 4 days since we are running this tool and this error has happened on different instance all the time

Operating System

Rocky Linux

Version

Version: 0.52.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[aconlin-scottlogic]

this reliably happens when scanning an AMI with the ECS agent installed, we're using v0.55.0, the output is:

amazon-machine-images/ecs (10:32:35) [main] 1030: trivy vm --no-progress --timeout 2m --severity HIGH,CRITICAL --scanners vuln --cache-dir /tmp/trivy ami:ami-X 
2024-09-06T09:39:32Z    INFO    Timeout is set to less than 30 min - upgrading to 30 min for this command.
2024-09-06T09:39:33Z    INFO    [vuln] Vulnerability scanning is enabled
2024-09-06T09:39:33Z    INFO    [ami] Snapshot found    snapshot_id="snap-X"
2024-09-06T09:40:03Z    WARN    [vm] Partition error    err="filesystem walk error: fs.Walk error: read directory /var/lib/docker/volumes/backingFsBlockDev: failed to list directory entries inode: 8529576: failed to list entries: not found entries"
2024-09-06T09:40:08Z    INFO    Detected OS     family="none" version=""
2024-09-06T09:40:08Z    WARN    Unsupported os  family="none"
2024-09-06T09:40:08Z    INFO    Number of language-specific files       num=0

(AMI/snapshot ID removed because they're not public)

also tried with --skip-directories /var/lib/docker and --skip-files /var/lib/docker