Worker 'post0' keeps disconnecting with no trace or other useful info

[przemekwes]

Describe the bug
cuckoo -v or -d not showing information or trace about error that occured

To Reproduce
Start cuckoo

Expected behavior
Explicit information about reason why worker disconnected

** My Cuckoo version and operating system are::**
Cuckoo 3.0.1, Ubuntu 20.04

The log, error, files etc can be found at:
2025-05-16 19:53:16 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/kuku/.cuckoocwd/conf/machineries/qemu.yaml
2025-05-16 19:53:17 DEBUG [pymisp]: pymisp loaded properly
2025-05-16 19:53:17 DEBUG [cuckoo.runprocessing]: Worker is done setting up. workername=identification0
2025-05-16 19:53:17 ERROR [cuckoo.runprocessing]: Worker disconnected unexpectedly. workername=post0
2025-05-16 19:53:17 DEBUG [cuckoo.runprocessing]: Stopping worker. workername=post0
2025-05-16 19:53:17 DEBUG [pymisp]: pymisp loaded properly

[cert-ee-raidar]

Hey @przemekwes and thank you for reporting the issue.

Logging is yes somewhat lacking. This is the first time I have seen this kind of problem.
Are you running a distributed variant or single node setup?

Have you tried reinstalling Cuckoo3?

[mihsergeev]

same issue on clean install

cuckoo -v -d
2025-06-26 15:03:08 INFO [cuckoo.startup]: Starting Cuckoo. cwd=/home/cuckoo/.cuckoocwd
2025-06-26 15:03:08 INFO [cuckoo.startup]: Loading configurations
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/cuckoo.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/analysissettings.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/identification.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/virustotal.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/irma.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/mhr.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/misp.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/intelmq.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/elasticsearch.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/suricata.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/post.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/web/web.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/machineries/qemu.yaml
2025-06-26 15:03:08 DEBUG [cuckoo.startup]: Initializing database
2025-06-26 15:03:09 DEBUG [cuckoo.startup]: Initializing task queue
2025-06-26 15:03:09 DEBUG [cuckoo.startup]: Starting local task node
2025-06-26 15:03:09 DEBUG [cuckoo.node.startup]: Starting resultserver. listenip=192.168.30.1 listenport=2042 sockpath=/home/cuckoo/.cuckoocwd/operational/sockets/resultserver.sock cwd=/home/cuckoo/.cuckoocwd
2025-06-26 15:03:09 INFO [cuckoo.node.resultserver]: Changed maximum file descriptors to hard limit for current process. newmax=1048576
2025-06-26 15:03:09 DEBUG [asyncio]: Using selector: EpollSelector
2025-06-26 15:03:09 INFO [cuckoo.node.resultserver]: Started resultserver. listen_ip=192.168.30.1 listen_port=2042
2025-06-26 15:03:09 DEBUG [cuckoo.node.startup]: Resultserver process started. pid=7368
2025-06-26 15:03:09 DEBUG [cuckoo.node.machinery]: Loading machinery and its machines. machinery=qemu
2025-06-26 15:03:09 DEBUG [cuckoo.node.machinery]: Machinery loaded machine. machinery=qemu machine=win10vm_
2025-06-26 15:03:09 INFO [cuckoo.node.machinery]: Loaded analysis machines. amount=1
2025-06-26 15:03:10 DEBUG [cuckoo.startup]: Starting processing handler and workers
2025-06-26 15:03:10 DEBUG [cuckoo.runprocessing]: Starting processing workers
2025-06-26 15:03:10 INFO [cuckoo.runprocessing]: Starting identification worker. workername=identification0
2025-06-26 15:03:10 DEBUG [cuckoo.runprocessing]: Worker process started. workername=identification0 pid=7390
2025-06-26 15:03:10 INFO [cuckoo.runprocessing]: Starting pre worker. workername=pre0
2025-06-26 15:03:10 DEBUG [cuckoo.runprocessing]: Worker process started. workername=pre0 pid=7391
2025-06-26 15:03:10 INFO [cuckoo.runprocessing]: Starting post worker. workername=post0
2025-06-26 15:03:10 DEBUG [cuckoo.runprocessing]: Worker process started. workername=post0 pid=7392
2025-06-26 15:03:11 DEBUG [cuckoo.runprocessing]: Loading configuration files. worker=identification0
2025-06-26 15:03:11 DEBUG [cuckoo.runprocessing]: Loading configuration files. worker=pre0
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/cuckoo.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/cuckoo.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.runprocessing]: Loading configuration files. worker=post0
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/cuckoo.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/analysissettings.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/analysissettings.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/analysissettings.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/identification.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/identification.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/identification.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/virustotal.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/irma.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/virustotal.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/irma.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/virustotal.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/mhr.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/irma.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/mhr.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/misp.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/misp.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/mhr.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/misp.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/intelmq.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/intelmq.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/elasticsearch.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/intelmq.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/elasticsearch.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/suricata.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/elasticsearch.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/suricata.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/post.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/suricata.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/post.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/processing/post.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/web/web.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/web/web.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/machineries/qemu.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/machineries/qemu.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/web/web.yaml
2025-06-26 15:03:11 DEBUG [cuckoo.common.startup]: Loading config. confpath=/home/cuckoo/.cuckoocwd/conf/machineries/qemu.yaml
2025-06-26 15:03:12 DEBUG [pymisp]: pymisp loaded properly
2025-06-26 15:03:12 DEBUG [cuckoo.runprocessing]: Worker is done setting up. workername=identification0
2025-06-26 15:03:12 DEBUG [pymisp]: pymisp loaded properly
2025-06-26 15:03:12 ERROR [cuckoo.runprocessing]: Worker disconnected unexpectedly. workername=post0
2025-06-26 15:03:12 DEBUG [cuckoo.runprocessing]: Stopping worker. workername=post0
2025-06-26 15:03:12 DEBUG [cuckoo.processing.pre.yara]: Loading yara static signature file. filepath=/home/cuckoo/.cuckoocwd/signatures/cuckoo/yara/static/family_echelon.yar
2025-06-26 15:03:12 DEBUG [cuckoo.processing.pre.yara]: Loading yara static signature file. filepath=/home/cuckoo/.cuckoocwd/signatures/cuckoo/yara/static/family_ekans.yar
2025-06-26 15:03:13 DEBUG [cuckoo.processing.pre.yara]: Loading yara static signature file. filepath=/home/cuckoo/.cuckoocwd/signatures/cuckoo/yara/static/family_qnodeservice.yara
2025-06-26 15:03:13 DEBUG [cuckoo.processing.pre.yara]: Loading yara static signature file. filepath=/home/cuckoo/.cuckoocwd/signatures/cuckoo/yara/static/family_sliverrat.yara
2025-06-26 15:03:13 DEBUG [cuckoo.runprocessing]: Worker is done setting up. workername=pre0
2025-06-26 15:03:13 DEBUG [cuckoo.startup]: Starting state controller
2025-06-26 15:03:13 DEBUG [cuckoo.startup]: Starting scheduler
2025-06-26 15:03:13 INFO [cuckoo.scheduler]: Scheduler started
2025-06-26 15:03:13 DEBUG [cuckoo.scheduler]: Searching for work to assign

[mihsergeev]

pre worker work fine in winodows vm, but post - absent

[notsb]

same issue on ubuntu 22.04
2025-07-28 09:13:28 ERROR [cuckoo.runprocessing]: Worker disconnected unexpectedly. workername=post0
2025-07-28 09:13:28 DEBUG [cuckoo.runprocessing]: Stopping worker. workername=post0

[mihsergeev]

after changing the server to another one - it started working normally, there is a possibility that the hardware did not fit (I tried 2 different ones - they started), so this is most likely not a software bug, but a problem with the CPU.

[notsb]

I find the solution. It crashed in /home/cuckoo/cuckoo3/venv/lib/python3.10/site-packages/hyperscan/_hs_ext.cpython-310-x86_64-linux-gnu.so and the reason is shlx instruction is not supported.
Installing an older version of hyperscan (python -m pip install "hyperscan<=0.6") fix it.

[cert-ee-raidar]

Hey @przemekwes and thank you for posting the issue.

We will add it to our todo list to look into it and try to add clearer error handling message.

@mihsergeev @notsb thank you for adding extra information!