E: Sub-process returned an error code" During APT Upgrade: A Deep Dive into Cache and List Corruption
Solving E: Sub-process returned an error code During APT Upgrade: A Deep Dive into Cache and List Corruption"
The frustrating error, E: Sub-process returned an error code, completely cripple the apt package manager. My own extensive troubleshooting revealed the root cause wasn't a problematic package, but rather a failing package manager hook specifically tied to etckeeper.
Recently, I encountered this exact issue on a server running on
Linux Ubuntu 24.04 server while attempting to upgrade elasticsearch fleet node. Cleanup of APT's local cache and package lists does not work.
1. The Symptoms and The Misleading Logs
The problem was I could not perform any package transaction (install, remove, or upgrade), with the error appearing immediately after files were downloaded but before installation started.
Failure Point: The system exited with E: Sub-process returned an error code.
Failed Debugging: Standard troubleshooting (dpkg --configure -a, checking term.log, and even journalctl) failed to reveal the specific error message because the failure occurred within an external shell script hook that simply returned a non-zero exit code to apt.
2. Identifying the Culprit: The etckeeper Hook
The root cause was eventually traced back to a pre-transaction hook designed to execute before any package installation or removal. In our case, this hook was by etckeeper, a utility that maintains a Git repository for the /etc directory. Identifying this proved time-consuming, taking several hours because apt logs and verbose output failed to provide any error messages.
The Problematic Configuration File
The culprit was the file /etc/apt/apt.conf.d/05etckeeper. This file uses directives to force etckeeper to run during every package transaction:
root@node:/etc/apt/apt.conf.d# cat 05etckeeper
DPkg::Pre-Invoke { "if [ -x /usr/bin/etckeeper ]; then etckeeper pre-install; fi"; };
DPkg::Post-Invoke { "if [ -x /usr/bin/etckeeper ]; then etckeeper post-install; fi"; };
# ... similar RPM sections follow
The Solution: Disable the Failing Hook
The temporary fix is to remove the configuration that injects the failing hook.
To quickly confirm etckeeper was the issue, the hooks can be temporarily disabled by commenting them out in the configuration file:
Open the file:
sudo nano /etc/apt/apt.conf.d/05etckeeper
Comment out the DPkg lines:
# DPkg::Pre-Invoke { "if [ -x /usr/bin/etckeeper ]; then etckeeper pre-install; fi"; };
# DPkg::Post-Invoke { "if [ -x /usr/bin/etckeeper ]; then etckeeper post-install; fi"; };
If this step unblocks apt, you have definitively found the culprit.