apache/kafka · error · ConfigException

Could not read file {path} for property {fileName}

Error message

Could not read file {path} for property {fileName}

What it means

Thrown as ConfigException by DirectoryConfigProvider.read() (the static helper invoked from the stream pipeline in get()) when Files.readString(path) fails with IOException for an individual file inside an allowed directory. The provider reads each regular file's full content as a property value; any I/O failure on a single file aborts the whole listing and is rethrown with both the path and the file name in the message.

Source

Thrown at clients/src/main/java/org/apache/kafka/common/config/provider/DirectoryConfigProvider.java:123

                        .filter(fileFilter)
                        .collect(Collectors.toMap(
                            p -> p.getFileName().toString(),
                            p -> read(p)));
                } catch (IOException e) {
                    log.error("Could not list directory {}", dir, e);
                    throw new ConfigException("Could not list directory " + dir);
                }
            }
        }
        return new ConfigData(map);
    }

    private static String read(Path path) {
        try {
            return Files.readString(path);
        } catch (IOException e) {
            log.error("Could not read file {} for property {}", path, path.getFileName(), e);
            throw new ConfigException("Could not read file " + path + " for property " + path.getFileName());
        }
    }

}

View on GitHub (pinned to c31c9215e1)

Solutions

1. Check the ERROR log 'Could not read file <path> for property <fileName>' with its IOException stack trace to find the exact file and cause.
2. Fix ownership/permissions so the Kafka user can read every file under the directory: chown -R kafka:kafka <dir> && chmod -R r <dir>.
3. Exclude unreadable or transient files (rotate them outside the directory, or use get(path, keys) to whitelist specific keys).
4. Ensure only regular files live in the directory; remove FIFOs/symlinks whose targets are unreadable.

Example fix

// before: directory contains a root-owned 600 file
-rw------- root root api.key

// after
chown kafka:kafka /etc/kafka/secrets/api.key
chmod 400 /etc/kafka/secrets/api.key

// Pre-check file readability before the provider reads it:
Path f = Paths.get(path);
if (!Files.isRegularFile(f)) {
    throw new IllegalArgumentException(path + " is not a regular file");
}
if (!Files.isReadable(f)) {
    throw new IllegalArgumentException(path + " is not readable");
}

try {
    provider.get(path);
} catch (ConfigException e) {
    if (e.getMessage().startsWith("Could not read file")) {
        // log file path & property name, skip key, or surface a config error
    } else { throw e; }
}

When it happens

Trigger: DirectoryConfigProvider.get(path) iterating directory entries and calling Files.readString on a regular file that raises IOException: unreadable due to permissions, file deleted between list and read (TOCTOU), special file returning an error, or encoding/IO error.

Common situations: A secrets directory contains a file the Kafka user can stat but not read (mode 000 owned by another user). A file is rotated/deleted concurrently (log rotation, secret rotation). Reading a FIFO, device node, or other non-regular-but-passed-filter file. Disk/medium read error.

Related errors

• Could not list directory {dir}
• Path normalisedPath does not exist
• Path normalisedPath could not be resolved
• The provider has not been configured yet.
• Failed to check internal API usage: {errorMessage}

AI-assisted analysis of apache/kafka@c31c9215e1 (2026-08-03). Data as JSON: /data/errors/e4ca0cd6ad3890b3.json. Report an issue: GitHub.