{"record":{"id":"09f76a9b7657fbf7","repo":"crowdsecurity/crowdsec","slug":"could-not-get-journalctl-stderr-w","errorCode":null,"errorMessage":"could not get journalctl stderr: %w","messagePattern":"could not get journalctl stderr: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/journalctl/run.go","lineNumber":58,"sourceCode":"\t}\n\n\treturn append(args, s.config.Filters...)\n}\n\nfunc (s *Source) runJournalCtl(ctx context.Context, out chan pipeline.Event) error {\n\tctx, cancel := context.WithCancel(ctx)\n\tdefer cancel()\n\n\tcmd := exec.CommandContext(ctx, journalctlCmd, s.getCommandArgs()...)\n\n\tstdout, err := cmd.StdoutPipe()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not get journalctl stdout: %w\", err)\n\t}\n\n\tstderr, err := cmd.StderrPipe()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not get journalctl stderr: %w\", err)\n\t}\n\n\tstderrChan := make(chan string)\n\tstdoutChan := make(chan string)\n\terrChan := make(chan error, 1)\n\n\ts.logger.WithField(\"command\", formatShellCommand(cmd.Args)).Info(\"Spawning process\")\n\n\terr = cmd.Start()\n\tif err != nil {\n\t\ts.logger.Errorf(\"Error spawning process: %s\", err)\n\t\treturn err\n\t}\n\n\tstdoutScanner := bufio.NewScanner(stdout)\n\tstderrScanner := bufio.NewScanner(stderr)\n\n\t// don't shadow parent context, we'll monitor later if it's canceled","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/journalctl/run.go#L40-L76","documentation":"runJournalCtl fails while creating the stderr pipe for the journalctl child process. It fires if exec.Cmd.StderrPipe returns an error (e.g. pipes already used or process already started), before journalctl is launched.","triggerScenarios":"Calling OneShot or Stream when cmd.StderrPipe() errors — command already started before piping, or OS-level pipe/fd allocation failure.","commonSituations":"File-descriptor exhaustion on the host; a modified build that starts the command before requesting pipes.","solutions":["Retry the acquisition; this is an internal pipe-setup failure, usually transient","Report a bug if it reproduces consistently"],"exampleFix":"// before\ncmd.Run()\nstderr, err := cmd.StderrPipe() // fails\n// after\nstderr, err := cmd.StderrPipe()\nif err != nil { return err }\ncmd.Run()","handlingStrategy":"retry","validationCode":"// ensure fds are available before starting the source\nf, err := os.Open(os.DevNull)\nif err != nil { return errors.New(\"fd exhaustion likely\") }\nf.Close()","typeGuard":null,"tryCatchPattern":"if err := runJournalCtl(ctx); err != nil {\n    if strings.Contains(err.Error(), \"could not get journalctl stderr\") {\n        // backoff and retry; inspect ulimit if persistent\n    }\n}","preventionTips":["Raise ulimit -n for the crowdsec service","Obtain all pipes (stdout, stderr) before cmd.Start()","Watch for fd leaks via /proc/<pid>/fd"],"tags":["go","exec","journalctl","pipe"],"backgroundTag":"file-open-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}