{"record":{"id":"157c393f7ab70506","repo":"prometheus/node_exporter","slug":"failed-to-retrieve-conntrack-stats-w","errorCode":null,"errorMessage":"failed to retrieve conntrack stats: %w","messagePattern":"failed to retrieve conntrack stats: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"collector/conntrack_linux.go","lineNumber":151,"sourceCode":"\tch <- prometheus.MustNewConstMetric(\n\t\tconntrackInsert, prometheus.GaugeValue, float64(conntrackStats.insert))\n\tch <- prometheus.MustNewConstMetric(\n\t\tconntrackInsertFailed, prometheus.GaugeValue, float64(conntrackStats.insertFailed))\n\tch <- prometheus.MustNewConstMetric(\n\t\tconntrackDrop, prometheus.GaugeValue, float64(conntrackStats.drop))\n\tch <- prometheus.MustNewConstMetric(\n\t\tconntrackEarlyDrop, prometheus.GaugeValue, float64(conntrackStats.earlyDrop))\n\tch <- prometheus.MustNewConstMetric(\n\t\tconntrackSearchRestart, prometheus.GaugeValue, float64(conntrackStats.searchRestart))\n\treturn nil\n}\n\nfunc (c *conntrackCollector) handleErr(err error) error {\n\tif errors.Is(err, os.ErrNotExist) {\n\t\tc.logger.Debug(\"conntrack probably not loaded\")\n\t\treturn ErrNoData\n\t}\n\treturn fmt.Errorf(\"failed to retrieve conntrack stats: %w\", err)\n}\n\nfunc getConntrackStatistics() (*conntrackStatistics, error) {\n\ts := conntrackStatistics{}\n\n\tfs, err := procfs.NewFS(*procPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to open procfs: %w\", err)\n\t}\n\n\tconnStats, err := fs.ConntrackStat()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tfor _, connStat := range connStats {\n\t\ts.found += connStat.Found\n\t\ts.invalid += connStat.Invalid","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/prometheus/node_exporter/blob/17ddd77c59ba27e1508e9f7894b1e55b44d6aed3/collector/conntrack_linux.go#L133-L169","documentation":"The conntrack collector wraps any error from reading conntrack statistics (/proc/sys/net/netfilter/conntrack_count etc. via procfs) with this message. It distinguishes os.ErrNotExist, which is downgraded to ErrNoData (collector silently reports nothing) since conntrack simply not being loaded is normal, from all other failures which are reported as real errors.","triggerScenarios":"Update() -> getConntrackStatistics() fails reading /proc/sys/net/netfilter/ files for a reason other than file-not-exist, e.g. permission problems or procfs parse errors.","commonSituations":"Containerized exporters without the netfilter proc files mounted; hardened systems where the exporter user cannot read /proc/sys/net/netfilter; kernel without nf_conntrack exposing partial files; procPath pointed at a non-Linux/odd /proc tree.","solutions":["Mount /proc (read-only) into the container if running containerized","Ensure the exporter process can read /proc/sys/net/netfilter/* (check permissions/LSM policy)","Load the nf_conntrack module if you expect conntrack metrics, or explicitly disable the conntrack collector","Verify --path.procfs points at a valid procfs mount"],"exampleFix":"// before\nnode_exporter --collector.conntrack   # fails in container without /proc/sys/net/netfilter\n// after\ndocker run -v /proc:/host/proc:ro node_exporter --path.procfs=/host/proc --collector.conntrack","handlingStrategy":"try-catch","validationCode":"// Go: pre-check the proc files exist before scraping\nif _, err := os.Stat(filepath.Join(*procPath, \"sys/net/netfilter\")); os.IsNotExist(err) {\n    return ErrNoData // skip conntrack collection\n}","typeGuard":"func conntrackAvailable(procPath string) bool {\n    _, err := os.Stat(filepath.Join(procPath, \"sys/net/netfilter\"))\n    return !os.IsNotExist(err)\n}","tryCatchPattern":"stats, err := getConntrackStatistics()\nif err != nil {\n    if errors.Is(err, ErrNoData) || errors.Is(err, os.ErrNotExist) {\n        return nil // treat as absent feature\n    }\n    return fmt.Errorf(\"conntrack: %w\", err)\n}","preventionTips":["Mount /proc into containers when enabling conntrack metrics","Confirm nf_conntrack is loaded if conntrack metrics are expected","Grant read access to /proc/sys/net/netfilter for the exporter user"],"tags":["conntrack","procfs","linux"],"backgroundTag":"file-read-failed","analyzedSha":"17ddd77c59ba27e1508e9f7894b1e55b44d6aed3","analyzedAt":"2026-09-07T17:54:06.211Z","contentChangedAt":"2026-09-07T17:54:06.211Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}