{"record":{"id":"158b9ffdc97db600","repo":"netbirdio/netbird","slug":"close-output-file-w","errorCode":null,"errorMessage":"close output file: %w","messagePattern":"close output file: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/capture.go","lineNumber":173,"sourceCode":"}\n\n// captureOutput returns the writer for capture data and a cleanup function\n// that finalizes the file. Errors from the cleanup must be propagated.\nfunc captureOutput(cmd *cobra.Command) (io.Writer, func() error, error) {\n\toutPath, _ := cmd.Flags().GetString(\"output\")\n\tif outPath == \"\" {\n\t\treturn os.Stdout, func() error { return nil }, nil\n\t}\n\n\tf, err := os.CreateTemp(filepath.Dir(outPath), filepath.Base(outPath)+\".*.tmp\")\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"create output file: %w\", err)\n\t}\n\ttmpPath := f.Name()\n\treturn f, func() error {\n\t\tvar merr *multierror.Error\n\t\tif err := f.Close(); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"close output file: %w\", err))\n\t\t}\n\t\tfi, statErr := os.Stat(tmpPath)\n\t\tif statErr != nil || fi.Size() == 0 {\n\t\t\tif rmErr := os.Remove(tmpPath); rmErr != nil && !os.IsNotExist(rmErr) {\n\t\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"remove empty output file: %w\", rmErr))\n\t\t\t}\n\t\t\treturn nberrors.FormatErrorOrNil(merr)\n\t\t}\n\t\tif err := os.Rename(tmpPath, outPath); err != nil {\n\t\t\tmerr = multierror.Append(merr, fmt.Errorf(\"rename output file: %w\", err))\n\t\t\treturn nberrors.FormatErrorOrNil(merr)\n\t\t}\n\t\tcmd.PrintErrf(\"Wrote %s\\n\", outPath)\n\t\treturn nberrors.FormatErrorOrNil(merr)\n\t}, nil\n}\n\nfunc handleCaptureError(err error) error {","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/capture.go#L155-L191","documentation":"During output finalization the cleanup function closes the temp pcap file and accumulates a close error here. The data was already streamed; this indicates the close syscall itself failed, which is rare for local files and usually points to deferred write errors being reported at close time (NFS/network filesystems) or the descriptor being invalidated externally. It is collected into a multierror together with any later rename result.","triggerScenarios":"--output on NFS or a network mount where flushed data fails at close; the process's file descriptor closed underneath it by an external tool or a filesystem forced unmount; SELinux/AppArmor interfering with the file after creation.","commonSituations":"Writing pcaps to a network share (home NFS, k8s hostPath with quirks); very long captures where the mount drops; exotic filesystems (FUSE) that return errors on close after background write failures.","solutions":["Retry the capture writing to a local filesystem (e.g. /tmp) and copy the file afterwards","If on NFS, check mount health (dmesg, mount stats) and remount or move to local storage","Check free space — a full disk can surface as an error at close rather than at write","Update/report if it reproduces on a plain local ext4/xfs path, since that would be a genuine bug in the capture path"],"exampleFix":"# before: pcap written directly to a network mount\nnetbird debug capture -d 30s -o /mnt/nfs/capture.pcap\n\n# after: capture locally, then copy\ncd /tmp && netbird debug capture -d 30s -o capture.pcap && cp capture.pcap /mnt/nfs/","handlingStrategy":"fallback","validationCode":"// Prefer a local filesystem target for pcaps:\nif isNetworkMount(dir) { // e.g. /proc/mounts type nfs|cifs|fuse\n    dir = os.TempDir()\n}","typeGuard":null,"tryCatchPattern":"// Capture locally, copy after success:\nif err := cleanup(); err != nil {\n    if isCloseOnly(err) { // data already flushed; copy from tmp if present\n        tryCopyTmpToFinal()\n    }\n}","preventionTips":["Write pcaps to local disk and copy them afterwards","Monitor mount health for long captures on network storage","Watch disk space during long captures instead of discovering issues at close"],"tags":["capture","filesystem","nfs","cleanup","cli"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}