{"record":{"id":"1b4842272bc27b85","repo":"elastic/elasticsearch","slug":"could-not-close-systemd-socket","errorCode":null,"errorMessage":"Could not close systemd socket: {}","messagePattern":"Could not close systemd socket: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/Systemd.java","lineNumber":114,"sourceCode":"                    if (error != null) {\n                        error.addSuppressed(e);\n                        throw error;\n                    } else {\n                        throw e;\n                    }\n                }\n            } else if (error != null) {\n                throw error;\n            }\n        }\n    }\n\n    private void throwOrLog(String message, boolean warnOnError) {\n        if (warnOnError) {\n            logger.warn(message);\n        } else {\n            logger.error(message);\n            throw new RuntimeException(message);\n        }\n    }\n}\n","sourceCodeStart":96,"sourceCodeEnd":118,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/Systemd.java#L96-L118","documentation":"Thrown (or logged) when libc.close() fails on the systemd socket file descriptor in the finally block. The error includes strerror(errno). EBADF (bad file descriptor) is the most common cause, indicating the fd was already closed or invalidated. For notify_ready() this is a RuntimeException; for others it is a WARN.","triggerScenarios":"Calling any Systemd.notify* method where the socket fd is closed by another thread or signal handler before the finally block runs. Also possible if the fd table is corrupted or if close() is interrupted by EINTR.","commonSituations":"Concurrent FD management closing the same descriptor. FD reuse after the socket was silently closed. Very rare kernel EINTR on close(). This error fires in the finally block, so it may mask or be masked by a prior error in the try block.","solutions":["Ensure no other thread or native library closes file descriptors that may alias the systemd socket.","If this appears alongside another systemd error, fix the root cause first; the close failure is secondary.","Wrap notify_ready() in try-catch to prevent close() failures from propagating.","Check for FD leaks or double-close bugs in JNI/native code."],"exampleFix":"// before\nsystemd.notify_ready(); // close() failure in finally propagates\n\n// after\ntry {\n    systemd.notify_ready();\n} catch (RuntimeException e) {\n    logger.warn(\"systemd notification failed (possibly on close); continuing\", e);\n}","handlingStrategy":"try-catch","validationCode":"// close() failures are not predictable; use try-catch around notify calls.\n// Audit native code for FD double-close or aliasing.","typeGuard":null,"tryCatchPattern":"try {\n    systemd.notify_ready();\n} catch (RuntimeException e) {\n    // may originate from close() in finally; log and continue\n    logger.warn(\"systemd socket close failed; fd may be leaked or already closed\", e);\n}","preventionTips":["Never close file descriptors that might alias internal library fds.","Treat all systemd notification calls as best-effort.","Audit native bindings for FD lifecycle bugs."],"tags":["systemd","linux","native","socket","close","fd-management"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}