{"record":{"id":"326b64a783afe200","repo":"prometheus/node_exporter","slug":"couldn-t-connect-rtnetlink-w","errorCode":null,"errorMessage":"couldn't connect rtnetlink: %w","messagePattern":"couldn't connect rtnetlink: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"collector/network_route_linux.go","lineNumber":64,"sourceCode":"\t)\n\troutesDesc := prometheus.NewDesc(\n\t\tprometheus.BuildFQName(namespace, subsystem, \"routes\"),\n\t\t\"network routes by interface\", []string{\"device\"}, nil,\n\t)\n\n\treturn &networkRouteCollector{\n\t\trouteInfoDesc: routeInfoDesc,\n\t\troutesDesc:    routesDesc,\n\t\tlogger:        logger,\n\t}, nil\n}\n\nfunc (n networkRouteCollector) Update(ch chan<- prometheus.Metric) error {\n\tdeviceRoutes := make(map[string]int)\n\n\tconn, err := rtnetlink.Dial(nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"couldn't connect rtnetlink: %w\", err)\n\t}\n\tdefer conn.Close()\n\n\tlinks, err := conn.Link.List()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"couldn't get links: %w\", err)\n\t}\n\n\troutes, err := conn.Route.List()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"couldn't get routes: %w\", err)\n\t}\n\n\tfor _, route := range routes {\n\t\tif route.Type != unix.RTA_DST {\n\t\t\tcontinue\n\t\t}\n\t\tif len(route.Attributes.Multipath) != 0 {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/prometheus/node_exporter/blob/17ddd77c59ba27e1508e9f7894b1e55b44d6aed3/collector/network_route_linux.go#L46-L82","documentation":"The network_route collector's Update dials the rtnetlink netlink socket (rtnetlink.Dial) to enumerate links and routes. If the netlink socket cannot be created or bound, Update returns this wrapped error and the route metrics are not scraped.","triggerScenarios":"rtnetlink.Dial(nil) fails when netlink sockets are unavailable: no NETLINK_ROUTE support, seccomp/apparmor/SELinux blocking socket(AF_NETLINK), or a container runtime without netlink in the sandbox.","commonSituations":"Hardened containers (seccomp profiles blocking netlink); restricted service users without CAP_NET_ADMIN-ish socket permissions; unusual sandboxes/gVisor environments lacking rtnetlink.","solutions":["Verify the kernel supports netlink (it does on all standard Linux) and that the exporter process can create netlink sockets (test with `ss -f netlink` or a small Go probe).","Review seccomp/AppArmor/SELinux profiles for the exporter and allow AF_NETLINK socket creation.","Run the exporter outside restrictive sandboxes or relax the runtime's syscall filter.","If the collector isn't needed, start node_exporter without the network_route collector (--collector.network-route disabled / blacklist flag)."],"exampleFix":"// before\nconn, err := rtnetlink.Dial(nil)\nif err != nil {\n\treturn fmt.Errorf(\"couldn't connect rtnetlink: %w\", err)\n}\n// after (surface the underlying cause context)\nconn, err := rtnetlink.Dial(nil)\nif err != nil {\n\treturn fmt.Errorf(\"couldn't connect rtnetlink (netlink socket blocked? check seccomp/permissions): %w\", err)\n}","handlingStrategy":"validation","validationCode":"import \"golang.org/x/sys/unix\"\n// Probe netlink socket capability before enabling the collector:\nfd, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_RAW, unix.NETLINK_ROUTE)\nif err != nil {\n\t// rtnetlink unavailable in this sandbox; disable network-route collector\n} else {\n\tunix.Close(fd)\n}","typeGuard":"null","tryCatchPattern":"// Fall back gracefully when netlink is blocked\nconn, err := rtnetlink.Dial(nil)\nif err != nil {\n\tlogger.Warn(\"rtnetlink unavailable; skipping network_route metrics\", \"err\", err)\n\treturn nil\n}","preventionTips":["Verify seccomp/AppArmor/SELinux profiles permit AF_NETLINK socket creation for the exporter.","Test node_exporter inside the actual sandbox (gVisor, Kata, hardened runtimes) before rollout.","Disable --collector.network-route where netlink is intentionally unavailable.","Run the exporter with an account allowed to open netlink sockets."],"tags":["linux","netlink","rtnetlink","network","containers"],"backgroundTag":"network-request-failed","analyzedSha":"17ddd77c59ba27e1508e9f7894b1e55b44d6aed3","analyzedAt":"2026-09-07T17:54:06.211Z","contentChangedAt":"2026-09-07T17:54:06.211Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}