{"record":{"id":"42f0220f464fa206","repo":"prometheus/node_exporter","slug":"couldn-t-get-tcpstats-w","errorCode":null,"errorMessage":"couldn't get tcpstats: %w","messagePattern":"couldn't get tcpstats: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"collector/tcpstat_linux.go","lineNumber":133,"sourceCode":"\tState   uint8\n\tTimer   uint8\n\tRetrans uint8\n\tID      InetDiagSockID\n\tExpires uint32\n\tRQueue  uint32\n\tWQueue  uint32\n\tUID     uint32\n\tInode   uint32\n}\n\nfunc parseInetDiagMsg(b []byte) *InetDiagMsg {\n\treturn (*InetDiagMsg)(unsafe.Pointer(&b[0]))\n}\n\nfunc (c *tcpStatCollector) Update(ch chan<- prometheus.Metric) error {\n\ttcpStats, err := getTCPStats(syscall.AF_INET)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"couldn't get tcpstats: %w\", err)\n\t}\n\n\t// if enabled ipv6 system\n\tif _, hasIPv6 := os.Stat(procFilePath(\"net/tcp6\")); hasIPv6 == nil {\n\t\ttcp6Stats, err := getTCPStats(syscall.AF_INET6)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"couldn't get tcp6stats: %w\", err)\n\t\t}\n\n\t\tfor st, value := range tcp6Stats {\n\t\t\ttcpStats[st] += value\n\t\t}\n\t}\n\n\tfor st, value := range tcpStats {\n\t\tch <- c.desc.mustNewConstMetric(value, st.String())\n\t}\n","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/prometheus/node_exporter/blob/17ddd77c59ba27e1508e9f7894b1e55b44d6aed3/collector/tcpstat_linux.go#L115-L151","documentation":"tcpStatCollector.Update gathers IPv4 TCP connection states via getTCPStats(syscall.AF_INET), which uses a netlink INET_DIAG socket. When that fails, the error is wrapped as \"couldn't get tcpstats\". The netlink error is preserved via %w for errors.Is/As inspection.","triggerScenarios":"The initial getTCPStats(AF_INET) call returns an error: netlink socket creation fails, the sock_diag request fails, or the kernel reply cannot be parsed into connection stats.","commonSituations":"Hardened containers lacking CAP_NET_ADMIN/CAP_SYS_PTRACE where inet_diag requests are denied; seccomp profiles blocking netlink socket creation; reading /proc/net/tcp disabled in the environment (needed for availability checks); very old or patched kernels lacking sock_diag for the requested family.","solutions":["Check the process can create NETLINK_INET_DIAG sockets (test with `ss -t` which uses the same mechanism)","Grant required capabilities in containers (e.g. docker run --cap-add=NET_ADMIN) or relax seccomp","If IPv4 stats fail persistently, disable the collector with --collector.tcpstat","Confirm the kernel supports inet_diag (CONFIG_INET_DIAG) — common in custom/minimal kernels"],"exampleFix":"// before\ndocker run prom/node-exporter --collector.tcpstat\n// after\ndocker run --cap-add=NET_ADMIN prom/node-exporter --collector.tcpstat","handlingStrategy":"fallback","validationCode":"if _, err := os.Stat(\"/proc/net/tcp\"); err != nil {\n    // /proc unavailable — tcpstat cannot work\n}","typeGuard":null,"tryCatchPattern":"if err := coll.Update(ch); err != nil {\n    if errors.Is(err, os.ErrPermission) {\n        log.Warn(\"tcpstat lacks netlink permission; disabling\")\n    } else {\n        log.Warn(\"tcpstat scrape failed\", \"err\", err)\n    }\n}","preventionTips":["Grant NET_ADMIN capability when running in containers","Verify `ss -t` works as the exporter user before enabling tcpstat","Use seccomp profiles that allow socket(AF_NETLINK)","Confirm CONFIG_INET_DIAG is enabled in custom kernels"],"tags":["tcp","netlink","linux","network"],"backgroundTag":"network-request-failed","analyzedSha":"17ddd77c59ba27e1508e9f7894b1e55b44d6aed3","analyzedAt":"2026-09-07T17:54:06.211Z","contentChangedAt":"2026-09-07T17:54:06.211Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}