{"record":{"id":"5960ab8c6c525df3","repo":"stamparm/maltrail","slug":"unable-to-resolve-remote-logging-endpoint-endpoint","errorCode":null,"errorMessage":"unable to resolve remote logging endpoint '{endpoint}'","messagePattern":"unable to resolve remote logging endpoint '(.+?)'","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sensor/src/output.rs","lineNumber":477,"sourceCode":"    /// every subsequent detection, silently.\n    fn endpoint_addr(&mut self, endpoint: &str) -> Option<SocketAddr> {\n        if let Some(addr) = self.endpoints.get(endpoint) {\n            return Some(*addr);\n        }\n        let now = Instant::now();\n        if let Some(deadline) = self.endpoint_retry.get(endpoint) {\n            if now < *deadline {\n                return None;\n            }\n        }\n        match resolve_endpoint(endpoint) {\n            Some(addr) => {\n                self.endpoints.insert(endpoint.to_string(), addr);\n                self.endpoint_retry.remove(endpoint);\n                Some(addr)\n            }\n            None => {\n                log_error(&format!(\"unable to resolve remote logging endpoint '{endpoint}'\"), true);\n                self.endpoint_retry.insert(endpoint.to_string(), now + Self::ENDPOINT_RETRY_INTERVAL);\n                None\n            }\n        }\n    }\n\n    fn send_datagram(&mut self, endpoint: &str, data: &[u8]) {\n        let Some(addr) = self.endpoint_addr(endpoint) else {\n            self.remote_log_errors += 1;\n            return;\n        };\n\n        let is_v6 = addr.is_ipv6();\n        let bind: &str = if is_v6 { \"[::]:0\" } else { \"0.0.0.0:0\" };\n        let sock = if is_v6 { &mut self.sock6 } else { &mut self.sock4 };\n        if sock.is_none() {\n            *sock = UdpSocket::bind(bind).ok();\n        }","sourceCodeStart":459,"sourceCodeEnd":495,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/output.rs#L459-L495","documentation":"The remote logging endpoint's hostname could not be resolved to an address. endpoint_addr caches resolved endpoints and backs off failed lookups for ENDPOINT_RETRY_INTERVAL; when resolution fails it logs this error, returns None, and the datagram for that event is dropped for now.","triggerScenarios":"send_datagram requests an endpoint not present in the cache, and ToSocketAddrs-style resolution of the configured '{endpoint}' returns None — bad hostname, no DNS, or no network at that moment. The endpoint is queued for retry after ENDPOINT_RETRY_INTERVAL.","commonSituations":"DNS server unreachable on the sensor host; typo in the remote log host config; endpoint hostname removed from DNS; sensor deployed in a network-isolated environment where only a local event log works.","solutions":["Verify the remote logging endpoint hostname in sensor configuration is correct and resolvable (dig/nslookup from the sensor host).","Fix DNS on the sensor host (check /etc/resolv.conf, firewall rules to the resolver).","The sensor retries resolution after ENDPOINT_RETRY_INTERVAL — confirm the error clears itself after transient DNS outages.","Pre-resolve and configure an IP literal for the endpoint if DNS is unreliable in the deployment."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# verify the configured remote logging endpoint resolves, from the sensor host\ndig +short \"$REMOTE_LOG_HOST\"\n# non-empty output means DNS is healthy for the endpoint","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate endpoint hostnames in config at sensor startup (fail fast on unresolvable hosts)","Run a local caching resolver on the sensor host to survive DNS blips","Use IP literals for endpoints where DNS is unreliable","Know that resolution retries automatically after ENDPOINT_RETRY_INTERVAL — expect self-healing for transient outages"],"tags":["dns","resolution","udp","logging"],"backgroundTag":"resource-not-found","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}