{"record":{"id":"5b01a6e2e9d0e5be","repo":"elastic/elasticsearch","slug":"could-not-open-systemd-socket","errorCode":null,"errorMessage":"Could not open systemd socket: {}","messagePattern":"Could not open systemd socket: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/Systemd.java","lineNumber":114,"sourceCode":"                    if (error != null) {\n                        error.addSuppressed(e);\n                        throw error;\n                    } else {\n                        throw e;\n                    }\n                }\n            } else if (error != null) {\n                throw error;\n            }\n        }\n    }\n\n    private void throwOrLog(String message, boolean warnOnError) {\n        if (warnOnError) {\n            logger.warn(message);\n        } else {\n            logger.error(message);\n            throw new RuntimeException(message);\n        }\n    }\n}\n","sourceCodeStart":96,"sourceCodeEnd":118,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/Systemd.java#L96-L118","documentation":"Thrown (or logged as a warning) by the Systemd notification module when the underlying socket() syscall fails to create a Unix datagram socket. For notify_ready() (warnOnError=false) it throws a RuntimeException after logging at ERROR level; for notify_extend_timeout() and notify_stopping() (warnOnError=true) it only logs a WARN. This indicates the OS denied socket creation, typically due to file descriptor exhaustion or permission issues.","triggerScenarios":"Calling systemd.notify_ready() when the process has hit its file descriptor limit (ulimit -n), or when running in a restricted environment that blocks AF_UNIX/SOCK_DGRAM socket creation. The libc.socket() call returns a negative fd.","commonSituations":"Running under a very low RLIMIT_NOFILE. Container with seccomp profiles blocking socket() for non-root. Running outside systemd (NOTIFY_SOCKET set but process lacks socket privileges). FD leak exhausting the descriptor table.","solutions":["Check process file descriptor limits with 'ulimit -n' or 'cat /proc/<pid>/limits' and raise if needed.","If systemd is not managing the process, unset NOTIFY_SOCKET or skip the notify_ready() call.","Investigate FD leaks: 'ls -1 /proc/<pid>/fd | wc -l'.","If in a container, ensure the seccomp/AppArmor profile permits AF_UNIX socket creation."],"exampleFix":"// before: unconditionally notifying systemd\nsystemd.notify_ready();\n\n// after: guard with NOTIFY_SOCKET presence check\nString notifySocket = System.getenv(\"NOTIFY_SOCKET\");\nif (notifySocket != null && !notifySocket.isEmpty()) {\n    try {\n        systemd.notify_ready();\n    } catch (RuntimeException e) {\n        logger.warn(\"Failed to notify systemd, continuing without sd_notify\", e);\n    }\n}","handlingStrategy":"try-catch","validationCode":"String notifySocket = System.getenv(\"NOTIFY_SOCKET\");\nif (notifySocket == null || notifySocket.isEmpty()) {\n    // systemd is not managing this process; skip notification\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    systemd.notify_ready();\n} catch (RuntimeException e) {\n    logger.warn(\"systemd READY=1 notification failed; process will continue\", e);\n}","preventionTips":["Only call notify_ready() when NOTIFY_SOCKET is set and non-empty.","Monitor file descriptor usage to avoid exhaustion.","Ensure container seccomp profiles allow AF_UNIX socket creation."],"tags":["systemd","linux","native","process-management","socket"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}