{"record":{"id":"69758702f0283259","repo":"crowdsecurity/crowdsec","slug":"could-not-start-syslog-server-w","errorCode":null,"errorMessage":"could not start syslog server: %w","messagePattern":"could not start syslog server: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/run.go","lineNumber":31,"sourceCode":"\t\"golang.org/x/sync/errgroup\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/acquisition/modules/syslog/internal/parser/rfc3164\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/acquisition/modules/syslog/internal/parser/rfc5424\"\n\tsyslogserver \"github.com/crowdsecurity/crowdsec/pkg/acquisition/modules/syslog/internal/server\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/pipeline\"\n)\n\nfunc (s *Source) Stream(ctx context.Context, out chan pipeline.Event) error {\n\tsrv := &syslogserver.SyslogServer{\n\t\tLogger:        s.logger.WithField(\"syslog\", \"internal\"),\n\t\tMaxMessageLen: s.config.MaxMessageLen,\n\t}\n\n\tmsgChan := make(chan syslogserver.SyslogMessage)\n\n\tif err := srv.Listen(s.config.Addr, s.config.Port); err != nil {\n\t\treturn fmt.Errorf(\"could not start syslog server: %w\", err)\n\t}\n\n\tdefer func() {\n\t\t_ = srv.KillServer()\n\t}()\n\n\tg, ctx := errgroup.WithContext(ctx)\n\n\tg.Go(func() error {\n\t\tdefer close(msgChan)\n\t\treturn srv.Serve(ctx, msgChan)\n\t})\n\n\tg.Go(func() error {\n\t\tfor {\n\t\t\tselect {\n\t\t\tcase <-ctx.Done():\n\t\t\t\ts.logger.Debug(\"context canceled\")","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/run.go#L13-L49","documentation":"Stream() wraps any failure from SyslogServer.Listen — the syslog datasource could not start because its UDP listener could not be set up (resolve or bind failure). The wrapped error from Listen carries the specific root cause.","triggerScenarios":"srv.Listen(addr, port) fails inside Stream(): unresolvable listen address, port already bound by another daemon, unprivileged bind on port <1024, or listen IP not on the host.","commonSituations":"rsyslog/syslog-ng already on 514/udp; crowdsec run as non-root wanting 514; misconfigured listen_addr in acquis.yaml; container missing network capabilities.","solutions":["Read the wrapped inner error to distinguish resolve failure from bind failure and fix accordingly.","Free the UDP port (stop rsyslog's imudp) or configure a different port in the syslog stanza.","Run with privileges/CAP_NET_BIND_SERVICE if binding port 514 as non-root, or use a high port.","Set listen_addr to a valid local IP or 0.0.0.0."],"exampleFix":"// before (config.yaml)\nsource: syslog\nlisten_addr: 0.0.0.0\nport: 514    # taken by rsyslog\n\n// after\nsource: syslog\nlisten_addr: 0.0.0.0\nport: 5514","handlingStrategy":"try-catch","validationCode":"// validate before starting acquisition\nif net.ParseIP(cfg.ListenAddr) == nil || cfg.Port <= 0 || cfg.Port > 65535 {\n    return errors.New(\"invalid syslog listen config\")\n}","typeGuard":null,"tryCatchPattern":"if err := srv.Listen(s.config.Addr, s.config.Port); err != nil {\n    log.Errorf(\"syslog datasource failed to start: %v\", err)\n    // decide: skip datasource and continue, or abort startup\n    return err\n}","preventionTips":["Pre-check UDP port availability before configuring the datasource.","Choose non-privileged ports unless running as root.","Keep one syslog daemon per host/port; coordinate with rsyslog."],"tags":["network","udp","syslog","startup"],"backgroundTag":"address-already-in-use","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}