{"record":{"id":"6aaee1e706b6e1c9","repo":"stamparm/maltrail","slug":"unable-to-send-to-remote-logging-endpoint-endpoint","errorCode":null,"errorMessage":"unable to send to remote logging endpoint '{endpoint}'","messagePattern":"unable to send to remote logging endpoint '(.+?)'","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sensor/src/output.rs","lineNumber":517,"sourceCode":"            self.remote_log_errors += 1;\n            return;\n        };\n        if s.send_to(data, addr).is_err() {\n            // Drop and recreate the socket once, exactly like `_send_datagram`.\n            let fresh = UdpSocket::bind(bind).ok();\n            let retried = match &fresh {\n                Some(f) => f.send_to(data, addr).is_ok(),\n                None => false,\n            };\n            if is_v6 {\n                self.sock6 = fresh;\n            } else {\n                self.sock4 = fresh;\n            }\n            if !retried {\n                // The second failure used to be discarded outright, so a remote-only deployment\n                // could lose every event while `events_written` kept climbing.\n                log_error(&format!(\"unable to send to remote logging endpoint '{endpoint}'\"), true);\n                self.remote_log_errors += 1;\n            }\n        }\n    }\n\n    /// `core/log.py:flush_condensed_events()`\n    pub fn flush_condensed(&mut self) {\n        if self.condensed.is_empty() {\n            self.last_condense_flush = Instant::now();\n            return;\n        }\n        let snapshot: Vec<Vec<Event>> = self.condensed.drain().map(|(_, v)| v).collect();\n        self.last_condense_flush = Instant::now();\n\n        for events in snapshot {\n            if let Some(merged) = merge_events(&events) {\n                self.log_event(&merged, false, true);\n            }","sourceCodeStart":499,"sourceCodeEnd":535,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/output.rs#L499-L535","documentation":"The UDP send to the remote logging endpoint failed even after the sensor dropped and recreated the socket and retried once. The first failure is transparently retried with a fresh socket; only a second failure is logged, incremented in remote_log_errors, and the event is not delivered remotely.","triggerScenarios":"send_datagram's s.send_to(data, addr) fails, a fresh socket is bound and the retry send also fails (or !retried), while writing an event via write_line — typically network unreachable, ICMP port unreachable, or interface down.","commonSituations":"Firewall dropping outbound UDP to the collector; collector host down (ICMP unreachable surfaces as send errors on connected paths); routing changes; MTU issues for large datagrams; sensor deployed in a network-isolated segment.","solutions":["Verify network reachability to '{endpoint}' from the sensor host (ping, firewall rules, security groups allowing outbound UDP).","Confirm the remote collector is running and reachable; UDP send errors often indicate ICMP port-unreachable from a dead collector.","Check routing/MTU if errors began after a network change; try reducing datagram size.","Note events are still counted in events_written but not delivered remotely — pair remote logging with the local event log so records survive network outages."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"# check outbound UDP reachability to the collector before relying on remote logging\nnc -vzu <collector-host> <udp-port>","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair remote logging with the local event log so events survive network outages","Open firewall/security-group rules for outbound UDP to the collector","Monitor remote_log_errors metrics and alert on sustained nonzero rates","Ensure the collector host is up — UDP send failures often come from ICMP port-unreachable"],"tags":["udp","network","send","logging"],"backgroundTag":"network-request-failed","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}