{"record":{"id":"6d8ae6ad0d298606","repo":"apache/hadoop","slug":"s09","errorCode":"S09","errorMessage":"Could not set service [{0}] programmatically -server shutting down-, {1}","messagePattern":"Could not set service \\[(.+?)\\] programmatically -server shutting down-, (.+?)","errorType":"error_code","errorClass":"ServerException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/lib/server/Server.java","lineNumber":767,"sourceCode":"      throw new IllegalStateException(\"Server shutting down\");\n    }\n    try {\n      Service newService = klass.newInstance();\n      Service oldService = services.get(newService.getInterface());\n      if (oldService != null) {\n        try {\n          oldService.destroy();\n        } catch (Throwable ex) {\n          log.error(\"Could not destroy service [{}], {}\",\n                    new Object[]{oldService.getInterface(), ex.getMessage(), ex});\n        }\n      }\n      newService.init(this);\n      services.put(newService.getInterface(), newService);\n    } catch (Exception ex) {\n      log.error(\"Could not set service [{}] programmatically -server shutting down-, {}\", klass, ex);\n      destroy();\n      throw new ServerException(ServerException.ERROR.S09, klass, ex.getMessage(), ex);\n    }\n  }\n\n}\n","sourceCodeStart":749,"sourceCodeEnd":772,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/lib/server/Server.java#L749-L772","documentation":"Server.setService(Class, Service) is HttpFS's programmatic hot-swap API: it destroys the currently registered service for an interface and calls init() on the replacement. Error S09 ('Could not set service programmatically -server shutting down-') is thrown when the replacement's init() throws; by then the server has already called destroy() on itself, so the server is down and must be restarted.","triggerScenarios":"Calling server.setService(SomeService.class, newService) where newService.init(this) throws - e.g. a replacement FileSystemAccessService with missing kerberos/hadoop-conf configuration, or a mock service in a test whose init fails; any Exception (other than during old-service destroy, which is only logged) triggers S09 after destroy().","commonSituations":"Integration tests injecting mock services that are not fully configured; runtime replacement of FileSystemAccessService with one pointing at a wrong hadoop config dir; using setService against a server whose service dependencies were already destroyed.","solutions":["Fix the underlying init failure shown in the preceding log.error line and the exception message - setService failed because the new service could not initialize","Verify every configuration key the replacement service reads (e.g. httpfs.hadoop.* keys) is present before calling setService","Remember the server has destroyed itself after this error - restart it; do not retry setService on the dead instance","Test the replacement service's init() against a scratch Server before hot-swapping on a live one"],"exampleFix":"// before: replacement service with missing config, init() throws -> server shuts down\nserver.setService(FileSystemAccess.class, new FileSystemAccessService());\n\n// after: configure the service before injecting it (or use a fully initialized instance)\nConfiguration conf = server.getConfig();\nconf.set(\"httpfs.hadoop.config.dir\", \"/etc/hadoop/conf\");\nconf.set(\"httpfs.hadoop.authentication.type\", \"simple\");\nserver.setService(FileSystemAccess.class, new FileSystemAccessService());","handlingStrategy":"try-catch","validationCode":"// Validate the replacement's init on a throwaway server before hot-swapping\nServer scratch = new Server(\"httpfs\", config, null);\ntry {\n  newService.init(scratch);\n  newService.destroy();\n} catch (Exception ex) {\n  throw new IllegalStateException(\"replacement service not ready\", ex);\n}","typeGuard":null,"tryCatchPattern":"try {\n  server.setService(FileSystemAccess.class, newService);\n} catch (ServerException ex) {\n  if (ex.getError() == ServerException.ERROR.S09) {\n  \t// server has destroyed itself - restart, do not retry setService\n    log.error(\"setService failed, server shut down: {}\", ex.getMessage(), ex);\n    restartHttpfs();\n  }\n}","preventionTips":["Fully configure a service before injecting it with setService","Prefer restart-based reconfiguration over setService in production unless you can rebuild the server","Treat S09 as fatal for the instance: any retry must start from a fresh Server","Cover setService failure paths in integration tests so mocks are known-good"],"tags":["httpfs","hot-swap","runtime-admin","service-lifecycle"],"backgroundTag":"service-init-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}