{"record":{"id":"8d1cc0c2f8c2dd77","repo":"stamparm/maltrail","slug":"unable-to-open-a-remote-logging-socket-for-endpoint","errorCode":null,"errorMessage":"unable to open a remote logging socket for '{endpoint}'","messagePattern":"unable to open a remote logging socket for '(.+?)'","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sensor/src/output.rs","lineNumber":498,"sourceCode":"            }\n        }\n    }\n\n    fn send_datagram(&mut self, endpoint: &str, data: &[u8]) {\n        let Some(addr) = self.endpoint_addr(endpoint) else {\n            self.remote_log_errors += 1;\n            return;\n        };\n\n        let is_v6 = addr.is_ipv6();\n        let bind: &str = if is_v6 { \"[::]:0\" } else { \"0.0.0.0:0\" };\n        let sock = if is_v6 { &mut self.sock6 } else { &mut self.sock4 };\n        if sock.is_none() {\n            *sock = UdpSocket::bind(bind).ok();\n        }\n        let Some(s) = sock.as_ref() else {\n            // A socket that will not bind used to be swallowed by `.ok()` and an early return.\n            log_error(&format!(\"unable to open a remote logging socket for '{endpoint}'\"), true);\n            self.remote_log_errors += 1;\n            return;\n        };\n        if s.send_to(data, addr).is_err() {\n            // Drop and recreate the socket once, exactly like `_send_datagram`.\n            let fresh = UdpSocket::bind(bind).ok();\n            let retried = match &fresh {\n                Some(f) => f.send_to(data, addr).is_ok(),\n                None => false,\n            };\n            if is_v6 {\n                self.sock6 = fresh;\n            } else {\n                self.sock4 = fresh;\n            }\n            if !retried {\n                // The second failure used to be discarded outright, so a remote-only deployment\n                // could lose every event while `events_written` kept climbing.","sourceCodeStart":480,"sourceCodeEnd":516,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/output.rs#L480-L516","documentation":"The sensor could not bind a local UDP socket needed to send remote logging datagrams for this endpoint. Previously such bind failures were silently swallowed; now the sensor logs this error, increments remote_log_errors, and drops the event's datagram.","triggerScenarios":"send_datagram finds self.sock4/sock6 is None for the required address family and UdpSocket::bind(bind) fails or returns None — e.g. the requested local bind address/port is unavailable, or the address family is not configured on the host (no IPv6 support while endpoint resolves to v6).","commonSituations":"Host lacks IPv6 (no v6 interfaces) but the endpoint is v6; another process holds the bound port (address in use); sandbox/container without the network capability to bind; restrictive SELinux/AppArmor policy.","solutions":["Check whether the required address family is available (ip addr / `ip -6 addr`); disable v6 remote logging or add v6 connectivity if is_v6 fails on a v4-only host.","Check for port/address conflicts with ss -lunp and stop the conflicting process or change the configured bind address.","Ensure the sensor process has network bind permission (containers: add CAP_NET_RAW/NET_BIND_SERVICE or adjust sandbox policy).","Watch remote_log_errors metrics; bind failures persist until the environment is fixed since each event re-attempts the bind."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# before starting the sensor, confirm both address families can bind\nip -4 addr show | grep -q inet  || echo \"no IPv4\"\nip -6 addr show | grep -q inet6 || echo \"no IPv6 (v6 remote logging will fail)\"\nss -lunp | grep \"<bind-port>\"   # detect address-in-use conflicts","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only enable IPv6 remote logging on hosts with IPv6 connectivity","Grant the sensor container/process network bind capabilities","Pick a non-conflicting local bind address/port in configuration","Test remote logging after network or sandbox policy changes"],"tags":["udp","socket","bind","network"],"backgroundTag":"address-already-in-use","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}