{"record":{"id":"b395e44da493deb4","repo":"crowdsecurity/crowdsec","slug":"could-not-listen-on-port-d-w","errorCode":null,"errorMessage":"could not listen on port %d: %w","messagePattern":"could not listen on port (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/server/syslogserver.go","lineNumber":32,"sourceCode":"\tconn          *net.UDPConn\n\tLogger        *log.Entry\n\tMaxMessageLen int\n}\n\ntype SyslogMessage struct {\n\tMessage []byte\n\tClient  string\n}\n\nfunc (s *SyslogServer) Listen(listenAddr string, port int) error {\n\tudpAddr, err := net.ResolveUDPAddr(\"udp\", net.JoinHostPort(listenAddr, strconv.Itoa(port)))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not resolve addr %s: %w\", listenAddr, err)\n\t}\n\n\tudpConn, err := net.ListenUDP(\"udp\", udpAddr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not listen on port %d: %w\", port, err)\n\t}\n\n\ts.Logger.Debugf(\"listening on %s:%d\", listenAddr, port)\n\ts.conn = udpConn\n\n\treturn nil\n}\n\nfunc (s *SyslogServer) Serve(ctx context.Context, msgChan chan SyslogMessage) error {\n\tgo func() {\n\t\t<-ctx.Done()\n\t\t// closing the socket unblocks ReadFrom()\n\t\ts.conn.Close()\n\t}()\n\n\t// RFC3164 says 1024 bytes max\n\t// RFC5424 says 480 bytes minimum, and should support up to 2048 bytes\n\tbuf := make([]byte, s.MaxMessageLen)","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/server/syslogserver.go#L14-L50","documentation":"The UDP address resolved but net.ListenUDP failed to bind the socket. Typical causes are the port already in use by another process, binding to an address not assigned to the machine, or lacking privileges for ports below 1024.","triggerScenarios":"Stream() -> Listen() with a port already bound by another syslog daemon (rsyslog/syslog-ng), a listen IP not present on the host, or port 514 as an unprivileged user.","commonSituations":"Running crowdsec as non-root while wanting the standard syslog port 514; rsyslog already holding 514/udp; docker container where 0.0.0.0 bind address differs; typo'd listen IP.","solutions":["Stop the process already bound to that UDP port (e.g. disable rsyslog's UDP listener) or choose another port.","For ports <1024, run crowdsec with elevated privileges or CAP_NET_BIND_SERVICE, or use a high port and forward with rsyslog.","Verify the listen IP is assigned to the host (ip addr); use 0.0.0.0 to bind all interfaces.","Read the wrapped OS error: 'address already in use' vs 'cannot assign requested address' distinguish the two cases."],"exampleFix":"// before (config.yaml)\nport: 514   # EACCES as non-root\n\n// after\nport: 5514  # or grant CAP_NET_BIND_SERVICE","handlingStrategy":"try-catch","validationCode":"if port < 1024 && os.Geteuid() != 0 {\n    return errors.New(\"binding ports <1024 requires root or CAP_NET_BIND_SERVICE\")\n}\n// check availability\nif conn, err := net.ListenPacket(\"udp\", fmt.Sprintf(\"%s:%d\", addr, port)); err == nil {\n    conn.Close()\n} else {\n    return fmt.Errorf(\"udp port %d unavailable: %w\", port, err)\n}","typeGuard":null,"tryCatchPattern":"if err := srv.Listen(addr, port); err != nil {\n    if strings.Contains(err.Error(), \"address already in use\") {\n        // stop competing daemon or pick another port\n    }\n    return err\n}","preventionTips":["Disable rsyslog/syslog-ng UDP listeners that compete on 514.","Use high ports (e.g. 5514) for non-root deployments.","Verify listen IP exists on the host with 'ip addr' before configuring."],"tags":["network","udp","bind","syslog"],"backgroundTag":"address-already-in-use","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}