{"record":{"id":"b5c0ca8b0577ff29","repo":"crowdsecurity/crowdsec","slug":"journalctl-exited-with-error-w","errorCode":null,"errorMessage":"journalctl exited with error: %w","messagePattern":"journalctl exited with error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/journalctl/run.go","lineNumber":126,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t})\n\n\tcleanup := func() error {\n\t\t// drain scanners\n\t\t_ = g.Wait()\n\t\t// reap journalctl, check status code\n\t\tcmdErr := cmd.Wait()\n\n\t\t// if the parent context was canceled, the journalctl error is likely \"signal: killed\" and we ignore that\n\t\tif ctx.Err() != nil {\n\t\t\treturn nil //nolint:nilerr\n\t\t}\n\n\t\tif cmdErr != nil {\n\t\t\treturn fmt.Errorf(\"journalctl exited with error: %w\", cmdErr)\n\t\t}\n\n\t\t// clean journalctl exit: should only happen in oneshot\n\t\treturn nil\n\t}\n\n\tfor {\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\ts.logger.Info(\"Datasource stopping\")\n\t\t\treturn cleanup()\n\t\tcase stdoutLine, ok := <-stdoutChan:\n\t\t\tif !ok {\n\t\t\t\ts.logger.Debug(\"stdout channel is closed, stopping datasource\")\n\t\t\t\treturn cleanup()\n\t\t\t}\n\n\t\t\tline := pipeline.Line{","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/journalctl/run.go#L108-L144","documentation":"After journalctl exits, runJournalCtl checks whether the parent context was canceled (normal shutdown, in which case 'signal: killed' is ignored and nil is returned). If the context was not canceled and the command exited non-zero, the exit error is wrapped with this message — meaning journalctl itself failed (bad args, no permission to read the journal, corrupted journal, etc.).","triggerScenarios":"OneShot or Stream runs journalctl which terminates with a non-zero exit code while crowdsec is not shutting down — e.g. invalid filters, user not in systemd-journal/adm group, or journald unavailable.","commonSituations":"Running crowdsec as a user lacking journal read permissions; typo in a filter causing journalctl to exit with 'unknown field'; system journal corruption; journalctl removed/upgraded mid-run.","solutions":["Run the same journalctl command manually (journalctl --output=json with your filters) to see its real error output.","Add the crowdsec user to the systemd-journal (or adm) group: usermod -aG systemd-journal crowdsec.","Fix invalid filter expressions — journalctl rejects unknown journal fields with a non-zero exit.","Check journalctl binary presence/version: which journalctl; journalctl --version.","If the error says 'signal: killed' during shutdown, it is benign — context cancellation handling already ignores that case."],"exampleFix":"// before (as unprivileged user)\ns.Stream() // journalctl exits 1: permission denied\n// after\n// systemctl restart crowdsec  (after adding user to systemd-journal group)\ns.Stream()","handlingStrategy":"try-catch","validationCode":"// before enabling the source, verify the exact command works\nout, err := exec.Command(\"journalctl\", append([]string{\"--output=json\"}, args...)...).CombinedOutput()\nif err != nil { return fmt.Errorf(\"journalctl precheck failed: %v: %s\", err, out) }","typeGuard":null,"tryCatchPattern":"if err := src.Stream(); err != nil {\n    if strings.Contains(err.Error(), \"journalctl exited with error\") {\n        // run journalctl manually with same args; fix perms/filters\n    }\n}","preventionTips":["Add the crowdsec user to the systemd-journal group","Test filters with journalctl CLI before putting them in the DSN","Pin journalctl/systemd versions and avoid mid-run upgrades","Distinguish shutdown 'signal: killed' (benign) from real exit codes"],"tags":["go","exec","journalctl","exit-code","permissions"],"backgroundTag":"git-command-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}