{"record":{"id":"c011212fc4d80496","repo":"crowdsecurity/crowdsec","slug":"unable-to-read-logs-from-service-s-w","errorCode":null,"errorMessage":"unable to read logs from service %s: %w","messagePattern":"unable to read logs from service (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/docker/run.go","lineNumber":751,"sourceCode":"\t}\n}\n\nfunc (d *Source) tailServiceAttempt(ctx context.Context, service *ContainerConfig, outChan chan pipeline.Event, bo backoff.BackOff) error {\n\t// For services, we need to get the service logs using the service logs API\n\t// Docker service logs aggregates logs from all running tasks of the service\n\tlogOptions := client.ServiceLogsOptions{\n\t\tShowStdout: service.logOptions.ShowStdout,\n\t\tShowStderr: service.logOptions.ShowStderr,\n\t\tSince:      service.logOptions.Since,\n\t\tUntil:      service.logOptions.Until,\n\t\tTimestamps: service.logOptions.Timestamps,\n\t\tFollow:     service.logOptions.Follow,\n\t\tTail:       service.logOptions.Tail,\n\t\tDetails:    service.logOptions.Details,\n\t}\n\tdockerReader, err := d.Client.ServiceLogs(ctx, service.ID, logOptions)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to read logs from service %s: %w\", service.Name, err)\n\t}\n\n\t// Log connection (both initial and reconnections)\n\tservice.logger.Info(\"connected to service logs\")\n\n\tbo.Reset()\n\n\t// Service logs don't use TTY, so we always use the dlog reader\n\treader := dlog.NewReader(dockerReader)\n\tscanner := bufio.NewScanner(reader)\n\n\treaderChan := make(chan string)\n\treaderTomb := &tomb.Tomb{}\n\treaderTomb.Go(func() error {\n\t\treturn ReadTailScanner(scanner, readerChan, readerTomb)\n\t})\n\n\tfor {","sourceCodeStart":733,"sourceCodeEnd":769,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/docker/run.go#L733-L769","documentation":"tailServiceAttempt opens a swarm service log stream with d.Client.ServiceLogs(ctx, service.ID, logOptions). If that API call fails, it wraps as \"unable to read logs from service %s\". It means the docker API refused the ServiceLogs request for the configured swarm service.","triggerScenarios":"ServiceLogs called for a service ID that no longer exists (service removed/updated between discovery and tail), the node is not a swarm manager (ServiceLogs requires manager access), or the daemon/proxy rejects the /services/{id}/logs endpoint.","commonSituations":"Pointing the docker datasource at a worker node's socket instead of a manager; service redeployed with a new ID; docker-socket-proxy blocking /services routes; swarm mode left after `docker swarm leave`.","solutions":["Ensure the configured docker_host is a swarm manager node: `docker service ls` must work with the same credentials/socket.","Verify the service name/ID is current (`docker service ps <name>`); service IDs change on redeploys.","With docker-socket-proxy, whitelist /services and /services/{id}/logs.","Rely on the retry backoff — the attempt loop will re-resolve the service and reconnect."],"exampleFix":"// before\ndocker_host: unix:///var/run/docker.sock  # on a worker node\n// after — point at a manager node\ndocker_host: tcp://manager:2377","handlingStrategy":"retry","validationCode":"// Go: confirm manager access and service existence first\nservices, err := cli.ServiceList(ctx, service.ListOptions{})\nif err != nil {\n\treturn fmt.Errorf(\"not a swarm manager or daemon unreachable: %w\", err)\n}\nfor _, s := range services {\n\tif s.Spec.Name == targetService {\n\t\treturn s.ID, nil\n\t}\n}\nreturn \"\", fmt.Errorf(\"service %q not found\", targetService)","typeGuard":null,"tryCatchPattern":"err := d.tailServiceAttempt(ctx, service, outChan, bo)\nif err != nil && strings.Contains(err.Error(), \"unable to read logs from service\") {\n\ttime.Sleep(bo.NextBackOff())\n\t// retry, re-resolving service ID\n}","preventionTips":["Point docker_host at a swarm manager, not a worker.","Resolve services by stable name, not ephemeral ID.","Whitelist /services endpoints behind docker-socket-proxy.","Verify `docker service ls` works with the same credentials before deploying."],"tags":["docker","swarm","logs","acquisition"],"backgroundTag":"file-read-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}