{"record":{"id":"c55bd96049c517d1","repo":"crowdsecurity/crowdsec","slug":"invalid-listen-ip-s","errorCode":null,"errorMessage":"invalid listen IP %s","messagePattern":"invalid listen IP (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/config.go","lineNumber":64,"sourceCode":"\t\tc.Addr = \"127.0.0.1\" // do we want a usable or secure default ?\n\t}\n\n\tif c.Port == 0 {\n\t\tc.Port = 514\n\t}\n\n\tif c.MaxMessageLen == 0 {\n\t\tc.MaxMessageLen = 2048\n\t}\n}\n\nfunc (c *Configuration) Validate() error {\n\tif c.Port <= 0 || c.Port > 65535 {\n\t\treturn fmt.Errorf(\"invalid port %d\", c.Port)\n\t}\n\n\tif net.ParseIP(c.Addr) == nil {\n\t\treturn fmt.Errorf(\"invalid listen IP %s\", c.Addr)\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\tcfg, err := ConfigurationFromYAML(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\ts.config = cfg\n\n\treturn nil\n}\n\nfunc (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {\n\terr := s.UnmarshalConfig(yamlConfig)","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/config.go#L46-L82","documentation":"Validate() rejects the configured listen address when net.ParseIP cannot parse it as a valid IP literal. The syslog server binds UDP on this address, so it must be a concrete IPv4/IPv6 address, not a hostname or arbitrary string.","triggerScenarios":"The 'listen_addr' field in the syslog acquisition config contains a hostname (e.g. 'localhost'), an empty string, a malformed IP ('0.0.0.0.0'), or an interface name.","commonSituations":"Writing 'localhost' instead of '127.0.0.1'; leaving listen_addr empty so it parses as ''; typos like '127.0.0.256'; using a DNS name expecting resolution that Validate does not perform.","solutions":["Replace listen_addr with a valid IP literal such as 0.0.0.0 (all interfaces), 127.0.0.1, or the machine's IPv4/IPv6 address.","If listen_addr is empty, add it explicitly to the syslog stanza.","Use a hostname only if the code path resolves it before Validate; otherwise resolve it yourself and put the IP in config."],"exampleFix":"// before (config.yaml)\nsource: syslog\nlisten_addr: localhost\nport: 514\n\n// after\nsource: syslog\nlisten_addr: 127.0.0.1\nport: 514","handlingStrategy":"validation","validationCode":"if net.ParseIP(cfg.ListenAddr) == nil {\n    return fmt.Errorf(\"listen_addr must be an IP literal, got %q\", cfg.ListenAddr)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use IP literals (0.0.0.0, 127.0.0.1) not hostnames in listen_addr.","Never leave listen_addr empty in a syslog stanza.","Sanity-check hand-edited acquis.yaml with a linter or dry run."],"tags":["config","network","syslog","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}