{"record":{"id":"f4327b89b9143d8f","repo":"nginx/nginx","slug":"ngx-log-alert-f4327b","errorCode":"NGX_LOG_ALERT","errorMessage":"<ngx_close_socket_n> failed","messagePattern":"<ngx_close_socket_n> failed","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/core/ngx_syslog.c","lineNumber":317,"sourceCode":"\n    if (peer->conn.fd == (ngx_socket_t) -1) {\n        if (ngx_syslog_init_peer(peer) != NGX_OK) {\n            return NGX_ERROR;\n        }\n    }\n\n    if (ngx_send) {\n        n = ngx_send(&peer->conn, buf, len);\n\n    } else {\n        /* event module has not yet set ngx_io */\n        n = ngx_os_io.send(&peer->conn, buf, len);\n    }\n\n    if (n == NGX_ERROR) {\n\n        if (ngx_close_socket(peer->conn.fd) == -1) {\n            ngx_log_error(NGX_LOG_ALERT, &peer->log, ngx_socket_errno,\n                          ngx_close_socket_n \" failed\");\n        }\n\n        peer->conn.fd = (ngx_socket_t) -1;\n    }\n\n    return n;\n}\n\n\nstatic ngx_int_t\nngx_syslog_init_peer(ngx_syslog_peer_t *peer)\n{\n    ngx_socket_t  fd;\n\n    fd = ngx_socket(peer->server.sockaddr->sa_family, SOCK_DGRAM, 0);\n    if (fd == (ngx_socket_t) -1) {\n        ngx_log_error(NGX_LOG_ALERT, &peer->log, ngx_socket_errno,","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/nginx/nginx/blob/3f6f7824d4e2eb1ac37dec76683d525ac0ff521c/src/core/ngx_syslog.c#L299-L335","documentation":"When a syslog send() returns NGX_ERROR, nginx tries to tear down the UDP socket so the next attempt reconnects; if that close() itself fails it logs this ALERT (with the socket errno) and still resets peer->conn.fd to -1. The close failure is secondary — the primary event is the send error, typically an ICMP port-unreachable surfacing on a connected UDP socket.","triggerScenarios":"Syslog daemon stopped or is not listening on 127.0.0.1:514 while nginx sends (connected UDP makes ECONNREFUSED surface on the next send); the unix datagram socket vanished; followed by close() returning -1 (e.g. EBADF after an external fd close).","commonSituations":"rsyslog restarted or crashed with nginx running; syslog-ng socket rotated; containerized syslog sidecar down; appears in the error log right when log shipping breaks.","solutions":["Check the syslog daemon is up and listening: `ss -ulnp | grep 514` or verify the unix socket path exists","Inspect the preceding log lines for the send() error that triggered the close path","Restart/reload the syslog service; nginx re-initializes the peer automatically on the next message","If close failures persist, look for fd table corruption or external tools (debuggers, fd-closing 'cleaners') touching nginx fds"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"# Pre-deploy: confirm the syslog destination answers\nif [[ \"$SERVER\" == unix:* ]]; then\n  [ -S \"${SERVER#unix:}\" ] || { echo \"missing syslog socket\"; exit 1; }\nelse\n  printf '<13>ping' | timeout 1 nc -u -w1 \"${SERVER%%:*}\" \"${SERVER##*:}\" || echo 'warn: no UDP ack (normal for syslog)'\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep a local syslog daemon (or /dev/log relay) on every nginx host so sends never depend on the network","Monitor for ECONNREFUSED/ALERT syslog messages as an early log-pipeline outage signal","Do not kill -9 the syslog daemon without a supervisor that recreates its socket"],"tags":["nginx","syslog","socket","udp","runtime"],"backgroundTag":"socket-close-failed","analyzedSha":"3f6f7824d4e2eb1ac37dec76683d525ac0ff521c","analyzedAt":"2026-08-22T03:09:46.447Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}