{"record":{"id":"f72b81e02b87fc30","repo":"crowdsecurity/crowdsec","slug":"reading-from-socket-w","errorCode":null,"errorMessage":"reading from socket: %w","messagePattern":"reading from socket: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/server/syslogserver.go","lineNumber":59,"sourceCode":"func (s *SyslogServer) Serve(ctx context.Context, msgChan chan SyslogMessage) error {\n\tgo func() {\n\t\t<-ctx.Done()\n\t\t// closing the socket unblocks ReadFrom()\n\t\ts.conn.Close()\n\t}()\n\n\t// RFC3164 says 1024 bytes max\n\t// RFC5424 says 480 bytes minimum, and should support up to 2048 bytes\n\tbuf := make([]byte, s.MaxMessageLen)\n\n\tfor {\n\t\tn, addr, err := s.conn.ReadFrom(buf)\n\t\tif err != nil {\n\t\t\tif ctx.Err() != nil {\n\t\t\t\treturn nil //nolint:nilerr  // context cancelation is not a failure\n\t\t\t}\n\n\t\t\treturn fmt.Errorf(\"reading from socket: %w\", err)\n\t\t}\n\n\t\tmsg := SyslogMessage{Message: buf[:n], Client: strings.Split(addr.String(), \":\")[0]}\n\n\t\tselect {\n\t\tcase msgChan <- msg:\n\t\tcase <-ctx.Done():\n\t\t\treturn nil\n\t\t}\n\t}\n}\n\nfunc (s *SyslogServer) KillServer() error {\n\tif err := s.conn.Close(); err != nil {\n\t\treturn fmt.Errorf(\"could not close UDP connection: %w\", err)\n\t}\n\n\treturn nil","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/server/syslogserver.go#L41-L77","documentation":"Serve()'s read loop failed on s.conn.ReadFrom. The UDP socket returned a read error that was not context cancelation, so the acquisition stream is aborted with this wrapped error. Network interface changes, socket closure, or buffer issues surface here.","triggerScenarios":"The UDP socket errors during ReadFrom: connection refused (ICMP port unreachable from a previous send), the socket was closed concurrently, or an OS-level socket error occurred while ctx is still alive.","commonSituations":"Interface flapping on the host; another component closing the conn while Serve is reading; kernel dropping with errors; running in a container whose network namespace is torn down.","solutions":["Inspect the wrapped error; for 'use of closed network connection' find what closed the socket (KillServer called twice or early).","Check network interface stability and host logs (dmesg/journalctl) for socket-level faults.","If transient, restart crowdsec; the acquisition will re-bind a fresh UDP socket.","Verify the context is not being canceled mid-run in your orchestration, since cancelation returns nil but other errors abort the datasource."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"n, addr, err := conn.ReadFrom(buf)\nif err != nil {\n    if ctx.Err() != nil {\n        return nil\n    }\n    if errors.Is(err, net.ErrClosed) {\n        // socket closed intentionally, stop loop\n        return nil\n    }\n    // transient: log and continue or restart with backoff\n}","preventionTips":["Ensure exactly one owner closes the UDP socket (guard against double KillServer).","Monitor host network interface stability for the acquisition host.","Keep the context lifetime aligned with the server lifecycle."],"tags":["network","udp","socket","syslog"],"backgroundTag":"network-request-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}