crowdsecurity/crowdsec · warning

could not close UDP connection: %w

Error message

could not close UDP connection: %w

What it means

KillServer() failed to close the UDP connection. Close() on the socket returned an error, most commonly because the connection was already closed (use of closed network connection) or s.conn is in an unusable state.

Source

Thrown at pkg/acquisition/modules/syslog/internal/server/syslogserver.go:74

				return nil //nolint:nilerr  // context cancelation is not a failure
			}

			return fmt.Errorf("reading from socket: %w", err)
		}

		msg := SyslogMessage{Message: buf[:n], Client: strings.Split(addr.String(), ":")[0]}

		select {
		case msgChan <- msg:
		case <-ctx.Done():
			return nil
		}
	}
}

func (s *SyslogServer) KillServer() error {
	if err := s.conn.Close(); err != nil {
		return fmt.Errorf("could not close UDP connection: %w", err)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Treat this as a shutdown-time warning if the underlying error is 'use of closed network connection' — the socket is already gone, which is the desired end state.
2. Ensure KillServer is called exactly once per Listen (check defer chains in Stream and reload logic).
3. If it recurs, check for races between Serve returning and the deferred KillServer in run.go.

if err := srv.KillServer(); err != nil {
    if errors.Is(err, net.ErrClosed) || strings.Contains(err.Error(), "use of closed") {
        return nil // already closed, acceptable at shutdown
    }
    return err
}

When it happens

Trigger: KillServer is called after the connection was already closed elsewhere (e.g. Serve aborted and a second shutdown path ran), or during teardown after a read error left the socket dead.

Common situations: Double shutdown during crowdsec exit; acquisition reload killing a server whose Serve loop already closed the socket; nil/failed Listen leaving conn unset in older code paths.

Related errors

• could not resolve addr %s: %w
• could not listen on port %d: %w
• reading from socket: %w
• could not start syslog server: %w
• invalid port %d

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4cf9d1a00566d3d6. Report an issue: GitHub.