crowdsecurity/crowdsec · error

could not get journalctl stderr: %w

Error message

could not get journalctl stderr: %w

What it means

runJournalCtl fails while creating the stderr pipe for the journalctl child process. It fires if exec.Cmd.StderrPipe returns an error (e.g. pipes already used or process already started), before journalctl is launched.

Source

Thrown at pkg/acquisition/modules/journalctl/run.go:58

	}

	return append(args, s.config.Filters...)
}

func (s *Source) runJournalCtl(ctx context.Context, out chan pipeline.Event) error {
	ctx, cancel := context.WithCancel(ctx)
	defer cancel()

	cmd := exec.CommandContext(ctx, journalctlCmd, s.getCommandArgs()...)

	stdout, err := cmd.StdoutPipe()
	if err != nil {
		return fmt.Errorf("could not get journalctl stdout: %w", err)
	}

	stderr, err := cmd.StderrPipe()
	if err != nil {
		return fmt.Errorf("could not get journalctl stderr: %w", err)
	}

	stderrChan := make(chan string)
	stdoutChan := make(chan string)
	errChan := make(chan error, 1)

	s.logger.WithField("command", formatShellCommand(cmd.Args)).Info("Spawning process")

	err = cmd.Start()
	if err != nil {
		s.logger.Errorf("Error spawning process: %s", err)
		return err
	}

	stdoutScanner := bufio.NewScanner(stdout)
	stderrScanner := bufio.NewScanner(stderr)

	// don't shadow parent context, we'll monitor later if it's canceled

View on GitHub (pinned to 909b515798)

Solutions

1. Retry the acquisition; this is an internal pipe-setup failure, usually transient
2. Report a bug if it reproduces consistently

Example fix

// before
cmd.Run()
stderr, err := cmd.StderrPipe() // fails
// after
stderr, err := cmd.StderrPipe()
if err != nil { return err }
cmd.Run()

// ensure fds are available before starting the source
f, err := os.Open(os.DevNull)
if err != nil { return errors.New("fd exhaustion likely") }
f.Close()

if err := runJournalCtl(ctx); err != nil {
    if strings.Contains(err.Error(), "could not get journalctl stderr") {
        // backoff and retry; inspect ulimit if persistent
    }
}

When it happens

Trigger: Calling OneShot or Stream when cmd.StderrPipe() errors — command already started before piping, or OS-level pipe/fd allocation failure.

Common situations: File-descriptor exhaustion on the host; a modified build that starts the command before requesting pipes.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• could not get journalctl stdout: %w
• journalctl exited with error: %w
• cannot parse: %s
• invalid DSN %s for journalctl source, must start with journa
• unsupported key %s in journalctl DSN

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/09f76a9b7657fbf7. Report an issue: GitHub.