What causes "could not get journalctl stdout: %w" in crowdsecurity/crowdsec?

Check the wrapped inner error; if it says the command is already started, ensure StdoutPipe is called before Start.

could not get journalctl stdout: %w

Error message

could not get journalctl stdout: %w

What it means

runJournalCtl starts the journalctl binary via exec.CommandContext and asks for its stdout pipe before starting the process. StdoutPipe only fails in rare cases (the command already started, or OS pipe exhaustion), and the failure is wrapped with this message.

Source

Thrown at pkg/acquisition/modules/journalctl/run.go:53

		args = []string{"--follow", "-n", "0"}
	}

	if s.config.since != "" {
		args = append(args, "--since", s.config.since)
	}

	return append(args, s.config.Filters...)
}

func (s *Source) runJournalCtl(ctx context.Context, out chan pipeline.Event) error {
	ctx, cancel := context.WithCancel(ctx)
	defer cancel()

	cmd := exec.CommandContext(ctx, journalctlCmd, s.getCommandArgs()...)

	stdout, err := cmd.StdoutPipe()
	if err != nil {
		return fmt.Errorf("could not get journalctl stdout: %w", err)
	}

	stderr, err := cmd.StderrPipe()
	if err != nil {
		return fmt.Errorf("could not get journalctl stderr: %w", err)
	}

	stderrChan := make(chan string)
	stdoutChan := make(chan string)
	errChan := make(chan error, 1)

	s.logger.WithField("command", formatShellCommand(cmd.Args)).Info("Spawning process")

	err = cmd.Start()
	if err != nil {
		s.logger.Errorf("Error spawning process: %s", err)
		return err
	}

View on GitHub (pinned to 909b515798)

Solutions

Check the wrapped inner error; if it says the command is already started, ensure StdoutPipe is called before Start.
Inspect the process fd usage (ls /proc/<pid>/fd | wc -l) and raise the ulimit if exhausted.
Restart crowdsec to clear leaked descriptors; investigate any fd leaks in custom modules.
Verify journalctl exists and is executable (though usually that surfaces later as exec failure, not pipe failure).

Example fix

// before
cmd.Start()
stdout, err := cmd.StdoutPipe() // fails: already started
// after
stdout, err := cmd.StdoutPipe()
if err != nil { return err }
cmd.Start()

Defensive patterns

Strategy: retry

Validate before calling

// ensure fds are available before starting the source
f, err := os.Open(os.DevNull)
if err != nil { return errors.New("fd exhaustion likely") }
f.Close()

Try / catch

if err := runJournalCtl(ctx); err != nil {
    if strings.Contains(err.Error(), "could not get journalctl stdout") {
        // backoff and retry; check fd limits if persistent
    }
}

Prevention

Raise ulimit -n for the crowdsec service unit
Monitor open fd counts on long-running processes
Never call exec.Cmd Start/Run before obtaining pipes in custom builds

When it happens

Trigger: Calling OneShot or Stream when cmd.StdoutPipe() returns a non-nil error — typically the command has already been started (Start/Run called before piping) or the OS cannot allocate a pipe (fd limit reached).

Common situations: Very high file-descriptor usage on a long-running crowdsec process (fd leak elsewhere); embedding/reusing the exec.Cmd incorrectly in a patched build.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/3522aef7b8afdc13. Report an issue: GitHub.