crowdsecurity/crowdsec · error

could not resolve addr %s: %w

Error message

could not resolve addr %s: %w

What it means

SyslogServer.Listen failed to resolve the UDP address before binding. net.ResolveUDPAddr on "udp" <addr:port> errors when the host part is not a valid IP or a resolvable hostname, or when the port is not numeric. The wrapped underlying error names the exact cause.

Source

Thrown at pkg/acquisition/modules/syslog/internal/server/syslogserver.go:27

	log "github.com/sirupsen/logrus"
)

type SyslogServer struct {
	conn          *net.UDPConn
	Logger        *log.Entry
	MaxMessageLen int
}

type SyslogMessage struct {
	Message []byte
	Client  string
}

func (s *SyslogServer) Listen(listenAddr string, port int) error {
	udpAddr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(listenAddr, strconv.Itoa(port)))
	if err != nil {
		return fmt.Errorf("could not resolve addr %s: %w", listenAddr, err)
	}

	udpConn, err := net.ListenUDP("udp", udpAddr)
	if err != nil {
		return fmt.Errorf("could not listen on port %d: %w", port, err)
	}

	s.Logger.Debugf("listening on %s:%d", listenAddr, port)
	s.conn = udpConn

	return nil
}

func (s *SyslogServer) Serve(ctx context.Context, msgChan chan SyslogMessage) error {
	go func() {
		<-ctx.Done()
		// closing the socket unblocks ReadFrom()
		s.conn.Close()

View on GitHub (pinned to 909b515798)

Solutions

1. Set listen_addr to a valid IP literal (e.g. 0.0.0.0) in the syslog acquisition config.
2. Check the wrapped error for DNS failures and fix name resolution (resolv.conf, /etc/hosts).
3. Ensure the port is a valid integer 1-65535 so JoinHostPort produces 'addr:port'.

Example fix

// before
listen_addr: myhost.internal  # DNS broken

// after
listen_addr: 0.0.0.0

if _, err := net.ResolveUDPAddr("udp", net.JoinHostPort(addr, strconv.Itoa(port))); err != nil {
    return fmt.Errorf("unresolvable syslog listen address %s:%d: %w", addr, port, err)
}

if err := srv.Listen(addr, port); err != nil {
    var dnsErr *net.DNSError
    if errors.As(err, &dnsErr) {
        // fall back to IP literal or fix DNS
    }
    return err
}

When it happens

Trigger: Stream() calls srv.Listen(addr, port) with a listenAddr that is a non-resolvable hostname, an empty string, or a port that is 0/negative producing an invalid JoinHostPort result.

Common situations: Config passed Validate with a resolvable-looking but broken DNS name and DNS is down; listen_addr empty because it bypassed validation; IPv6 literal mishandled; /etc/hosts issues in containers.

Related errors

• could not listen on port %d: %w
• reading from socket: %w
• could not close UDP connection: %w
• could not start syslog server: %w
• invalid port %d

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8b55e39b4f55456e. Report an issue: GitHub.