crowdsecurity/crowdsec · error

could not start syslog server: %w

Error message

could not start syslog server: %w

What it means

Stream() wraps any failure from SyslogServer.Listen — the syslog datasource could not start because its UDP listener could not be set up (resolve or bind failure). The wrapped error from Listen carries the specific root cause.

Source

Thrown at pkg/acquisition/modules/syslog/run.go:31

	"golang.org/x/sync/errgroup"

	"github.com/crowdsecurity/crowdsec/pkg/acquisition/modules/syslog/internal/parser/rfc3164"
	"github.com/crowdsecurity/crowdsec/pkg/acquisition/modules/syslog/internal/parser/rfc5424"
	syslogserver "github.com/crowdsecurity/crowdsec/pkg/acquisition/modules/syslog/internal/server"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
)

func (s *Source) Stream(ctx context.Context, out chan pipeline.Event) error {
	srv := &syslogserver.SyslogServer{
		Logger:        s.logger.WithField("syslog", "internal"),
		MaxMessageLen: s.config.MaxMessageLen,
	}

	msgChan := make(chan syslogserver.SyslogMessage)

	if err := srv.Listen(s.config.Addr, s.config.Port); err != nil {
		return fmt.Errorf("could not start syslog server: %w", err)
	}

	defer func() {
		_ = srv.KillServer()
	}()

	g, ctx := errgroup.WithContext(ctx)

	g.Go(func() error {
		defer close(msgChan)
		return srv.Serve(ctx, msgChan)
	})

	g.Go(func() error {
		for {
			select {
			case <-ctx.Done():
				s.logger.Debug("context canceled")

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped inner error to distinguish resolve failure from bind failure and fix accordingly.
2. Free the UDP port (stop rsyslog's imudp) or configure a different port in the syslog stanza.
3. Run with privileges/CAP_NET_BIND_SERVICE if binding port 514 as non-root, or use a high port.
4. Set listen_addr to a valid local IP or 0.0.0.0.

Example fix

// before (config.yaml)
source: syslog
listen_addr: 0.0.0.0
port: 514    # taken by rsyslog

// after
source: syslog
listen_addr: 0.0.0.0
port: 5514

// validate before starting acquisition
if net.ParseIP(cfg.ListenAddr) == nil || cfg.Port <= 0 || cfg.Port > 65535 {
    return errors.New("invalid syslog listen config")
}

if err := srv.Listen(s.config.Addr, s.config.Port); err != nil {
    log.Errorf("syslog datasource failed to start: %v", err)
    // decide: skip datasource and continue, or abort startup
    return err
}

When it happens

Trigger: srv.Listen(addr, port) fails inside Stream(): unresolvable listen address, port already bound by another daemon, unprivileged bind on port <1024, or listen IP not on the host.

Common situations: rsyslog/syslog-ng already on 514/udp; crowdsec run as non-root wanting 514; misconfigured listen_addr in acquis.yaml; container missing network capabilities.

Related errors

• could not resolve addr %s: %w
• could not listen on port %d: %w
• reading from socket: %w
• could not close UDP connection: %w
• invalid port %d

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/69758702f0283259. Report an issue: GitHub.