crowdsecurity/crowdsec · error

invalid listen IP %s

Error message

invalid listen IP %s

What it means

Validate() rejects the configured listen address when net.ParseIP cannot parse it as a valid IP literal. The syslog server binds UDP on this address, so it must be a concrete IPv4/IPv6 address, not a hostname or arbitrary string.

Source

Thrown at pkg/acquisition/modules/syslog/config.go:64

		c.Addr = "127.0.0.1" // do we want a usable or secure default ?
	}

	if c.Port == 0 {
		c.Port = 514
	}

	if c.MaxMessageLen == 0 {
		c.MaxMessageLen = 2048
	}
}

func (c *Configuration) Validate() error {
	if c.Port <= 0 || c.Port > 65535 {
		return fmt.Errorf("invalid port %d", c.Port)
	}

	if net.ParseIP(c.Addr) == nil {
		return fmt.Errorf("invalid listen IP %s", c.Addr)
	}

	return nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	s.config = cfg

	return nil
}

func (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	err := s.UnmarshalConfig(yamlConfig)

View on GitHub (pinned to 909b515798)

Solutions

1. Replace listen_addr with a valid IP literal such as 0.0.0.0 (all interfaces), 127.0.0.1, or the machine's IPv4/IPv6 address.
2. If listen_addr is empty, add it explicitly to the syslog stanza.
3. Use a hostname only if the code path resolves it before Validate; otherwise resolve it yourself and put the IP in config.

Example fix

// before (config.yaml)
source: syslog
listen_addr: localhost
port: 514

// after
source: syslog
listen_addr: 127.0.0.1
port: 514

if net.ParseIP(cfg.ListenAddr) == nil {
    return fmt.Errorf("listen_addr must be an IP literal, got %q", cfg.ListenAddr)
}

When it happens

Trigger: The 'listen_addr' field in the syslog acquisition config contains a hostname (e.g. 'localhost'), an empty string, a malformed IP ('0.0.0.0.0'), or an interface name.

Common situations: Writing 'localhost' instead of '127.0.0.1'; leaving listen_addr empty so it parses as ''; typos like '127.0.0.256'; using a DNS name expecting resolution that Validate does not perform.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• invalid port %d
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c55bd96049c517d1. Report an issue: GitHub.