crowdsecurity/crowdsec · error

reading from socket: %w

Error message

reading from socket: %w

What it means

Serve()'s read loop failed on s.conn.ReadFrom. The UDP socket returned a read error that was not context cancelation, so the acquisition stream is aborted with this wrapped error. Network interface changes, socket closure, or buffer issues surface here.

Source

Thrown at pkg/acquisition/modules/syslog/internal/server/syslogserver.go:59

func (s *SyslogServer) Serve(ctx context.Context, msgChan chan SyslogMessage) error {
	go func() {
		<-ctx.Done()
		// closing the socket unblocks ReadFrom()
		s.conn.Close()
	}()

	// RFC3164 says 1024 bytes max
	// RFC5424 says 480 bytes minimum, and should support up to 2048 bytes
	buf := make([]byte, s.MaxMessageLen)

	for {
		n, addr, err := s.conn.ReadFrom(buf)
		if err != nil {
			if ctx.Err() != nil {
				return nil //nolint:nilerr  // context cancelation is not a failure
			}

			return fmt.Errorf("reading from socket: %w", err)
		}

		msg := SyslogMessage{Message: buf[:n], Client: strings.Split(addr.String(), ":")[0]}

		select {
		case msgChan <- msg:
		case <-ctx.Done():
			return nil
		}
	}
}

func (s *SyslogServer) KillServer() error {
	if err := s.conn.Close(); err != nil {
		return fmt.Errorf("could not close UDP connection: %w", err)
	}

	return nil

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the wrapped error; for 'use of closed network connection' find what closed the socket (KillServer called twice or early).
2. Check network interface stability and host logs (dmesg/journalctl) for socket-level faults.
3. If transient, restart crowdsec; the acquisition will re-bind a fresh UDP socket.
4. Verify the context is not being canceled mid-run in your orchestration, since cancelation returns nil but other errors abort the datasource.

n, addr, err := conn.ReadFrom(buf)
if err != nil {
    if ctx.Err() != nil {
        return nil
    }
    if errors.Is(err, net.ErrClosed) {
        // socket closed intentionally, stop loop
        return nil
    }
    // transient: log and continue or restart with backoff
}

When it happens

Trigger: The UDP socket errors during ReadFrom: connection refused (ICMP port unreachable from a previous send), the socket was closed concurrently, or an OS-level socket error occurred while ctx is still alive.

Common situations: Interface flapping on the host; another component closing the conn while Serve is reading; kernel dropping with errors; running in a container whose network namespace is torn down.

Related errors

• could not resolve addr %s: %w
• could not listen on port %d: %w
• could not close UDP connection: %w
• could not start syslog server: %w
• invalid port %d

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f72b81e02b87fc30. Report an issue: GitHub.