crowdsecurity/crowdsec · error

reading from socket

Error message

reading from socket: %w

What it means

Serve()'s read loop failed on s.conn.ReadFrom. The UDP socket returned a read error that was not context cancelation, so the acquisition stream is aborted with this wrapped error. Network interface changes, socket closure, or buffer issues surface here.

Solutions

1. Inspect the wrapped error; for 'use of closed network connection' find what closed the socket (KillServer called twice or early).
2. Check network interface stability and host logs (dmesg/journalctl) for socket-level faults.
3. If transient, restart crowdsec; the acquisition will re-bind a fresh UDP socket.
4. Verify the context is not being canceled mid-run in your orchestration, since cancelation returns nil but other errors abort the datasource.

n, addr, err := conn.ReadFrom(buf)
if err != nil {
    if ctx.Err() != nil {
        return nil
    }
    if errors.Is(err, net.ErrClosed) {
        // socket closed intentionally, stop loop
        return nil
    }
    // transient: log and continue or restart with backoff
}

When it happens

Trigger: The UDP socket errors during ReadFrom: connection refused (ICMP port unreachable from a previous send), the socket was closed concurrently, or an OS-level socket error occurred while ctx is still alive.

Common situations: Interface flapping on the host; another component closing the conn while Serve is reading; kernel dropping with errors; running in a container whose network namespace is torn down.

Related errors

• could not close UDP connection
• could not listen on port
• could not resolve addr
• could not start syslog server
• invalid listen IP

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f72b81e02b87fc30. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/syslog/internal/server/syslogserver.go:59

func (s *SyslogServer) Serve(ctx context.Context, msgChan chan SyslogMessage) error {
	go func() {
		<-ctx.Done()
		// closing the socket unblocks ReadFrom()
		s.conn.Close()
	}()

	// RFC3164 says 1024 bytes max
	// RFC5424 says 480 bytes minimum, and should support up to 2048 bytes
	buf := make([]byte, s.MaxMessageLen)

	for {
		n, addr, err := s.conn.ReadFrom(buf)
		if err != nil {
			if ctx.Err() != nil {
				return nil //nolint:nilerr  // context cancelation is not a failure
			}

			return fmt.Errorf("reading from socket: %w", err)
		}

		msg := SyslogMessage{Message: buf[:n], Client: strings.Split(addr.String(), ":")[0]}

		select {
		case msgChan <- msg:
		case <-ctx.Done():
			return nil
		}
	}
}

func (s *SyslogServer) KillServer() error {
	if err := s.conn.Close(); err != nil {
		return fmt.Errorf("could not close UDP connection: %w", err)
	}

	return nil

View on GitHub (pinned to 909b515798)