crowdsecurity/crowdsec · error

unable to close %s : %s

Error message

unable to close %s : %s

What it means

After successfully opening the file to validate readability, setupTailForFile immediately closes it. If fd.Close() fails, the module returns "unable to close %s : %s". This is rare: it signals the file descriptor could not be released, usually due to filesystem errors or resource exhaustion.

Source

Thrown at pkg/acquisition/modules/file/run.go:217

	s.tailMapMutex.RLock()

	if s.tails[file] {
		s.tailMapMutex.RUnlock()
		logger.Debugf("Already tailing file %s, not creating a new tail", file)

		return nil
	}

	s.tailMapMutex.RUnlock()

	// Validate file
	fd, err := os.Open(file)
	if err != nil {
		return fmt.Errorf("unable to read %s : %s", file, err)
	}

	if err = fd.Close(); err != nil {
		return fmt.Errorf("unable to close %s : %s", file, err)
	}

	fi, err := os.Stat(file)
	if err != nil {
		return fmt.Errorf("could not stat file %s : %w", file, err)
	}

	if fi.IsDir() {
		logger.Warnf("%s is a directory, ignoring it.", file)
		return nil
	}

	// Determine polling mode
	pollFile := false
	if s.config.PollWithoutInotify != nil {
		pollFile = *s.config.PollWithoutInotify
	} else {
		networkFS, fsType, err := fsutil.IsNetworkFS(file)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the underlying OS error in the log (e.g. 'input/output error', 'device or resource busy').
2. Check filesystem health (dmesg, df, mount state) if on NFS or network storage.
3. Check open file descriptor limits (ulimit -n) and raise if the process is leaking descriptors.
4. Restart crowdsec to clear any stuck descriptors and retry.

// inspect the wrapped OS error
if err := setupTailForFile(...); err != nil {
    log.Printf("tail setup failed: %v", err) // surfaces the close() cause
}

When it happens

Trigger: os.Open succeeded but fd.Close() returned an error inside setupTailForFile (called by StreamingAcquisition or checkAndTailFile).

Common situations: Filesystem I/O errors (NFS stale handles, disk issues); process hitting file-descriptor limits in exotic setups; interrupted syscalls on flaky storage.

Related errors

• unable to read %s : %s
• could not lstat() file %s: %w
• could not start tailing file %s : %w
• failed opening %s: %w
• failed to read gz %s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/25b97e31fc624160. Report an issue: GitHub.