elastic/elasticsearch · warning · RuntimeException

Could not close systemd socket: {}

Error message

Could not close systemd socket: {}

What it means

Thrown (or logged) when libc.close() fails on the systemd socket file descriptor in the finally block. The error includes strerror(errno). EBADF (bad file descriptor) is the most common cause, indicating the fd was already closed or invalidated. For notify_ready() this is a RuntimeException; for others it is a WARN.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/Systemd.java:114

                    if (error != null) {
                        error.addSuppressed(e);
                        throw error;
                    } else {
                        throw e;
                    }
                }
            } else if (error != null) {
                throw error;
            }
        }
    }

    private void throwOrLog(String message, boolean warnOnError) {
        if (warnOnError) {
            logger.warn(message);
        } else {
            logger.error(message);
            throw new RuntimeException(message);
        }
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure no other thread or native library closes file descriptors that may alias the systemd socket.
2. If this appears alongside another systemd error, fix the root cause first; the close failure is secondary.
3. Wrap notify_ready() in try-catch to prevent close() failures from propagating.
4. Check for FD leaks or double-close bugs in JNI/native code.

Example fix

// before
systemd.notify_ready(); // close() failure in finally propagates

// after
try {
    systemd.notify_ready();
} catch (RuntimeException e) {
    logger.warn("systemd notification failed (possibly on close); continuing", e);
}

// close() failures are not predictable; use try-catch around notify calls.
// Audit native code for FD double-close or aliasing.

try {
    systemd.notify_ready();
} catch (RuntimeException e) {
    // may originate from close() in finally; log and continue
    logger.warn("systemd socket close failed; fd may be leaked or already closed", e);
}

When it happens

Trigger: Calling any Systemd.notify* method where the socket fd is closed by another thread or signal handler before the finally block runs. Also possible if the fd table is corrupted or if close() is interrupted by EINTR.

Common situations: Concurrent FD management closing the same descriptor. FD reuse after the socket was silently closed. Very rare kernel EINTR on close(). This error fires in the finally block, so it may mask or be masked by a prior error in the try block.

Related errors

• Could not open systemd socket: {}
• Could not connect to systemd socket: {}
• Failed to send message (READY=1) to systemd socket: {}
• Not all bytes of message (READY=1) sent to systemd socket (s
• seccomp unavailable: '{}' architecture unsupported

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/1b4842272bc27b85. Report an issue: GitHub.