nginx/nginx · warning

NGX_LOG_ALERT

NGX_LOG_ALERT

Error message

<ngx_close_socket_n> failed

What it means

When a syslog send() returns NGX_ERROR, nginx tries to tear down the UDP socket so the next attempt reconnects; if that close() itself fails it logs this ALERT (with the socket errno) and still resets peer->conn.fd to -1. The close failure is secondary — the primary event is the send error, typically an ICMP port-unreachable surfacing on a connected UDP socket.

Source

Thrown at src/core/ngx_syslog.c:317

    if (peer->conn.fd == (ngx_socket_t) -1) {
        if (ngx_syslog_init_peer(peer) != NGX_OK) {
            return NGX_ERROR;
        }
    }

    if (ngx_send) {
        n = ngx_send(&peer->conn, buf, len);

    } else {
        /* event module has not yet set ngx_io */
        n = ngx_os_io.send(&peer->conn, buf, len);
    }

    if (n == NGX_ERROR) {

        if (ngx_close_socket(peer->conn.fd) == -1) {
            ngx_log_error(NGX_LOG_ALERT, &peer->log, ngx_socket_errno,
                          ngx_close_socket_n " failed");
        }

        peer->conn.fd = (ngx_socket_t) -1;
    }

    return n;
}


static ngx_int_t
ngx_syslog_init_peer(ngx_syslog_peer_t *peer)
{
    ngx_socket_t  fd;

    fd = ngx_socket(peer->server.sockaddr->sa_family, SOCK_DGRAM, 0);
    if (fd == (ngx_socket_t) -1) {
        ngx_log_error(NGX_LOG_ALERT, &peer->log, ngx_socket_errno,

View on GitHub (pinned to 3f6f7824d4)

Solutions

1. Check the syslog daemon is up and listening: `ss -ulnp | grep 514` or verify the unix socket path exists
2. Inspect the preceding log lines for the send() error that triggered the close path
3. Restart/reload the syslog service; nginx re-initializes the peer automatically on the next message
4. If close failures persist, look for fd table corruption or external tools (debuggers, fd-closing 'cleaners') touching nginx fds

# Pre-deploy: confirm the syslog destination answers
if [[ "$SERVER" == unix:* ]]; then
  [ -S "${SERVER#unix:}" ] || { echo "missing syslog socket"; exit 1; }
else
  printf '<13>ping' | timeout 1 nc -u -w1 "${SERVER%%:*}" "${SERVER##*:}" || echo 'warn: no UDP ack (normal for syslog)'
fi

When it happens

Trigger: Syslog daemon stopped or is not listening on 127.0.0.1:514 while nginx sends (connected UDP makes ECONNREFUSED surface on the next send); the unix datagram socket vanished; followed by close() returning -1 (e.g. EBADF after an external fd close).

Common situations: rsyslog restarted or crashed with nginx running; syslog-ng socket rotated; containerized syslog sidecar down; appears in the error log right when log shipping breaks.

Related errors

• NGX_LOG_WARN
• NGX_LOG_CRIT
• NGX_LOG_ALERT
• NGX_LOG_EMERG
• NGX_LOG_EMERG

AI-assisted analysis of nginx/nginx@3f6f7824d4 (2026-08-22). Data as JSON: /api/errors/f4327b89b9143d8f. Report an issue: GitHub.