What causes "failed to get IPv4 sockstat data: %w" in prometheus/node_exporter?

Grant the exporter process read access to /proc/net/sockstat (check seccomp/AppArmor/SELinux denials)

failed to get IPv4 sockstat data

Error message

failed to get IPv4 sockstat data: %w

What it means

After opening procfs, the sockstat collector reads /proc/net/sockstat via fs.NetSockstat(). Errors other than os.ErrNotExist are wrapped as 'failed to get IPv4 sockstat data'. A missing file is tolerated (IPv4 disabled kernels log and skip); anything else is a real read/parse failure.

Solutions

Grant the exporter process read access to /proc/net/sockstat (check seccomp/AppArmor/SELinux denials)
Confirm /proc/net/sockstat is readable by the exporter user: `cat /proc/net/sockstat`
Update github.com/prometheus/procfs if the kernel format changed; disable the sockstat collector as a last resort

Example fix

// verify access as the exporter user
sudo -u node_exporter cat /proc/net/sockstat
// if denied, adjust the LSM profile or run the exporter with sufficient privileges

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check before scraping IPv4 sockstat
if _, err := os.Stat("/proc/net/sockstat"); os.IsPermission(err) {
	// environment blocks the file; expect this error or skip the collector
}

Try / catch

if err := collector.Update(ch); err != nil {
	if strings.Contains(err.Error(), "failed to get IPv4 sockstat data") {
		logger.Warn("IPv4 sockstat unavailable", "err", err)
	} else {
		return err
	}
}

Prevention

Ensure the exporter user can read /proc/net/sockstat; review seccomp/AppArmor/SELinux denials
In containers, avoid masking /proc/net entries via lxcfs or similar without testing
Note ErrNotExist is tolerated (IPv4 disabled); only fix genuine permission/parse errors

When it happens

Trigger: fs.NetSockstat() returning a non-ErrNotExist error during Update: permission problems reading /proc/net/sockstat or procfs parse errors on unexpected content.

Common situations: Hardened/seccomp environments blocking /proc/net reads; LSM policies denying access; kernels or LSMs returning unexpected sockstat content that procfs cannot parse.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of prometheus/node_exporter@17ddd77c59 (2026-09-07). Data as JSON: /api/errors/d21832515ceb11ce. Report an issue: GitHub.

Appendix: source

Thrown at collector/sockstat_linux.go:61

// NewSockStatCollector returns a new Collector exposing socket stats.
func NewSockStatCollector(logger *slog.Logger) (Collector, error) {
	return &sockStatCollector{logger}, nil
}

func (c *sockStatCollector) Update(ch chan<- prometheus.Metric) error {
	fs, err := procfs.NewFS(*procPath)
	if err != nil {
		return fmt.Errorf("failed to open procfs: %w", err)
	}

	// If IPv4 and/or IPv6 are disabled on this kernel, handle it gracefully.
	stat4, err := fs.NetSockstat()
	switch {
	case err == nil:
	case errors.Is(err, os.ErrNotExist):
		c.logger.Debug("IPv4 sockstat statistics not found, skipping")
	default:
		return fmt.Errorf("failed to get IPv4 sockstat data: %w", err)
	}

	stat6, err := fs.NetSockstat6()
	switch {
	case err == nil:
	case errors.Is(err, os.ErrNotExist):
		c.logger.Debug("IPv6 sockstat statistics not found, skipping")
	default:
		return fmt.Errorf("failed to get IPv6 sockstat data: %w", err)
	}

	stats := []struct {
		isIPv6 bool
		stat   *procfs.NetSockstat
	}{
		{
			stat: stat4,
		},

View on GitHub (pinned to 17ddd77c59)