What causes "Failed to set up SIGHUP handler." in vectordotdev/vector?

Allow signal syscalls in the container security profile or use the default profile

Failed to set up SIGHUP handler.

Error message

Failed to set up SIGHUP handler.

What it means

Vector registers a SIGHUP handler (configuration reload signal) via tokio::signal::unix::signal(SignalKind::hangup()) and unwraps the io::Result with expect. If registration fails in the execution environment, Vector panics during startup and never becomes reloadable via SIGHUP.

Source

Thrown at src/signal.rs:200

        for shutdown_tx in self.shutdown_txs.drain(..) {
            // An error just means the channel was already shut down; safe to ignore.
            _ = shutdown_tx.send(());
        }
    }
}

/// Signals from OS/user.
#[cfg(unix)]
fn os_signals(runtime: &Runtime) -> impl Stream<Item = SignalTo> + use<> {
    use tokio::signal::unix::{SignalKind, signal};

    // The `signal` function must be run within the context of a Tokio runtime.
    runtime.block_on(async {
        let mut sigint = signal(SignalKind::interrupt()).expect("Failed to set up SIGINT handler.");
        let mut sigterm =
            signal(SignalKind::terminate()).expect("Failed to set up SIGTERM handler.");
        let mut sigquit = signal(SignalKind::quit()).expect("Failed to set up SIGQUIT handler.");
        let mut sighup = signal(SignalKind::hangup()).expect("Failed to set up SIGHUP handler.");

        async_stream::stream! {
            loop {
                let signal = tokio::select! {
                    _ = sigint.recv() => {
                        info!(message = "Signal received.", signal = "SIGINT");
                        SignalTo::Shutdown(None)
                    },
                    _ = sigterm.recv() => {
                        info!(message = "Signal received.", signal = "SIGTERM");
                        SignalTo::Shutdown(None)
                    } ,
                    _ = sigquit.recv() => {
                        info!(message = "Signal received.", signal = "SIGQUIT");
                        SignalTo::Quit
                    },
                    _ = sighup.recv() => {
                        info!(message = "Signal received.", signal = "SIGHUP");

View on GitHub (pinned to 3708c39b12)

Solutions

Allow signal syscalls in the container security profile or use the default profile
Increase RLIMIT_NOFILE if registration fails from fd pressure
Reload configuration through Vector's API instead of SIGHUP where the environment cannot deliver it
Confirm the panic reproduces only inside the restricted environment

Defensive patterns

Strategy: validation

Validate before calling

ulimit -n 65536
vector validate /etc/vector/vector.toml && vector --config /etc/vector/vector.toml

Prevention

Keep the runtime environment permissive for signal registration (default seccomp)
Use Vector's admin API for reloads in environments where SIGHUP cannot be delivered
Avoid supervisors that consume or mask SIGHUP before Vector sees it

When it happens

Trigger: Starting Vector where SIGHUP registration fails: sandboxed runtimes blocking sigaction/signalfd, exhausted fd/handler budgets, or platforms/environments (some jails, minimal emulators) that disallow SIGHUP streams.

Common situations: Strict container security profiles; process managers that swallow SIGHUP; test environments creating many Tokio runtimes.

Related errors

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/4f84a20afd541dd3. Report an issue: GitHub.