Unable to do unprivileged listen on socket,

[datamuc]

The latest docker image logs a lot of these when doing ICMP checks.

time=2025-12-06T22:08:50.901Z level=ERROR source=icmp.go:178 msg="Unable to do unprivileged listen on socket, will attempt privileged" module=ping4 target=... err="socket: permission denied"
time=2025-12-06T22:08:50.990Z level=ERROR source=icmp.go:126 msg="Unable to do unprivileged listen on socket, will attempt privileged" module=ping6 target=... err="socket: permission denied"

The level of that message was changed from DEBUG to ERROR recently. Is that supposed to be so? To me the code reads like it is trying to figure out how to do things and it should continue to be DEBUG.

[electron0zero]

we updated the log levels and changed the logging behaviour in v0.28.0 to be more accurate, please see release notes: v0.28.0 (release)

see more: https://github.com/prometheus/blackbox_exporter#controlling-log-level-for-probe-logs

if you still think this error is unexpected, please share the config and more details on the setup?

[datamuc]

it's just the default config:

docker run --network=host  --rm quay.io/prometheus/blackbox-exporter:v0.28.0 \
  --web.listen-address=:19115 --config.file=/etc/blackbox_exporter/config.yml

$ curl -s localhost:19115/probe -G -d module=icmp -d target=localhost | grep probe_success
# HELP probe_success Displays whether or not the probe was a success
# TYPE probe_success gauge
probe_success 1

and it logs ERRORS even though the probe was successful

time=2025-12-16T13:50:27.351Z level=ERROR source=icmp.go:126 msg="Unable to do unprivileged listen on socket, will attempt privileged" module=icmp target=localhost err="socket: permission denied"

The code in question:

               /* We try it unprivileged */
		if tryUnprivileged {
			// "udp" here means unprivileged -- not the protocol "udp".
			icmpConn, err = icmp.ListenPacket("udp6", srcIP.String())
			if err != nil {
				logger.Error("Unable to do unprivileged listen on socket, will attempt privileged", "err", err) /* i still think these should not be errors */
			} else {
				privileged = false
			}
		}

                /* if that didn't work, then we try privileged */
		if privileged {
			icmpConn, err = icmp.ListenPacket("ip6:ipv6-icmp", srcIP.String())
			if err != nil {
				logger.Error("Error listening to socket", "err", err) /* i still think these should not be errors */
				return
			}
		}
		defer icmpConn.Close()

                /* if neither of these works, we log an error */
		if err := icmpConn.IPv6PacketConn().SetControlMessage(ipv6.FlagHopLimit, true); err != nil {
			logger.Error("Failed to set Control Message for retrieving Hop Limit", "err", err)
			hopLimitFlagSet = false
		}

so the trying part should log as debug, and only if neither works an error should be logged, imho.