{"record":{"id":"01d29245e7a938df","repo":"crowdsecurity/crowdsec","slug":"getxmlevents-failed-v","errorCode":null,"errorMessage":"getXMLEvents failed: %v","messagePattern":"getXMLEvents failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/run_windows.go","lineNumber":148,"sourceCode":"\tdefer func() {\n\t\tfor _, h := range publisherCache {\n\t\t\twinlog.Close(h)\n\t\t}\n\t}()\n\nOUTER_LOOP:\n\tfor {\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\ts.logger.Infof(\"wineventlog is dying\")\n\t\t\treturn nil\n\t\tdefault:\n\t\t\tevts, err := s.getXMLEvents(s.evtConfig, publisherCache, handle, 500)\n\t\t\tif errors.Is(err, windows.ERROR_NO_MORE_ITEMS) {\n\t\t\t\tlog.Info(\"No more items\")\n\t\t\t\tbreak OUTER_LOOP\n\t\t\t} else if err != nil {\n\t\t\t\treturn fmt.Errorf(\"getXMLEvents failed: %v\", err)\n\t\t\t}\n\t\t\ts.logger.Debugf(\"Got %d events\", len(evts))\n\t\t\tfor _, evt := range evts {\n\t\t\t\ts.logger.Tracef(\"Event: %s\", evt)\n\t\t\t\tif s.metricsLevel != metrics.AcquisitionMetricsLevelNone {\n\t\t\t\t\tmetrics.WineventlogDataSourceLinesRead.With(prometheus.Labels{\"source\": s.name, \"datasource_type\": ModuleName, \"acquis_type\": s.config.Labels[\"type\"]}).Inc()\n\t\t\t\t}\n\t\t\t\tl := pipeline.Line{}\n\t\t\t\tl.Raw = evt\n\t\t\t\tl.Module = s.GetName()\n\t\t\t\tl.Labels = s.config.Labels\n\t\t\t\tl.Time = time.Now()\n\t\t\t\tl.Src = s.name\n\t\t\t\tl.Process = true\n\t\t\t\tcsevt := pipeline.MakeEvent(s.config.UseTimeMachine, pipeline.LOG, true)\n\t\t\t\tcsevt.Line = l\n\t\t\t\tout <- csevt\n\t\t\t}","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/run_windows.go#L130-L166","documentation":"After EvtQuery succeeds, OneShot batches event rendering through getXMLEvents, which calls EvtNext/EvtRender to fetch and render events as XML. This error wraps any failure from that batch fetch that is not ERROR_NO_MORE_ITEMS (which is treated as normal end-of-stream). It typically means the event handle became invalid, rendering a publisher's metadata failed, or a Windows API error occurred mid-iteration.","triggerScenarios":"Calling OneShot on a handle from EvtQuery, then getXMLEvents fails mid-batch: e.g. ERROR_INVALID_HANDLE after the log was rotated/closed, a publisher metadata lookup failure (EvtOpenPublisherMetadata) while localizing events, or another Win32 error other than ERROR_NO_MORE_ITEMS returned by EvtNext.","commonSituations":"The queried .evtx file is truncated/corrupt or deleted while being read; the event log channel is cleared (wevtutil cl) during the read; a specific event's provider is uninstalled so its message template cannot be rendered; transient Windows errors during large batch reads of 500 events.","solutions":["Read the wrapped %v error to identify the Win32 code and address that specific cause (e.g. re-point to an intact .evtx file, reinstall the missing event provider)","Retry the OneShot acquisition — transient failures on live channels often resolve on the next run","If reading a large historical file, split the time range into smaller queries so partial failures lose less work","Check that the event publishers referenced in the log are still installed on the machine"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"f, err := os.Open(evtFilePath)\nif err != nil { return err }\nfi, _ := f.Stat()\nif fi.Size() == 0 { return errors.New(\"empty/corrupt evtx\") }","typeGuard":null,"tryCatchPattern":"err := source.OneShot(ctx, out)\nif err != nil && strings.Contains(err.Error(), \"getXMLEvents failed\") {\n    if errors.Is(err, context.Canceled) { return }\n    time.Sleep(backoff); retryOnce() // transient API failures\n}","preventionTips":["Do not clear or rotate the channel/evtx file while a historical read is in flight","Keep event providers installed on machines whose logs you read remotely","Use moderate batch sizes and monitor for repeated failures on specific events","Check Windows Event Log service health before bulk imports"],"tags":["windows","eventlog","acquisition"],"backgroundTag":"http-error-response","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}