{"record":{"id":"07e5263b278a79cd","repo":"hashicorp/nomad","slug":"could-not-configure-eventlog-w","errorCode":null,"errorMessage":"could not configure eventlog - %w","messagePattern":"could not configure eventlog - %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/windows_service_install.go","lineNumber":231,"sourceCode":"\t\t}\n\t} else {\n\t\tsrvc, err = m.CreateService(winsvc.WINDOWS_SERVICE_NAME, opts.binaryPath,\n\t\t\twinsvc.WindowsServiceConfiguration{\n\t\t\t\tStartType:      winsvc.StartAutomatic,\n\t\t\t\tDisplayName:    winsvc.WINDOWS_SERVICE_DISPLAY_NAME,\n\t\t\t\tDescription:    winsvc.WINDOWS_SERVICE_DESCRIPTION,\n\t\t\t\tBinaryPathName: cmd,\n\t\t\t},\n\t\t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to create service - %w\", err)\n\t\t}\n\t\tdefer srvc.Close()\n\t}\n\n\t// Enable the service in the Windows eventlog\n\tif err := srvc.EnableEventlog(); err != nil {\n\t\treturn fmt.Errorf(\"could not configure eventlog - %w\", err)\n\t}\n\n\t// Ensure the service is stopped\n\tif err := srvc.Stop(); err != nil {\n\t\treturn fmt.Errorf(\"could not stop service - %w\", err)\n\t}\n\n\t// Start the service so the new binary is in use\n\tif err := srvc.Start(); err != nil {\n\t\treturn fmt.Errorf(\"could not start service - %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (c *WindowsServiceInstallCommand) configInstall(opts *windowsInstallOpts) error {\n\t// If the config or data directory are unset, default them\n\tif opts.configDir == \"\" {","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/windows_service_install.go#L213-L249","documentation":"Wraps the failure of `srvc.EnableEventlog`, which registers the Nomad service in the Windows Event Log so agent logs are attributed to it. The underlying registry/EventLog configuration error is chained with %w.","triggerScenarios":"Adding the EventLog message-file registry entry (HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application) fails: access denied, registry locked by policy, or registry virtualization issues.","commonSituations":"Non-elevated run blocked from writing HKLM; group policy restricting registry edits; antivirus blocking registry writes to the EventLog key.","solutions":["Re-run the install from an elevated shell","Check permissions on HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application","Temporarily exclude Nomad install paths from security software and retry","Verify group policy isn't locking the EventLog registry key"],"exampleFix":"// before\nPS> nomad windows install\n// after\nPS (admin)> nomad windows install","handlingStrategy":"try-catch","validationCode":"key, err := registry.OpenKey(registry.LOCAL_MACHINE,\n\t`SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application`, registry.SET_VALUE)\nif err != nil {\n\tlog.Fatalf(\"no write access to EventLog registry key (run elevated): %v\", err)\n}\nkey.Close()","typeGuard":null,"tryCatchPattern":"if err := srvc.EnableEventlog(); err != nil {\n\tif errors.Is(err, registry.ErrShortBuffer) || errors.Is(err, windows.ERROR_ACCESS_DENIED) {\n\t\t// elevate and retry\n\t}\n\treturn fmt.Errorf(\"could not configure eventlog - %w\", err)\n}","preventionTips":["Write to HKLM only from elevated processes","Check group policy restrictions on the EventLog registry key","Exclude the install path from security software that blocks registry writes"],"tags":["windows","eventlog","registry"],"backgroundTag":"eventlog-registry-write-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}