{"record":{"id":"0eeb0aaad119b853","repo":"nats-io/nats-server","slug":"could-not-access-event-log-v","errorCode":null,"errorMessage":"could not access event log: %v","messagePattern":"could not access event log: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"logger/syslog_windows.go","lineNumber":43,"sourceCode":"var natsEventSource = \"NATS-Server\"\n\n// SetSyslogName sets the name to use for the system log event source\nfunc SetSyslogName(name string) {\n\tnatsEventSource = name\n}\n\n// SysLogger logs to the windows event logger\ntype SysLogger struct {\n\twriter *eventlog.Log\n\tdebug  bool\n\ttrace  bool\n}\n\n// NewSysLogger creates a log using the windows event logger\nfunc NewSysLogger(debug, trace bool) *SysLogger {\n\tif err := eventlog.InstallAsEventCreate(natsEventSource, eventlog.Info|eventlog.Error|eventlog.Warning); err != nil {\n\t\tif !strings.Contains(err.Error(), \"registry key already exists\") {\n\t\t\tpanic(fmt.Sprintf(\"could not access event log: %v\", err))\n\t\t}\n\t}\n\n\tw, err := eventlog.Open(natsEventSource)\n\tif err != nil {\n\t\tpanic(fmt.Sprintf(\"could not open event log: %v\", err))\n\t}\n\n\treturn &SysLogger{\n\t\twriter: w,\n\t\tdebug:  debug,\n\t\ttrace:  trace,\n\t}\n}\n\n// NewRemoteSysLogger creates a remote event logger\nfunc NewRemoteSysLogger(fqn string, debug, trace bool) *SysLogger {\n\tw, err := eventlog.OpenRemote(fqn, natsEventSource)","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/logger/syslog_windows.go#L25-L61","documentation":"On Windows, NewSysLogger installs the \"nats-server\" event source via eventlog.InstallAsEventCreate; if installation fails with anything other than the expected \"registry key already exists\" (i.e. the source is already installed), it panics with this message wrapping the OS error. The process cannot use the Windows event log as its logger.","triggerScenarios":"Starting the Windows service with syslog logging enabled when the process lacks permission to create the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\<source>, or eventlog.InstallAsEventCreate returns a different error.","commonSituations":"Running the NATS service under a non-admin account that cannot write HKLM registry keys; group policy restricting event log registration; corrupt event source registration.","solutions":["Run the service installation/first start as Administrator so the event source registry key can be created","Pre-create the event source with PowerShell: New-EventLog -LogName Application -Source nats-server","Or fall back to file logging instead of syslog on Windows"],"exampleFix":"// before: run service as low-privilege user -> panic\n// after: pre-register source as admin, then start service\n# PowerShell (admin)\nNew-EventLog -LogName Application -Source nats-server","handlingStrategy":"try-catch","validationCode":"// Windows, before enabling syslog logging (admin PowerShell)\ntry { Get-EventLog -LogName Application -Newest 1 -Source nats-server *> $null\n} catch { New-EventLog -LogName Application -Source nats-server }","typeGuard":null,"tryCatchPattern":"// Go: wrap NewSysLogger so a panic becomes a controlled fallback\nfunc newLoggerSafe(debug, trace bool) (logger natsd.Logger, err error) {\n  defer func() {\n    if r := recover(); r != nil {\n      err = fmt.Errorf(\"syslog init failed: %v\", r)\n    }\n  }()\n  logger = loggerpkg.NewSysLogger(debug, trace)\n  return\n}","preventionTips":["Install the nats-server Windows service under an account with rights to write HKLM event log keys","Pre-register the event source during deployment (New-EventLog) before first service start","Have a file-logging fallback when event log registration is restricted by policy"],"tags":["windows","syslog","eventlog","panic"],"backgroundTag":"event-log-access-denied","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}