{"record":{"id":"107b8d8645065121","repo":"crowdsecurity/crowdsec","slug":"generateconfig-failed-w","errorCode":null,"errorMessage":"generateConfig failed: %w","messagePattern":"generateConfig failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":254,"sourceCode":"\t\t\t\t}\n\t\t\t\ts.config.EventLevel = value[0]\n\t\t\t}\n\t\t}\n\t}\n\n\tvar err error\n\n\t// FIXME: handle custom xpath query\n\ts.query, err = s.buildXpathQuery()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"buildXpathQuery failed: %w\", err)\n\t}\n\n\ts.logger.Debugf(\"query: %s\\n\", s.query)\n\n\ts.evtConfig, err = s.generateConfig(s.query, false)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generateConfig failed: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":236,"sourceCodeEnd":259,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L236-L259","documentation":"As the final step of ConfigureByDSN, generateConfig converts the built XPath query into an EVT_QUERY configuration handle for wevtapi. This error wraps any failure from generateConfig — most commonly the windows.UTF16PtrFromString failure when the query (or event file path) contains an invalid character such as an embedded NUL byte, meaning the query could not be handed to the Windows Event Log API.","triggerScenarios":"Calling ConfigureByDSN where the resulting query string (channel name from the DSN plus event filters) fails UTF-16 conversion — e.g. a channel name containing a NUL byte — or the event file path in the DSN is invalid for UTF16PtrFromString.","commonSituations":"DSNs constructed programmatically from untrusted input containing control characters, corrupted channel names from copy-paste, or event file paths with encoded NULs.","solutions":["Inspect the wrapped inner error — if it mentions UTF16PtrFromString, hunt for NUL/control bytes in the DSN's channel or file path.","Sanitize the DSN before calling: strings.ReplaceAll(dsn, \"\\x00\", \"\").","Use a plain, well-formed channel name like `System`, `Security`, or `Application`.","If the problem persists, configure the source via a YAML acquisition file instead of a DSN to isolate where the invalid character enters."],"exampleFix":"// before\ndsn := fmt.Sprintf(\"wineventlog://%s\", string(rawBytes)) // rawBytes may contain \\x00\n// after\nclean := strings.ReplaceAll(string(rawBytes), \"\\x00\", \"\")\ndsn := fmt.Sprintf(\"wineventlog://%s\", clean)","handlingStrategy":"try-catch","validationCode":"if strings.ContainsRune(dsn, 0) { return errors.New(\"DSN contains NUL byte\") }","typeGuard":"func dsnSafe(dsn string) bool { return !strings.ContainsRune(dsn, 0) }","tryCatchPattern":"if err := src.ConfigureByDSN(ctx, dsn, labels, logger, uuid); err != nil {\n\tif strings.Contains(err.Error(), \"generateConfig\") {\n\t\tlogger.Errorf(\"wineventlog DSN rejected: %v\", err)\n\t\t// fall back to default channel\n\t\treturn src.ConfigureByDSN(ctx, \"wineventlog://Application\", labels, logger, uuid)\n\t}\n\treturn err\n}","preventionTips":["Strip control characters from any programmatically built DSN","Use canonical channel names (System, Security, Application)","Test DSN configuration on a staging host before production"],"tags":["windows","dsn","api"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}