{"record":{"id":"5c5f7d0d0bc169f9","repo":"crowdsecurity/crowdsec","slug":"failed-to-parse-event-id-s","errorCode":null,"errorMessage":"failed to parse event_id: %s","messagePattern":"failed to parse event_id: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":229,"sourceCode":"\t\t\treturn fmt.Errorf(\"failed to parse DSN parameters: %w\", err)\n\t\t}\n\n\t\tfor key, value := range params {\n\t\t\tswitch key {\n\t\t\tcase \"log_level\":\n\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"log_level must be a single value\")\n\t\t\t\t}\n\t\t\t\tlvl, err := log.ParseLevel(value[0])\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to parse log_level: %s\", err)\n\t\t\t\t}\n\t\t\t\ts.logger.Logger.SetLevel(lvl)\n\t\t\tcase \"event_id\":\n\t\t\t\tfor _, id := range value {\n\t\t\t\t\tevtid, err := strconv.Atoi(id)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"failed to parse event_id: %s\", err)\n\t\t\t\t\t}\n\t\t\t\t\ts.config.EventIDs = append(s.config.EventIDs, evtid)\n\t\t\t\t}\n\t\t\tcase \"event_level\":\n\t\t\t\tif len(value) != 1 {\n\t\t\t\t\treturn errors.New(\"event_level must be a single value\")\n\t\t\t\t}\n\t\t\t\ts.config.EventLevel = value[0]\n\t\t\t}\n\t\t}\n\t}\n\n\tvar err error\n\n\t// FIXME: handle custom xpath query\n\ts.query, err = s.buildXpathQuery()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"buildXpathQuery failed: %w\", err)","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L211-L247","documentation":"Each value of the `event_id` DSN parameter must be an integer convertible by strconv.Atoi, since event IDs are numeric Windows Event IDs. This error wraps the Atoi failure when a non-numeric ID is supplied.","triggerScenarios":"A DSN like `wineventlog://Security?event_id=4625,4624` — wait, multiple values are allowed via repeated params — specifically `event_id=4a62` or `event_id=462 5` containing non-digit characters, or an ID exceeding int range.","commonSituations":"Comma-separated IDs passed in a single parameter (use repeated event_id params instead), quotes or spaces accidentally included, or confusing event IDs with event level names.","solutions":["Ensure each event_id value is purely numeric, e.g. `wineventlog://Security?event_id=4624&event_id=4625`.","If you used commas (`event_id=4624,4625`), split them into repeated parameters.","Strip quotes/whitespace from the DSN string.","Check that the ID fits in a platform int (Windows event IDs are 16-bit, so this is rarely an issue)."],"exampleFix":"// before\nwineventlog://Security?event_id=4624,4625\n// after\nwineventlog://Security?event_id=4624&event_id=4625","handlingStrategy":"validation","validationCode":"for _, id := range idStrings {\n\tif n, err := strconv.Atoi(id); err != nil || n < 0 {\n\t\treturn fmt.Errorf(\"event_id must be a positive integer, got %q\", id)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Repeat the event_id parameter for multiple IDs instead of comma-separating","Quote DSNs in shell scripts to avoid whitespace injection","Validate numeric fields at config-load time"],"tags":["dsn","parsing","windows"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}