{"record":{"id":"776b0eb65fd66d58","repo":"crowdsecurity/crowdsec","slug":"invalid-dsn-s-for-wineventlog-source-must-start","errorCode":null,"errorMessage":"invalid DSN %s for wineventlog source, must start with wineventlog://","messagePattern":"invalid DSN (.+?) for wineventlog source, must start with wineventlog://","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":188,"sourceCode":"\ts.logger = logger\n\ts.metricsLevel = metricsLevel\n\n\terr := s.UnmarshalConfig(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\ts.evtConfig, err = s.generateConfig(s.query, true)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) ConfigureByDSN(ctx context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {\n\tif !strings.HasPrefix(dsn, \"wineventlog://\") {\n\t\treturn fmt.Errorf(\"invalid DSN %s for wineventlog source, must start with wineventlog://\", dsn)\n\t}\n\n\ts.logger = logger\n\ts.config = Configuration{}\n\n\tdsn = strings.TrimPrefix(dsn, \"wineventlog://\")\n\n\targs := strings.Split(dsn, \"?\")\n\n\tif args[0] == \"\" {\n\t\treturn errors.New(\"empty wineventlog:// DSN\")\n\t}\n\n\tif len(args) > 2 {\n\t\treturn errors.New(\"too many arguments in DSN\")\n\t}\n\n\ts.config.EventFile = args[0]","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L170-L206","documentation":"ConfigureByDSN only accepts data source names beginning with the `wineventlog://` scheme. This error is returned immediately when the DSN lacks that prefix, rejecting the input before any parsing occurs. It exists because acquisition DSN strings from other source types (e.g. `journalctl://`, `file://`) may be routed to this module and must be validated.","triggerScenarios":"Calling ConfigureByDSN with a DSN such as `wineventlog://System` misspelled as `wineventlog: System`, `Wineventlog://System` (case matters for strings.HasPrefix... actually the check is case-sensitive on the exact prefix), or a completely different scheme like `file://System`.","commonSituations":"Copy-pasted DSNs from docs with wrong casing or missing `//`, generic acquisition tooling passing DSNs meant for another source type, or truncation that dropped the prefix.","solutions":["Ensure the DSN starts exactly with `wineventlog://` (lowercase, with the double slash), e.g. `wineventlog://System`.","Check for typos/extra whitespace at the start of the DSN string.","Verify you are not accidentally routing a DSN from another acquisition module (file://, journalctl://) to the wineventlog source.","Log/print the DSN before the call to confirm its exact contents."],"exampleFix":"// before\nsrc.ConfigureByDSN(ctx, \"wineventlog:System\", labels, logger, uuid)\n// after\nsrc.ConfigureByDSN(ctx, \"wineventlog://System\", labels, logger, uuid)","handlingStrategy":"validation","validationCode":"if !strings.HasPrefix(dsn, \"wineventlog://\") {\n\treturn fmt.Errorf(\"DSN must start with wineventlog://, got %q\", dsn)\n}","typeGuard":"func isWineventlogDSN(dsn string) bool { return strings.HasPrefix(dsn, \"wineventlog://\") }","tryCatchPattern":"if err := src.ConfigureByDSN(ctx, dsn, labels, logger, uuid); err != nil {\n\tif strings.Contains(err.Error(), \"invalid DSN\") {\n\t\treturn fmt.Errorf(\"bad DSN %q: use wineventlog://<channel>\", dsn)\n\t}\n\treturn err\n}","preventionTips":["Build DSNs with a helper that always prepends the scheme constant","Never hand-truncate DSN strings","Validate DSN scheme before routing to a source type"],"tags":["dsn","config","windows"],"backgroundTag":"invalid-url-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}