{"record":{"id":"7b750fa06289dd2b","repo":"crowdsecurity/crowdsec","slug":"windows-event-log-acquisition-is-only-supported-on","errorCode":null,"errorMessage":"windows event log acquisition is only supported on Windows","messagePattern":"windows event log acquisition is only supported on Windows","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/source_windows.go","lineNumber":36,"sourceCode":"\tquery        string\n\tname         string\n}\n\nfunc (s *Source) GetUuid() string {\n\treturn s.config.UniqueId\n}\n\nfunc (s *Source) GetMode() string {\n\treturn s.config.Mode\n}\n\nfunc (*Source) GetName() string {\n\treturn ModuleName\n}\n\nfunc (*Source) CanRun() error {\n\tif runtime.GOOS != \"windows\" {\n\t\treturn errors.New(\"windows event log acquisition is only supported on Windows\")\n\t}\n\treturn nil\n}\n\nfunc (s *Source) Dump() interface{} {\n\treturn s\n}\n","sourceCodeStart":18,"sourceCodeEnd":44,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/source_windows.go#L18-L44","documentation":"The real wineventlog source implementation uses the Windows Event Log API (golang.org/x/sys/windows), which exists only on Windows. CanRun is invoked by the acquisition registry before a source is used, and on any other OS it returns this error so the source is refused.","triggerScenarios":"Loading a wineventlog acquisition config on Linux/macOS/FreeBSD, or any code path that calls Source.CanRun() on a non-Windows GOOS.","commonSituations":"Running crowdsec on Linux with a config that still references wineventlog (leftover from a Windows machine or a shared config); testing Windows acquisition configs in a Linux CI environment.","solutions":["Run the acquisition on a Windows host","Remove the wineventlog source from the acquisition config on non-Windows machines","Split configs per-platform and only reference wineventlog in the Windows deployment"],"exampleFix":"// before (acquis.yaml on Linux)\nsource: wineventlog\nevent_channel: System\n// after (remove, or use a supported source)\nsource: journalctl\njournalctl_filter:\n  - _SYSTEMD_UNIT=ssh.service","handlingStrategy":"validation","validationCode":"// Go: skip wineventlog sources on non-Windows hosts before loading config\nif runtime.GOOS != \"windows\" {\n    log.Info(\"skipping wineventlog acquisition: not supported on \" + runtime.GOOS)\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := src.CanRun(); err != nil {\n    log.Warnf(\"source %s unavailable: %s\", src.GetName(), err)\n    return\n}","preventionTips":["Keep platform-specific sources out of shared acquisition configs","Filter acquisition configs by GOOS in deployment tooling","Call CanRun() before configuring any data source"],"tags":["windows","platform","acquisition","wineventlog"],"backgroundTag":"unsupported-platform","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}