{"record":{"id":"8228f275db48e979","repo":"puppetlabs/puppet","slug":"registereventsourcew-failed-to-open-windows-eventl","errorCode":null,"errorMessage":"RegisterEventSourceW failed to open Windows eventlog","messagePattern":"RegisterEventSourceW failed to open Windows eventlog","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/eventlog.rb","lineNumber":37,"sourceCode":"  EVENTLOG_ERROR_TYPE       = 0x0001\n  EVENTLOG_WARNING_TYPE     = 0x0002\n  EVENTLOG_INFORMATION_TYPE = 0x0004\n\n  # These are duplicate definitions from Puppet::Util::Windows::ApiTypes,\n  # established here so this class can be standalone from Puppet, and public so\n  # we can reference them in tests.\n  NULL_HANDLE = 0\n  WIN32_FALSE = 0\n\n  # Register an event log handle for the application\n  # @param source_name [String] the name of the event source to retrieve a handle for\n  # @return [void]\n  # @api public\n  def initialize(source_name = 'Puppet')\n    @eventlog_handle = RegisterEventSourceW(FFI::Pointer::NULL, wide_string(source_name))\n    if @eventlog_handle == NULL_HANDLE\n      # TRANSLATORS 'Windows' is the operating system and 'RegisterEventSourceW' is a API call and should not be translated\n      raise EventLogError.new(_(\"RegisterEventSourceW failed to open Windows eventlog\"), FFI.errno)\n    end\n  end\n\n  # Close this instance's event log handle\n  # @return [void]\n  # @api public\n  def close\n    DeregisterEventSource(@eventlog_handle)\n  ensure\n    @eventlog_handle = nil\n  end\n\n  # Report an event to this instance's event log handle. Accepts a string to\n  #   report (:data => <string>) and event type (:event_type => Integer) and id\n  # (:event_id => Integer) as returned by #to_native. The additional arguments to\n  # ReportEventW seen in this method aren't exposed - though ReportEventW\n  # technically can accept multiple strings as well as raw binary data to log,\n  # we accept a single string from Puppet::Util::Log","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/eventlog.rb#L19-L55","documentation":"Puppet::Util::Windows::EventLog.new calls the Win32 API RegisterEventSourceW and raises EventLogError (carrying FFI.errno) when it returns a NULL handle: Windows refused to open an event-log handle for the requested source name. On Windows, puppet routes log output to the event log, so this typically fires when the :eventlog log destination is set up.","triggerScenarios":"Constructing EventLog.new(source_name) (or EventLog.open) where source_name has no registration under the EventLog service's Application subkey in the registry; the Windows Event Log service is stopped or unreachable; the target log channel denies the caller.","commonSituations":"Running puppet or a gem reusing this class with a custom source name that no installer ever registered; stripped-down Windows images or containers with the Event Log service disabled; registry entries for the source deleted or corrupted.","solutions":["Use the default source name 'Puppet' — the puppet-agent installer registers its registry keys (including EventMessageFile) for it","Start the Windows Event Log service (Start-Service EventLog) and retry","For a custom source, register it under the EventLog Application tree with an EventMessageFile pointing at a message DLL, then retry","Read the Windows error code from the raised EventLogError (FFI.errno) to identify the OS-level reason"],"exampleFix":"# before\nlog = Puppet::Util::Windows::EventLog.new('MyCustomSource')  # unregistered source\n\n# after\nlog = Puppet::Util::Windows::EventLog.new('Puppet')  # installer-registered source","handlingStrategy":"try-catch","validationCode":"require 'win32/service'\nWin32::Service.status('EventLog').current_state == 'running' rescue nil # best-effort pre-check","typeGuard":null,"tryCatchPattern":"begin\n  log = Puppet::Util::Windows::EventLog.new('Puppet')\nrescue Puppet::Util::Windows::EventLogError => e\n  # fall back to another log destination instead of dying\n  Puppet::Util::Log.newdestination(:console)\nend","preventionTips":["Use the installer-registered 'Puppet' source name unless you have registered your own keys","Ensure the Windows Event Log service is running before configuring the eventlog log destination","Register custom sources (EventMessageFile included) via installer/GPO before first use"],"tags":["windows","eventlog","ffi","puppet"],"backgroundTag":"windows-eventlog-open-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}