{"record":{"id":"83954d3970dcfdcf","repo":"crowdsecurity/crowdsec","slug":"evtquery-failed-v","errorCode":null,"errorMessage":"EvtQuery failed: %v","messagePattern":"EvtQuery failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/run_windows.go","lineNumber":124,"sourceCode":"\t\t\t\t\tl.Time = time.Now()\n\t\t\t\t\tl.Src = s.name\n\t\t\t\t\tl.Process = true\n\t\t\t\t\tif !s.config.UseTimeMachine {\n\t\t\t\t\t\tout <- pipeline.Event{Line: l, Process: true, Type: pipeline.LOG, ExpectMode: pipeline.LIVE, Unmarshaled: make(map[string]interface{})}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tout <- pipeline.Event{Line: l, Process: true, Type: pipeline.LOG, ExpectMode: pipeline.TIMEMACHINE, Unmarshaled: make(map[string]interface{})}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t}\n}\n\nfunc (s *Source) OneShot(ctx context.Context, out chan pipeline.Event) error {\n\thandle, err := wevtapi.EvtQuery(localMachine, s.evtConfig.ChannelPath, s.evtConfig.Query, s.evtConfig.Flags)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"EvtQuery failed: %v\", err)\n\t}\n\n\tdefer winlog.Close(handle)\n\n\tpublisherCache := make(map[string]windows.Handle)\n\tdefer func() {\n\t\tfor _, h := range publisherCache {\n\t\t\twinlog.Close(h)\n\t\t}\n\t}()\n\nOUTER_LOOP:\n\tfor {\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\ts.logger.Infof(\"wineventlog is dying\")\n\t\t\treturn nil\n\t\tdefault:","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/run_windows.go#L106-L142","documentation":"OneShot opens a Windows Event Log query via wevtapi.EvtQuery to replay historical events from a channel (e.g. a .evtx file or a named channel). This error wraps the failure of that EvtQuery call: the channel path, the XPath query, or the flags passed to the Windows event API were rejected, or the API returned a Win32 error (invalid handle parameters, channel not found, access denied). CrowdSec wraps the raw error so the underlying Windows reason is preserved.","triggerScenarios":"OneShot is called with s.evtConfig.ChannelPath pointing to a nonexistent .evtx file or invalid channel name, an XPath s.evtConfig.Query that is syntactically invalid, or invalid flag combination (e.g. EvtQueryChannelPath vs EvtQueryFilePath mismatch, forward/reverse direction flags combined wrongly). Also triggered when running without privileges to read the channel (Security channel requires admin).","commonSituations":"Users point acquisition at a channel name that doesn't exist on the host (typo in 'Security'/'System'/'Application'), an exported .evtx file path that is wrong, run crowdsec as a non-elevated service while reading the Security log, or craft an XPath query with invalid syntax/unsupported functions.","solutions":["Verify the channel path or .evtx file path in the acquisition config exists and is spelled correctly (use wevtutil el to list channels, wevtutil qe <channel> /c:1 to test readability)","Test the XPath query with wevtutil qe <channel> \"/path-to-event\" /c:1 to confirm it is valid before putting it in config","Run crowdsec with elevated privileges (admin/SYSTEM) if reading protected channels like Security","Read the wrapped %v value: it contains the Win32 error code that identifies the exact cause"],"exampleFix":"// before\ndata_source:\n  channel: Securty   # typo, channel does not exist\n// after\ndata_source:\n  channel: Security","handlingStrategy":"try-catch","validationCode":"ch := `wevtutil el`\n// assert channel exists before acquisition:\nif !strings.Contains(ch, \"Security\") { return errors.New(\"channel not found\") }\n// and test readability:\ncmd := exec.Command(\"wevtutil\", \"qe\", \"Security\", \"/c:1\")\nif err := cmd.Run(); err != nil { return err }","typeGuard":null,"tryCatchPattern":"if err := source.OneShot(ctx, out); err != nil {\n    if strings.Contains(err.Error(), \"EvtQuery failed\") {\n        log.Errorf(\"bad channel/query config: %v\", err)\n        return // do not retry blindly; fix config\n    }\n    return err\n}","preventionTips":["Validate channel names with wevtutil el before adding them to acquis.yaml","Test XPath queries with wevtutil qe before deployment","Run the crowdsec service with sufficient privileges for protected channels","Keep .evtx files on stable paths accessible to the service account"],"tags":["windows","eventlog","acquisition"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}