{"record":{"id":"88154d6a99844a8b","repo":"crowdsecurity/crowdsec","slug":"windows-createevent-failed-v","errorCode":null,"errorMessage":"windows.CreateEvent failed: %v","messagePattern":"windows\\.CreateEvent failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":115,"sourceCode":"\tif s.logger != nil {\n\t\ts.logger.Debugf(\"xpathQuery: %s\", xpathQuery)\n\t}\n\treturn string(xpathQuery), nil\n}\n\nfunc (s *Source) generateConfig(query string, live bool) (*winlog.SubscribeConfig, error) {\n\tvar config winlog.SubscribeConfig\n\tvar err error\n\n\tif live {\n\t\t// Create a subscription signaler.\n\t\tconfig.SignalEvent, err = windows.CreateEvent(\n\t\t\tnil, // Default security descriptor.\n\t\t\t1,   // Manual reset.\n\t\t\t1,   // Initial state is signaled.\n\t\t\tnil) // Optional name.\n\t\tif err != nil {\n\t\t\treturn &config, fmt.Errorf(\"windows.CreateEvent failed: %v\", err)\n\t\t}\n\t\tconfig.Flags = wevtapi.EvtSubscribeToFutureEvents\n\t} else {\n\t\tconfig.ChannelPath, err = windows.UTF16PtrFromString(s.config.EventFile)\n\t\tif err != nil {\n\t\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t\t}\n\t\tconfig.Flags = wevtapi.EvtQueryFilePath | wevtapi.EvtQueryForwardDirection\n\t}\n\tconfig.Query, err = windows.UTF16PtrFromString(query)\n\tif err != nil {\n\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t}\n\n\treturn &config, nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L97-L133","documentation":"When building the Windows Event Log subscription config, if the user asked for a signal event (no explicit event file), `windows.CreateEvent` failed to create the kernel auto-reset/manual-reset event object used to signal EVT. This is a Win32 API failure surfaced during `generateConfig`, so the datasource cannot be configured.","triggerScenarios":"`windows.CreateEvent(nil, 1, 1, nil)` returns a handle error: the Win32 event object could not be created — essentially only on severe system-resource exhaustion (handle/memory limits) or an invalid security descriptor argument.","commonSituations":"Extremely rare; seen when the process is leaking handles and hits the per-process handle limit, or running in a heavily restricted service sandbox/job object; misconfigured datasource that requests signal-event mode unintentionally.","solutions":["Check the process handle count (`handle.exe -p <pid>`) for a handle leak and restart crowdsec.","Reboot or free system resources if the machine is at kernel object limits.","Run crowdsec under a less restricted account/service context if sandboxing blocks object creation.","If signal-event mode is not required, configure `event_file`/read-from-file mode so this branch is skipped.","Report persistent failures to the OS vendor; CreateEvent with these flags failing is abnormal."],"exampleFix":"// before (acquis.yaml, windows)\nsource: wineventlog\n# no event_file -> signal-event path\n// after\nsource: wineventlog\nevent_file: C:\\Windows\\System32\\winevt\\Logs\\System.evtx  # avoid CreateEvent path","handlingStrategy":"try-catch","validationCode":"// prefer the file path when possible so CreateEvent is skipped\nif cfg.EventFile == \"\" && cfg.Mode == \"signal\" {\n    // verify the process can create kernel events:\n    h, err := windows.CreateEvent(nil, 1, 1, nil)\n    if err != nil { return err }\n    windows.CloseHandle(h)\n}","typeGuard":null,"tryCatchPattern":"sig, err := windows.CreateEvent(nil, 1, 1, nil)\nif err != nil {\n    return fmt.Errorf(\"windows.CreateEvent failed: %v\", err)\n}\ndefer windows.CloseHandle(sig) // avoid handle leaks causing later failures","preventionTips":["Close event handles you create to avoid handle exhaustion","Avoid unnecessary signal-event mode; read from .evtx files when possible","Run the service with a normal, unrestricted account","Monitor process handle counts"],"tags":["windows","wineventlog","win32"],"backgroundTag":"module-init-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}