{"record":{"id":"9b4d7ab6736e439f","repo":"puppetlabs/puppet","slug":"reporteventw-failed-to-report-event-to-windows-eve","errorCode":null,"errorMessage":"ReportEventW failed to report event to Windows eventlog","messagePattern":"ReportEventW failed to report event to Windows eventlog","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/eventlog.rb","lineNumber":79,"sourceCode":"    unless args[:data].is_a?(String)\n      raise ArgumentError, _(\"data must be a string, not %{class_name}\") % { class_name: args[:data].class }\n    end\n\n    from_string_to_wide_string(args[:data]) do |message_ptr|\n      FFI::MemoryPointer.new(:pointer) do |message_array_ptr|\n        message_array_ptr.write_pointer(message_ptr)\n        user_sid = FFI::Pointer::NULL\n        raw_data = FFI::Pointer::NULL\n        raw_data_size = 0\n        num_strings = 1\n        eventlog_category = 0\n        report_result = ReportEventW(@eventlog_handle, args[:event_type],\n                                     eventlog_category, args[:event_id], user_sid,\n                                     num_strings, raw_data_size, message_array_ptr, raw_data)\n\n        if report_result == WIN32_FALSE\n          # TRANSLATORS 'Windows' is the operating system and 'ReportEventW' is a API call and should not be translated\n          raise EventLogError.new(_(\"ReportEventW failed to report event to Windows eventlog\"), FFI.errno)\n        end\n      end\n    end\n  end\n\n  class << self\n    # Feels more natural to do Puppet::Util::Window::EventLog.open(\"MyApplication\")\n    alias :open :new\n\n    # Query event identifier info for a given log level\n    # @param level [Symbol] an event log level\n    # @return [Array] Win API Event ID, Puppet Event ID\n    # @api public\n    def to_native(level)\n      case level\n      when :debug, :info, :notice\n        [EVENTLOG_INFORMATION_TYPE, 0x01]\n      when :warning","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/eventlog.rb#L61-L97","documentation":"EventLog#report_event raises EventLogError (carrying FFI.errno) when the ReportEventW API call returns FALSE — the write to the Windows event log failed. The handle comes from RegisterEventSourceW at construction, and #close nils @eventlog_handle, so the most common cause is reporting on a stale/closed handle or the log service becoming unavailable mid-run.","triggerScenarios":"Calling report_event on an instance after close has run (handle is nil); the Event Log service stopped or the log was cleared between open and write; passing event_type/event_id values not derived from EventLog.to_native so the API rejects the record.","commonSituations":"Long-running Ruby processes caching one EventLog instance across service restarts; logging during shutdown after the handle was closed; reusing an instance after an earlier failure.","solutions":["Create a fresh EventLog instance (EventLog.open/new) per reporting batch instead of caching one forever","Never call report_event after close — reopen when logging is needed again","Always derive event_type/event_id via Puppet::Util::Windows::EventLog.to_native(level)","Check FFI.errno on the raised error (e.g. ERROR_INVALID_HANDLE confirms a stale handle)"],"exampleFix":"# before\nlog = Puppet::Util::Windows::EventLog.open('Puppet')\nlog.close\nlog.report_event(data: 'msg', event_type: t, event_id: i)  # stale handle -> EventLogError\n\n# after\nlog = Puppet::Util::Windows::EventLog.open('Puppet')\nlog.report_event(data: 'msg', event_type: t, event_id: i)\nlog.close","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  @log.report_event(data: msg, event_type: t, event_id: i)\nrescue Puppet::Util::Windows::EventLogError\n  @log = Puppet::Util::Windows::EventLog.new('Puppet') # reopen: handle may be stale\n  @log.report_event(data: msg, event_type: t, event_id: i)\nend","preventionTips":["Keep the EventLog lifetime aligned with the reporting session; reopen after close or errors","Derive event_type/event_id only via EventLog.to_native(level) — never hand-roll integers","Do not cache one instance across Windows service restarts; handle invalidation is silent"],"tags":["windows","eventlog","ffi","puppet"],"backgroundTag":"windows-eventlog-write-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}