{"record":{"id":"c3b37d8afd904f06","repo":"nats-io/nats-server","slug":"could-not-open-event-log-v","errorCode":null,"errorMessage":"could not open event log: %v","messagePattern":"could not open event log: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"logger/syslog_windows.go","lineNumber":49,"sourceCode":"\n// SysLogger logs to the windows event logger\ntype SysLogger struct {\n\twriter *eventlog.Log\n\tdebug  bool\n\ttrace  bool\n}\n\n// NewSysLogger creates a log using the windows event logger\nfunc NewSysLogger(debug, trace bool) *SysLogger {\n\tif err := eventlog.InstallAsEventCreate(natsEventSource, eventlog.Info|eventlog.Error|eventlog.Warning); err != nil {\n\t\tif !strings.Contains(err.Error(), \"registry key already exists\") {\n\t\t\tpanic(fmt.Sprintf(\"could not access event log: %v\", err))\n\t\t}\n\t}\n\n\tw, err := eventlog.Open(natsEventSource)\n\tif err != nil {\n\t\tpanic(fmt.Sprintf(\"could not open event log: %v\", err))\n\t}\n\n\treturn &SysLogger{\n\t\twriter: w,\n\t\tdebug:  debug,\n\t\ttrace:  trace,\n\t}\n}\n\n// NewRemoteSysLogger creates a remote event logger\nfunc NewRemoteSysLogger(fqn string, debug, trace bool) *SysLogger {\n\tw, err := eventlog.OpenRemote(fqn, natsEventSource)\n\tif err != nil {\n\t\tpanic(fmt.Sprintf(\"could not open event log: %v\", err))\n\t}\n\n\treturn &SysLogger{\n\t\twriter: w,","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/logger/syslog_windows.go#L31-L67","documentation":"After (possibly skipped) installation, NewSysLogger opens the nats-server event source via eventlog.Open; if that fails, it panics with this message wrapping the OS error, since the SysLogger cannot function without an open handle to the event log.","triggerScenarios":"eventlog.Open(natsEventSource) returns an error — typically when the event source registry key does not exist or is unreadable because installation was skipped/failed silently and Open proceeds anyway.","commonSituations":"Event source removed by cleanup scripts or AV tools; service moved to a machine/host where the source was never registered; registry permissions deny read access for the service account.","solutions":["Register the event source first (admin PowerShell: New-EventLog -LogName Application -Source nats-server) then restart the service","Verify the registry key HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\nats-server exists and is readable by the service account","Switch to file logging if the Windows event log is not required"],"exampleFix":"// before\nw, err := eventlog.Open(natsEventSource) // fails: source missing\n// after (ops fix, admin PowerShell)\nNew-EventLog -LogName Application -Source nats-server\n// then start the service","handlingStrategy":"try-catch","validationCode":"// Windows: verify the source is registered before enabling syslog\n$src='HKLM:\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\nats-server'\nif (-not (Test-Path $src)) { New-EventLog -LogName Application -Source nats-server }","typeGuard":null,"tryCatchPattern":"// Go: guard against the panic and fall back to file logging\ndefer func() {\n  if r := recover(); r != nil {\n    log.Printf(\"event log unavailable: %v; falling back to file log\", r)\n  }\n}()\nw := loggerpkg.NewSysLogger(debug, trace)","preventionTips":["Ensure the event source exists before the service starts (deployment script creates it)","Protect the event source registry key from cleanup scripts and AV tampering","Grant the service account read access to the event log registry key"],"tags":["windows","syslog","eventlog","panic"],"backgroundTag":"event-log-access-denied","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}