{"record":{"id":"ea908ee80de47138","repo":"crowdsecurity/crowdsec","slug":"wevtapi-evtnext-failed-v","errorCode":null,"errorMessage":"wevtapi.EvtNext failed: %v","messagePattern":"wevtapi\\.EvtNext failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/run_windows.go","lineNumber":41,"sourceCode":"const localMachine = 0\n\n// This is lifted from winops/winlog, but we only want to render the basic XML string, we don't need the extra fluff\nfunc (s *Source) getXMLEvents(config *winlog.SubscribeConfig, publisherCache map[string]windows.Handle, resultSet windows.Handle, maxEvents int) ([]string, error) {\n\tevents := make([]windows.Handle, maxEvents)\n\tvar returned uint32\n\n\t// Get handles to events from the result set.\n\terr := wevtapi.EvtNext(\n\t\tresultSet,           // Handle to query or subscription result set.\n\t\tuint32(len(events)), // The number of events to attempt to retrieve.\n\t\t&events[0],          // Pointer to the array of event handles.\n\t\t2000,                // Timeout in milliseconds to wait.\n\t\t0,                   // Reserved. Must be zero.\n\t\t&returned)           // The number of handles in the array that are set by the API.\n\tif errors.Is(err, windows.ERROR_NO_MORE_ITEMS) {\n\t\treturn nil, err\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"wevtapi.EvtNext failed: %v\", err)\n\t}\n\n\t// Event handles must be closed after they are returned by EvtNext whether or not we use them.\n\tdefer func() {\n\t\tfor _, event := range events[:returned] {\n\t\t\twinlog.Close(event)\n\t\t}\n\t}()\n\n\t// Render events.\n\tvar renderedEvents []string\n\tfor _, event := range events[:returned] {\n\t\t// Render the basic XML representation of the event.\n\t\tfragment, err := winlog.RenderFragment(event, wevtapi.EvtRenderEventXml)\n\t\tif err != nil {\n\t\t\ts.logger.Errorf(\"Failed to render event with RenderFragment, skipping: %v\", err)\n\t\t\tcontinue\n\t\t}","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/run_windows.go#L23-L59","documentation":"getXMLEvents fetches a batch of event handles from an event query or subscription using wevtapi.EvtNext, with a 2000 ms timeout. This error is returned when EvtNext fails with anything other than windows.ERROR_NO_MORE_ITEMS (which signals normal end-of-results and is passed through). It wraps the raw Windows API error, so the cause can be an RPC failure, a closed/corrupted channel, invalid handles, or timeout.","triggerScenarios":"Called by getEvents (the streaming loop) and OneShot when EvtNext returns an unexpected Win32 error: the Event Log service (wevtsvc) is stopped, the query handle became invalid, the channel was deleted/cleared mid-read, RPC to a remote log failed, or the 2-second wait timed out.","commonSituations":"Windows Event Log service not running or crashed, reading a channel that was cleared (`wevtutil cl`), remote event log collection where the remote host is unreachable or access is denied, or system resource exhaustion preventing handle creation.","solutions":["Check the Windows Event Log service: `Get-Service eventlog` / `net start eventlog`, and ensure it is running.","Read the wrapped Win32 error to identify the cause (ERROR_ACCESS_DENIED → run as admin or grant log access; RPC errors → check remote host/firewall).","Verify the channel still exists: `wevtutil el` — if the channel was deleted or renamed, fix the event_channel config.","For remote collection, confirm network connectivity and that Remote Event Log Management is enabled in the firewall.","If errors are transient/timeouts, add retry/backoff around OneShot calls; for the streaming path, check crowdsec logs for the failing query and restart the source."],"exampleFix":"// before (caller)\nevents, err := src.OneShot(ctx)\nif err != nil { return err }\n// after (caller)\nevents, err := src.OneShot(ctx)\nif errors.Is(err, windows.ERROR_NO_MORE_ITEMS) { return nil }\nif err != nil {\n\tlogger.Warnf(\"evt fetch failed, retrying: %v\", err)\n\ttime.Sleep(time.Second)\n\tevents, err = src.OneShot(ctx)\n\tif err != nil { return err }\n}","handlingStrategy":"retry","validationCode":"svc, err := exec.Command(\"powershell\", \"-c\", \"Get-Service eventlog\").Output()\n// verify eventlog service is Running and channel exists via `wevtutil gl <channel>` before opening the source","typeGuard":null,"tryCatchPattern":"events, err := src.OneShot(ctx)\nif errors.Is(err, windows.ERROR_NO_MORE_ITEMS) { return nil } // normal end of stream\nif err != nil {\n\tif retryable(err) { // RPC/timeout style errors\n\t\ttime.Sleep(backoff)\n\t\tevents, err = src.OneShot(ctx)\n\t}\n\tif err != nil { return err }\n}","preventionTips":["Ensure the Windows Event Log service is enabled and running (monitor it with a health check)","Grant the crowdsec service account read access to the target channels (eventlog readers group)","Don't clear/delete channels while a source is reading them","Run crowdsec as Administrator or with the Event Log Readers group membership","Add bounded retry/backoff for transient RPC/timeout failures in one-shot usage"],"tags":["windows","eventlog","winapi","network"],"backgroundTag":"api-request-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}