crowdsecurity/crowdsec · error

empty wineventlog:// DSN

Error message

empty wineventlog:// DSN

What it means

ConfigureByDSN parses DSN strings of the form wineventlog://<event_file>[?<params>]. After stripping the scheme and splitting on '?', an empty first segment means no event log file/channel was specified, so the function rejects the DSN.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:199

	}

	return nil
}

func (s *Source) ConfigureByDSN(ctx context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	if !strings.HasPrefix(dsn, "wineventlog://") {
		return fmt.Errorf("invalid DSN %s for wineventlog source, must start with wineventlog://", dsn)
	}

	s.logger = logger
	s.config = Configuration{}

	dsn = strings.TrimPrefix(dsn, "wineventlog://")

	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty wineventlog:// DSN")
	}

	if len(args) > 2 {
		return errors.New("too many arguments in DSN")
	}

	s.config.EventFile = args[0]

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("failed to parse DSN parameters: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {

View on GitHub (pinned to 909b515798)

Solutions

1. Include the Windows event log channel in the DSN, e.g. wineventlog://Security
2. Verify the variable holding the channel name is not empty in scripts/templates
3. Prefer a YAML acquisition file with event_channel if the DSN keeps coming out empty

Example fix

// before
ConfigureByDSN("wineventlog://")
// after
ConfigureByDSN("wineventlog://Security?log_level=info")

// Go: check DSN before calling ConfigureByDSN
dsn = strings.TrimPrefix(dsn, "wineventlog://")
name := strings.Split(dsn, "?")[0]
if name == "" {
    return fmt.Errorf("wineventlog DSN requires an event log channel")
}

if err := src.ConfigureByDSN(dsn); err != nil {
    return fmt.Errorf("invalid wineventlog DSN %q: %w", dsn, err)
}

When it happens

Trigger: Calling ConfigureByDSN with 'wineventlog://' or 'wineventlog://?log_level=info' — the part before '?' (the event log name) is empty.

Common situations: A generated or templated DSN where the channel variable was empty; copying a URL-style DSN and dropping the channel name; whitespace-only or stripped arguments in a script assembling the DSN.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• too many arguments in DSN
• log_level must be a single value
• event_level must be a single value
• event_channel or xpath_query must be set
• windows event log acquisition is only supported on Windows

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8cc048f947274edb. Report an issue: GitHub.