crowdsecurity/crowdsec · error

EvtQuery failed: %v

Error message

EvtQuery failed: %v

What it means

OneShot opens a Windows Event Log query via wevtapi.EvtQuery to replay historical events from a channel (e.g. a .evtx file or a named channel). This error wraps the failure of that EvtQuery call: the channel path, the XPath query, or the flags passed to the Windows event API were rejected, or the API returned a Win32 error (invalid handle parameters, channel not found, access denied). CrowdSec wraps the raw error so the underlying Windows reason is preserved.

Source

Thrown at pkg/acquisition/modules/wineventlog/run_windows.go:124

					l.Time = time.Now()
					l.Src = s.name
					l.Process = true
					if !s.config.UseTimeMachine {
						out <- pipeline.Event{Line: l, Process: true, Type: pipeline.LOG, ExpectMode: pipeline.LIVE, Unmarshaled: make(map[string]interface{})}
					} else {
						out <- pipeline.Event{Line: l, Process: true, Type: pipeline.LOG, ExpectMode: pipeline.TIMEMACHINE, Unmarshaled: make(map[string]interface{})}
					}
				}
			}

		}
	}
}

func (s *Source) OneShot(ctx context.Context, out chan pipeline.Event) error {
	handle, err := wevtapi.EvtQuery(localMachine, s.evtConfig.ChannelPath, s.evtConfig.Query, s.evtConfig.Flags)
	if err != nil {
		return fmt.Errorf("EvtQuery failed: %v", err)
	}

	defer winlog.Close(handle)

	publisherCache := make(map[string]windows.Handle)
	defer func() {
		for _, h := range publisherCache {
			winlog.Close(h)
		}
	}()

OUTER_LOOP:
	for {
		select {
		case <-ctx.Done():
			s.logger.Infof("wineventlog is dying")
			return nil
		default:

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the channel path or .evtx file path in the acquisition config exists and is spelled correctly (use wevtutil el to list channels, wevtutil qe <channel> /c:1 to test readability)
2. Test the XPath query with wevtutil qe <channel> "/path-to-event" /c:1 to confirm it is valid before putting it in config
3. Run crowdsec with elevated privileges (admin/SYSTEM) if reading protected channels like Security
4. Read the wrapped %v value: it contains the Win32 error code that identifies the exact cause

Example fix

// before
data_source:
  channel: Securty   # typo, channel does not exist
// after
data_source:
  channel: Security

ch := `wevtutil el`
// assert channel exists before acquisition:
if !strings.Contains(ch, "Security") { return errors.New("channel not found") }
// and test readability:
cmd := exec.Command("wevtutil", "qe", "Security", "/c:1")
if err := cmd.Run(); err != nil { return err }

if err := source.OneShot(ctx, out); err != nil {
    if strings.Contains(err.Error(), "EvtQuery failed") {
        log.Errorf("bad channel/query config: %v", err)
        return // do not retry blindly; fix config
    }
    return err
}

When it happens

Trigger: OneShot is called with s.evtConfig.ChannelPath pointing to a nonexistent .evtx file or invalid channel name, an XPath s.evtConfig.Query that is syntactically invalid, or invalid flag combination (e.g. EvtQueryChannelPath vs EvtQueryFilePath mismatch, forward/reverse direction flags combined wrongly). Also triggered when running without privileges to read the channel (Security channel requires admin).

Common situations: Users point acquisition at a channel name that doesn't exist on the host (typo in 'Security'/'System'/'Application'), an exported .evtx file path that is wrong, run crowdsec as a non-elevated service while reading the Security log, or craft an XPath query with invalid syntax/unsupported functions.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• getXMLEvents failed: %v
• event_channel or xpath_query must be set
• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/83954d3970dcfdcf. Report an issue: GitHub.