crowdsecurity/crowdsec · error

failed to parse event_id: %s

Error message

failed to parse event_id: %s

What it means

Each value of the `event_id` DSN parameter must be an integer convertible by strconv.Atoi, since event IDs are numeric Windows Event IDs. This error wraps the Atoi failure when a non-numeric ID is supplied.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:229

			return fmt.Errorf("failed to parse DSN parameters: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("log_level must be a single value")
				}
				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("failed to parse log_level: %s", err)
				}
				s.logger.Logger.SetLevel(lvl)
			case "event_id":
				for _, id := range value {
					evtid, err := strconv.Atoi(id)
					if err != nil {
						return fmt.Errorf("failed to parse event_id: %s", err)
					}
					s.config.EventIDs = append(s.config.EventIDs, evtid)
				}
			case "event_level":
				if len(value) != 1 {
					return errors.New("event_level must be a single value")
				}
				s.config.EventLevel = value[0]
			}
		}
	}

	var err error

	// FIXME: handle custom xpath query
	s.query, err = s.buildXpathQuery()
	if err != nil {
		return fmt.Errorf("buildXpathQuery failed: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure each event_id value is purely numeric, e.g. `wineventlog://Security?event_id=4624&event_id=4625`.
2. If you used commas (`event_id=4624,4625`), split them into repeated parameters.
3. Strip quotes/whitespace from the DSN string.
4. Check that the ID fits in a platform int (Windows event IDs are 16-bit, so this is rarely an issue).

Example fix

// before
wineventlog://Security?event_id=4624,4625
// after
wineventlog://Security?event_id=4624&event_id=4625

for _, id := range idStrings {
	if n, err := strconv.Atoi(id); err != nil || n < 0 {
		return fmt.Errorf("event_id must be a positive integer, got %q", id)
	}
}

When it happens

Trigger: A DSN like `wineventlog://Security?event_id=4625,4624` — wait, multiple values are allowed via repeated params — specifically `event_id=4a62` or `event_id=462 5` containing non-digit characters, or an ID exceeding int range.

Common situations: Comma-separated IDs passed in a single parameter (use repeated event_id params instead), quotes or spaces accidentally included, or confusing event IDs with event level names.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value
• event_level must be a single value
• invalid DSN %s for wineventlog source, must start with winev

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5c5f7d0d0bc169f9. Report an issue: GitHub.