crowdsecurity/crowdsec · error

generateConfig failed: %w

Error message

generateConfig failed: %w

What it means

As the final step of ConfigureByDSN, generateConfig converts the built XPath query into an EVT_QUERY configuration handle for wevtapi. This error wraps any failure from generateConfig — most commonly the windows.UTF16PtrFromString failure when the query (or event file path) contains an invalid character such as an embedded NUL byte, meaning the query could not be handed to the Windows Event Log API.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:254

				}
				s.config.EventLevel = value[0]
			}
		}
	}

	var err error

	// FIXME: handle custom xpath query
	s.query, err = s.buildXpathQuery()
	if err != nil {
		return fmt.Errorf("buildXpathQuery failed: %w", err)
	}

	s.logger.Debugf("query: %s\n", s.query)

	s.evtConfig, err = s.generateConfig(s.query, false)
	if err != nil {
		return fmt.Errorf("generateConfig failed: %w", err)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the wrapped inner error — if it mentions UTF16PtrFromString, hunt for NUL/control bytes in the DSN's channel or file path.
2. Sanitize the DSN before calling: strings.ReplaceAll(dsn, "\x00", "").
3. Use a plain, well-formed channel name like `System`, `Security`, or `Application`.
4. If the problem persists, configure the source via a YAML acquisition file instead of a DSN to isolate where the invalid character enters.

Example fix

// before
dsn := fmt.Sprintf("wineventlog://%s", string(rawBytes)) // rawBytes may contain \x00
// after
clean := strings.ReplaceAll(string(rawBytes), "\x00", "")
dsn := fmt.Sprintf("wineventlog://%s", clean)

if strings.ContainsRune(dsn, 0) { return errors.New("DSN contains NUL byte") }

func dsnSafe(dsn string) bool { return !strings.ContainsRune(dsn, 0) }

if err := src.ConfigureByDSN(ctx, dsn, labels, logger, uuid); err != nil {
	if strings.Contains(err.Error(), "generateConfig") {
		logger.Errorf("wineventlog DSN rejected: %v", err)
		// fall back to default channel
		return src.ConfigureByDSN(ctx, "wineventlog://Application", labels, logger, uuid)
	}
	return err
}

When it happens

Trigger: Calling ConfigureByDSN where the resulting query string (channel name from the DSN plus event filters) fails UTF-16 conversion — e.g. a channel name containing a NUL byte — or the event file path in the DSN is invalid for UTF16PtrFromString.

Common situations: DSNs constructed programmatically from untrusted input containing control characters, corrupted channel names from copy-paste, or event file paths with encoded NULs.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value
• event_level must be a single value
• invalid DSN %s for wineventlog source, must start with winev

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/107b8d8645065121. Report an issue: GitHub.