crowdsecurity/crowdsec · error

getXMLEvents failed: %v

Error message

getXMLEvents failed: %v

What it means

After EvtQuery succeeds, OneShot batches event rendering through getXMLEvents, which calls EvtNext/EvtRender to fetch and render events as XML. This error wraps any failure from that batch fetch that is not ERROR_NO_MORE_ITEMS (which is treated as normal end-of-stream). It typically means the event handle became invalid, rendering a publisher's metadata failed, or a Windows API error occurred mid-iteration.

Source

Thrown at pkg/acquisition/modules/wineventlog/run_windows.go:148

	defer func() {
		for _, h := range publisherCache {
			winlog.Close(h)
		}
	}()

OUTER_LOOP:
	for {
		select {
		case <-ctx.Done():
			s.logger.Infof("wineventlog is dying")
			return nil
		default:
			evts, err := s.getXMLEvents(s.evtConfig, publisherCache, handle, 500)
			if errors.Is(err, windows.ERROR_NO_MORE_ITEMS) {
				log.Info("No more items")
				break OUTER_LOOP
			} else if err != nil {
				return fmt.Errorf("getXMLEvents failed: %v", err)
			}
			s.logger.Debugf("Got %d events", len(evts))
			for _, evt := range evts {
				s.logger.Tracef("Event: %s", evt)
				if s.metricsLevel != metrics.AcquisitionMetricsLevelNone {
					metrics.WineventlogDataSourceLinesRead.With(prometheus.Labels{"source": s.name, "datasource_type": ModuleName, "acquis_type": s.config.Labels["type"]}).Inc()
				}
				l := pipeline.Line{}
				l.Raw = evt
				l.Module = s.GetName()
				l.Labels = s.config.Labels
				l.Time = time.Now()
				l.Src = s.name
				l.Process = true
				csevt := pipeline.MakeEvent(s.config.UseTimeMachine, pipeline.LOG, true)
				csevt.Line = l
				out <- csevt
			}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %v error to identify the Win32 code and address that specific cause (e.g. re-point to an intact .evtx file, reinstall the missing event provider)
2. Retry the OneShot acquisition — transient failures on live channels often resolve on the next run
3. If reading a large historical file, split the time range into smaller queries so partial failures lose less work
4. Check that the event publishers referenced in the log are still installed on the machine

f, err := os.Open(evtFilePath)
if err != nil { return err }
fi, _ := f.Stat()
if fi.Size() == 0 { return errors.New("empty/corrupt evtx") }

err := source.OneShot(ctx, out)
if err != nil && strings.Contains(err.Error(), "getXMLEvents failed") {
    if errors.Is(err, context.Canceled) { return }
    time.Sleep(backoff); retryOnce() // transient API failures
}

When it happens

Trigger: Calling OneShot on a handle from EvtQuery, then getXMLEvents fails mid-batch: e.g. ERROR_INVALID_HANDLE after the log was rotated/closed, a publisher metadata lookup failure (EvtOpenPublisherMetadata) while localizing events, or another Win32 error other than ERROR_NO_MORE_ITEMS returned by EvtNext.

Common situations: The queried .evtx file is truncated/corrupt or deleted while being read; the event log channel is cleared (wevtutil cl) during the read; a specific event's provider is uninstalled so its message template cannot be rendered; transient Windows errors during large batch reads of 500 events.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• EvtQuery failed: %v
• event_channel or xpath_query must be set
• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/01d29245e7a938df. Report an issue: GitHub.