crowdsecurity/crowdsec · error

invalid DSN %s for wineventlog source, must start with winev

Error message

invalid DSN %s for wineventlog source, must start with wineventlog://

What it means

ConfigureByDSN only accepts data source names beginning with the `wineventlog://` scheme. This error is returned immediately when the DSN lacks that prefix, rejecting the input before any parsing occurs. It exists because acquisition DSN strings from other source types (e.g. `journalctl://`, `file://`) may be routed to this module and must be validated.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:188

	s.logger = logger
	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	s.evtConfig, err = s.generateConfig(s.query, true)
	if err != nil {
		return err
	}

	return nil
}

func (s *Source) ConfigureByDSN(ctx context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	if !strings.HasPrefix(dsn, "wineventlog://") {
		return fmt.Errorf("invalid DSN %s for wineventlog source, must start with wineventlog://", dsn)
	}

	s.logger = logger
	s.config = Configuration{}

	dsn = strings.TrimPrefix(dsn, "wineventlog://")

	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty wineventlog:// DSN")
	}

	if len(args) > 2 {
		return errors.New("too many arguments in DSN")
	}

	s.config.EventFile = args[0]

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the DSN starts exactly with `wineventlog://` (lowercase, with the double slash), e.g. `wineventlog://System`.
2. Check for typos/extra whitespace at the start of the DSN string.
3. Verify you are not accidentally routing a DSN from another acquisition module (file://, journalctl://) to the wineventlog source.
4. Log/print the DSN before the call to confirm its exact contents.

Example fix

// before
src.ConfigureByDSN(ctx, "wineventlog:System", labels, logger, uuid)
// after
src.ConfigureByDSN(ctx, "wineventlog://System", labels, logger, uuid)

if !strings.HasPrefix(dsn, "wineventlog://") {
	return fmt.Errorf("DSN must start with wineventlog://, got %q", dsn)
}

func isWineventlogDSN(dsn string) bool { return strings.HasPrefix(dsn, "wineventlog://") }

if err := src.ConfigureByDSN(ctx, dsn, labels, logger, uuid); err != nil {
	if strings.Contains(err.Error(), "invalid DSN") {
		return fmt.Errorf("bad DSN %q: use wineventlog://<channel>", dsn)
	}
	return err
}

When it happens

Trigger: Calling ConfigureByDSN with a DSN such as `wineventlog://System` misspelled as `wineventlog: System`, `Wineventlog://System` (case matters for strings.HasPrefix... actually the check is case-sensitive on the exact prefix), or a completely different scheme like `file://System`.

Common situations: Copy-pasted DSNs from docs with wrong casing or missing `//`, generic acquisition tooling passing DSNs meant for another source type, or truncation that dropped the prefix.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• empty journalctl:// DSN
• empty loki host
• event_channel or xpath_query must be set
• empty wineventlog:// DSN
• too many arguments in DSN

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/776b0eb65fd66d58. Report an issue: GitHub.