crowdsecurity/crowdsec · error

log_media="syslog" is not supported on windows

Error message

log_media="syslog" is not supported on windows

What it means

Platform stub for syslog logging on Windows. The crowdsec Windows build does not implement a syslog log medium because syslog is a Unix facility, so setupSyslogDefault (the syslog backend initializer) unconditionally returns this error instead of configuring a logger.

Source

Thrown at pkg/logging/syslog_windows.go:8

package logging

import (
	"errors"
)

func setupSyslogDefault() error {
	return errors.New(`log_media="syslog" is not supported on windows`)
}

View on GitHub (pinned to 909b515798)

Solutions

1. Change log_media in the config to 'file' (or 'stdout') on Windows.
2. If syslog forwarding is required, log to a file and ship it to syslog/rsyslog with an external agent (e.g. nxlog, filebeat, syslog-ng).
3. Run crowdsec on a Linux host if native syslog output is a hard requirement.

Example fix

// before (crowdsec.yaml)
log_media: syslog
// after
log_media: file
log_dir: C:\ProgramData\crowdsec\logs\

if runtime.GOOS == "windows" && cfg.LogMedia == "syslog" {
    return errors.New("syslog log_media unsupported on windows; use file or stdout")
}

if err := setupLogging(cfg); err != nil {
    log.Fatalf("logging setup failed: %v", err) // fallback to stdout
}

When it happens

Trigger: Setting log_media: syslog in crowdsec.yaml (or via -o syslog style configuration) and starting crowdsec on a Windows machine; the logging subsystem calls the windows-specific setupSyslogDefault which always fails.

Common situations: Copying a Linux crowdsec.yaml to a Windows server unchanged, migrating configs between hosts with different OSes, or following Linux-oriented setup guides.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• log_level must be a single value
• windows event log acquisition is only supported on Windows
• windows event log acquisition is only supported on Windows
• timestamp is not valid
• hostname is not valid

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ed89eecf53d9a3b2. Report an issue: GitHub.