crowdsecurity/crowdsec · error

too many arguments in DSN

Error message

too many arguments in DSN

What it means

The wineventlog DSN format allows at most two '?'-separated segments: the event log file/channel and one query-string of parameters. More than one '?' produces more than two args, indicating a malformed DSN.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:203

func (s *Source) ConfigureByDSN(ctx context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	if !strings.HasPrefix(dsn, "wineventlog://") {
		return fmt.Errorf("invalid DSN %s for wineventlog source, must start with wineventlog://", dsn)
	}

	s.logger = logger
	s.config = Configuration{}

	dsn = strings.TrimPrefix(dsn, "wineventlog://")

	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty wineventlog:// DSN")
	}

	if len(args) > 2 {
		return errors.New("too many arguments in DSN")
	}

	s.config.EventFile = args[0]

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {
			return fmt.Errorf("failed to parse DSN parameters: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("log_level must be a single value")
				}
				lvl, err := log.ParseLevel(value[0])
				if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Join multiple parameters in one query string: wineventlog://Security?log_level=info&event_level=error
2. URL-encode any literal '?' inside parameter values (%3F)
3. Ensure the XPath query passed in the DSN does not contain a raw '?'

Example fix

// before
wineventlog://Security?log_level=info?event_level=error
// after
wineventlog://Security?log_level=info&event_level=error

// Go: ensure only one '?' in the DSN
if strings.Count(dsn, "?") > 1 {
    return fmt.Errorf("wineventlog DSN allows at most one '?' separator; join params with '&'")
}

if err := src.ConfigureByDSN(dsn); err != nil {
    return fmt.Errorf("malformed wineventlog DSN %q: %w", dsn, err)
}

When it happens

Trigger: Calling ConfigureByDSN with a DSN containing multiple '?' characters, e.g. wineventlog://Security?log_level=info?event_level=error, or an unencoded '?' inside a parameter value.

Common situations: Users appending options as extra '?key=value' pairs instead of joining them with '&' inside a single query string; pasting a full URL that itself contains '?' into the DSN; XPath queries with unescaped '?' characters.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• empty wineventlog:// DSN
• log_level must be a single value
• event_level must be a single value
• event_channel or xpath_query must be set
• windows event log acquisition is only supported on Windows

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6a51240a5a1bf0ae. Report an issue: GitHub.