crowdsecurity/crowdsec · error

wevtapi.EvtNext failed: %v

Error message

wevtapi.EvtNext failed: %v

What it means

getXMLEvents fetches a batch of event handles from an event query or subscription using wevtapi.EvtNext, with a 2000 ms timeout. This error is returned when EvtNext fails with anything other than windows.ERROR_NO_MORE_ITEMS (which signals normal end-of-results and is passed through). It wraps the raw Windows API error, so the cause can be an RPC failure, a closed/corrupted channel, invalid handles, or timeout.

Source

Thrown at pkg/acquisition/modules/wineventlog/run_windows.go:41

const localMachine = 0

// This is lifted from winops/winlog, but we only want to render the basic XML string, we don't need the extra fluff
func (s *Source) getXMLEvents(config *winlog.SubscribeConfig, publisherCache map[string]windows.Handle, resultSet windows.Handle, maxEvents int) ([]string, error) {
	events := make([]windows.Handle, maxEvents)
	var returned uint32

	// Get handles to events from the result set.
	err := wevtapi.EvtNext(
		resultSet,           // Handle to query or subscription result set.
		uint32(len(events)), // The number of events to attempt to retrieve.
		&events[0],          // Pointer to the array of event handles.
		2000,                // Timeout in milliseconds to wait.
		0,                   // Reserved. Must be zero.
		&returned)           // The number of handles in the array that are set by the API.
	if errors.Is(err, windows.ERROR_NO_MORE_ITEMS) {
		return nil, err
	} else if err != nil {
		return nil, fmt.Errorf("wevtapi.EvtNext failed: %v", err)
	}

	// Event handles must be closed after they are returned by EvtNext whether or not we use them.
	defer func() {
		for _, event := range events[:returned] {
			winlog.Close(event)
		}
	}()

	// Render events.
	var renderedEvents []string
	for _, event := range events[:returned] {
		// Render the basic XML representation of the event.
		fragment, err := winlog.RenderFragment(event, wevtapi.EvtRenderEventXml)
		if err != nil {
			s.logger.Errorf("Failed to render event with RenderFragment, skipping: %v", err)
			continue
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the Windows Event Log service: `Get-Service eventlog` / `net start eventlog`, and ensure it is running.
2. Read the wrapped Win32 error to identify the cause (ERROR_ACCESS_DENIED → run as admin or grant log access; RPC errors → check remote host/firewall).
3. Verify the channel still exists: `wevtutil el` — if the channel was deleted or renamed, fix the event_channel config.
4. For remote collection, confirm network connectivity and that Remote Event Log Management is enabled in the firewall.
5. If errors are transient/timeouts, add retry/backoff around OneShot calls; for the streaming path, check crowdsec logs for the failing query and restart the source.

Example fix

// before (caller)
events, err := src.OneShot(ctx)
if err != nil { return err }
// after (caller)
events, err := src.OneShot(ctx)
if errors.Is(err, windows.ERROR_NO_MORE_ITEMS) { return nil }
if err != nil {
	logger.Warnf("evt fetch failed, retrying: %v", err)
	time.Sleep(time.Second)
	events, err = src.OneShot(ctx)
	if err != nil { return err }
}

svc, err := exec.Command("powershell", "-c", "Get-Service eventlog").Output()
// verify eventlog service is Running and channel exists via `wevtutil gl <channel>` before opening the source

events, err := src.OneShot(ctx)
if errors.Is(err, windows.ERROR_NO_MORE_ITEMS) { return nil } // normal end of stream
if err != nil {
	if retryable(err) { // RPC/timeout style errors
		time.Sleep(backoff)
		events, err = src.OneShot(ctx)
	}
	if err != nil { return err }
}

When it happens

Trigger: Called by getEvents (the streaming loop) and OneShot when EvtNext returns an unexpected Win32 error: the Event Log service (wevtsvc) is stopped, the query handle became invalid, the channel was deleted/cleared mid-read, RPC to a remote log failed, or the 2-second wait timed out.

Common situations: Windows Event Log service not running or crashed, reading a channel that was cleared (`wevtutil cl`), remote event log collection where the remote host is unreachable or access is denied, or system resource exhaustion preventing handle creation.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• EvtQuery failed: %v
• getXMLEvents failed: %v
• error connecting to websocket
• invalid log level
• event_channel and xpath_query are mutually exclusive

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ea908ee80de47138. Report an issue: GitHub.