What causes "windows.CreateEvent failed: %v" in crowdsecurity/crowdsec?

Check the process handle count (`handle.exe -p `) for a handle leak and restart crowdsec.

windows.CreateEvent failed: %v

Error message

windows.CreateEvent failed: %v

What it means

When building the Windows Event Log subscription config, if the user asked for a signal event (no explicit event file), `windows.CreateEvent` failed to create the kernel auto-reset/manual-reset event object used to signal EVT. This is a Win32 API failure surfaced during `generateConfig`, so the datasource cannot be configured.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:115

	if s.logger != nil {
		s.logger.Debugf("xpathQuery: %s", xpathQuery)
	}
	return string(xpathQuery), nil
}

func (s *Source) generateConfig(query string, live bool) (*winlog.SubscribeConfig, error) {
	var config winlog.SubscribeConfig
	var err error

	if live {
		// Create a subscription signaler.
		config.SignalEvent, err = windows.CreateEvent(
			nil, // Default security descriptor.
			1,   // Manual reset.
			1,   // Initial state is signaled.
			nil) // Optional name.
		if err != nil {
			return &config, fmt.Errorf("windows.CreateEvent failed: %v", err)
		}
		config.Flags = wevtapi.EvtSubscribeToFutureEvents
	} else {
		config.ChannelPath, err = windows.UTF16PtrFromString(s.config.EventFile)
		if err != nil {
			return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
		}
		config.Flags = wevtapi.EvtQueryFilePath | wevtapi.EvtQueryForwardDirection
	}
	config.Query, err = windows.UTF16PtrFromString(query)
	if err != nil {
		return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
	}

	return &config, nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {

View on GitHub (pinned to 909b515798)

Solutions

Check the process handle count (`handle.exe -p <pid>`) for a handle leak and restart crowdsec.
Reboot or free system resources if the machine is at kernel object limits.
Run crowdsec under a less restricted account/service context if sandboxing blocks object creation.
If signal-event mode is not required, configure `event_file`/read-from-file mode so this branch is skipped.
Report persistent failures to the OS vendor; CreateEvent with these flags failing is abnormal.

Example fix

// before (acquis.yaml, windows)
source: wineventlog
# no event_file -> signal-event path
// after
source: wineventlog
event_file: C:\Windows\System32\winevt\Logs\System.evtx  # avoid CreateEvent path

Defensive patterns

Strategy: try-catch

Validate before calling

// prefer the file path when possible so CreateEvent is skipped
if cfg.EventFile == "" && cfg.Mode == "signal" {
    // verify the process can create kernel events:
    h, err := windows.CreateEvent(nil, 1, 1, nil)
    if err != nil { return err }
    windows.CloseHandle(h)
}

Try / catch

sig, err := windows.CreateEvent(nil, 1, 1, nil)
if err != nil {
    return fmt.Errorf("windows.CreateEvent failed: %v", err)
}
defer windows.CloseHandle(sig) // avoid handle leaks causing later failures

Prevention

Close event handles you create to avoid handle exhaustion
Avoid unnecessary signal-event mode; read from .evtx files when possible
Run the service with a normal, unrestricted account
Monitor process handle counts

When it happens

Trigger: `windows.CreateEvent(nil, 1, 1, nil)` returns a handle error: the Win32 event object could not be created — essentially only on severe system-resource exhaustion (handle/memory limits) or an invalid security descriptor argument.

Common situations: Extremely rare; seen when the process is leaking handles and hits the per-process handle limit, or running in a heavily restricted service sandbox/job object; misconfigured datasource that requests signal-event mode unintentionally.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/88154d6a99844a8b. Report an issue: GitHub.