crowdsecurity/crowdsec · error
windows event log acquisition is only supported on Windows
Error message
windows event log acquisition is only supported on Windows
What it means
The stub build of the wineventlog module (used when compiling for non-Windows platforms) implements CanRun to always fail: Windows event log acquisition is never possible outside Windows. This is the non-Windows counterpart of the real source's GOOS check.
Source
Thrown at pkg/acquisition/modules/wineventlog/stub.go:61
func (*Source) OneShot(_ context.Context, _ chan pipeline.Event) error {
return nil
}
func (*Source) GetMetrics() []prometheus.Collector {
return nil
}
func (*Source) GetAggregMetrics() []prometheus.Collector {
return nil
}
func (*Source) GetName() string {
return ModuleName
}
func (*Source) CanRun() error {
return errors.New("windows event log acquisition is only supported on Windows")
}
func (*Source) StreamingAcquisition(_ context.Context, _ chan pipeline.Event, _ *tomb.Tomb) error {
return nil
}
func (w *Source) Dump() any {
return w
}
View on GitHub (pinned to 909b515798)
Solutions
- Use a Windows build of crowdsec for wineventlog acquisition
- Remove wineventlog entries from acquisition configs on non-Windows systems
- Guard config loading per-platform in deployment automation
Defensive patterns
Strategy: validation
Validate before calling
// Go: guard before using wineventlog in cross-platform code
if runtime.GOOS != "windows" {
return fmt.Errorf("wineventlog requires a Windows build of crowdsec")
} Try / catch
if err := src.CanRun(); err != nil {
log.Warnf("wineventlog unavailable on this platform: %s", err)
return
} Prevention
- Use correct build tags when compiling code that touches wineventlog
- Test acquisition configs on the target OS, not just in CI on Linux
- Document platform requirements for Windows-only modules
When it happens
Trigger: Any attempt to register or validate a wineventlog source in a binary built for Linux/macOS, where stub.go is compiled instead of source_windows.go.
Common situations: Cross-compiling or running crowdsec on Linux while acquisition config still lists wineventlog; CI builds on Linux attempting to test Windows sources.
Understand the failure class
Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.
Related errors
- windows event log acquisition is only supported on Windows
- event_channel or xpath_query must be set
- empty wineventlog:// DSN
- too many arguments in DSN
- log_level must be a single value
AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06).
Data as JSON: /api/errors/08abc5b14b679256.
Report an issue: GitHub.