crowdsecurity/crowdsec · error

windows event log acquisition is only supported on Windows

Error message

windows event log acquisition is only supported on Windows

What it means

The real wineventlog source implementation uses the Windows Event Log API (golang.org/x/sys/windows), which exists only on Windows. CanRun is invoked by the acquisition registry before a source is used, and on any other OS it returns this error so the source is refused.

Source

Thrown at pkg/acquisition/modules/wineventlog/source_windows.go:36

	query        string
	name         string
}

func (s *Source) GetUuid() string {
	return s.config.UniqueId
}

func (s *Source) GetMode() string {
	return s.config.Mode
}

func (*Source) GetName() string {
	return ModuleName
}

func (*Source) CanRun() error {
	if runtime.GOOS != "windows" {
		return errors.New("windows event log acquisition is only supported on Windows")
	}
	return nil
}

func (s *Source) Dump() interface{} {
	return s
}

View on GitHub (pinned to 909b515798)

Solutions

1. Run the acquisition on a Windows host
2. Remove the wineventlog source from the acquisition config on non-Windows machines
3. Split configs per-platform and only reference wineventlog in the Windows deployment

Example fix

// before (acquis.yaml on Linux)
source: wineventlog
event_channel: System
// after (remove, or use a supported source)
source: journalctl
journalctl_filter:
  - _SYSTEMD_UNIT=ssh.service

// Go: skip wineventlog sources on non-Windows hosts before loading config
if runtime.GOOS != "windows" {
    log.Info("skipping wineventlog acquisition: not supported on " + runtime.GOOS)
    return nil
}

if err := src.CanRun(); err != nil {
    log.Warnf("source %s unavailable: %s", src.GetName(), err)
    return
}

When it happens

Trigger: Loading a wineventlog acquisition config on Linux/macOS/FreeBSD, or any code path that calls Source.CanRun() on a non-Windows GOOS.

Common situations: Running crowdsec on Linux with a config that still references wineventlog (leftover from a Windows machine or a shared config); testing Windows acquisition configs in a Linux CI environment.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• windows event log acquisition is only supported on Windows
• event_channel or xpath_query must be set
• empty wineventlog:// DSN
• too many arguments in DSN
• log_level must be a single value

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7b750fa06289dd2b. Report an issue: GitHub.