crowdsecurity/crowdsec · error

windows.UTF16PtrFromString failed: %v

Error message

windows.UTF16PtrFromString failed: %v

What it means

`windows.UTF16PtrFromString` failed to convert the configured event file path (or the XPath query string) into a NUL-terminated UTF-16 pointer required by the EVT Win32 API. This happens when the string contains embedded NUL bytes or, for paths, is invalid for conversion — an invalid input configuration rather than an environment failure.

Source

Thrown at pkg/acquisition/modules/wineventlog/config_windows.go:121

func (s *Source) generateConfig(query string, live bool) (*winlog.SubscribeConfig, error) {
	var config winlog.SubscribeConfig
	var err error

	if live {
		// Create a subscription signaler.
		config.SignalEvent, err = windows.CreateEvent(
			nil, // Default security descriptor.
			1,   // Manual reset.
			1,   // Initial state is signaled.
			nil) // Optional name.
		if err != nil {
			return &config, fmt.Errorf("windows.CreateEvent failed: %v", err)
		}
		config.Flags = wevtapi.EvtSubscribeToFutureEvents
	} else {
		config.ChannelPath, err = windows.UTF16PtrFromString(s.config.EventFile)
		if err != nil {
			return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
		}
		config.Flags = wevtapi.EvtQueryFilePath | wevtapi.EvtQueryForwardDirection
	}
	config.Query, err = windows.UTF16PtrFromString(query)
	if err != nil {
		return &config, fmt.Errorf("windows.UTF16PtrFromString failed: %v", err)
	}

	return &config, nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse wineventlog configuration: %s", yaml.FormatError(err, false, false))
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the `event_file` value in the acquisition yaml for invisible/control characters and rewrite it cleanly.
2. Use a plain forward- or back-slash path without quotes artifacts, e.g. `event_file: C:\Windows\System32\winevt\Logs\System.evtx`.
3. Re-encode the yaml as UTF-8 without BOM/control bytes and reload.
4. If the query string triggers it, simplify/rewrite the XPath query in the config.
5. Trim any trailing whitespace/`\0` if the value is templated from another system.

Example fix

// before
event_file: "C:\\Logs\\sys.evtx\x00"
// after
event_file: C:\Windows\System32\winevt\Logs\System.evtx

func validWinString(s string) bool {
    return s != "" && !strings.ContainsRune(s, '\x00') && utf8.ValidString(s)
}
// call before Configure: validWinString(cfg.EventFile)

p, err := windows.UTF16PtrFromString(path)
if err != nil {
    return fmt.Errorf("invalid event_file path %q: %v", path, err)
}

When it happens

Trigger: `s.config.EventFile` (from the acquis yaml `event_file`) or the generated XPath `query` contains a NUL character (`\x00`) or is otherwise not convertible by `UTF16PtrFromString`; a corrupted config value with control characters produces this in `generateConfig`.

Common situations: Copy-pasting a Windows path with invisible control characters into the acquisition yaml; generating the path programmatically from a value that already includes a NUL terminator; encoding issues in the yaml that inject stray bytes into the path.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• event_channel or xpath_query must be set
• invalid log level
• event_channel and xpath_query are mutually exclusive
• empty wineventlog:// DSN
• too many arguments in DSN

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/1c74e13791fe9cf4. Report an issue: GitHub.