nats-io/nats-server · critical

could not access event log: %v

Error message

could not access event log: %v

What it means

On Windows, NewSysLogger installs the "nats-server" event source via eventlog.InstallAsEventCreate; if installation fails with anything other than the expected "registry key already exists" (i.e. the source is already installed), it panics with this message wrapping the OS error. The process cannot use the Windows event log as its logger.

Source

Thrown at logger/syslog_windows.go:43

var natsEventSource = "NATS-Server"

// SetSyslogName sets the name to use for the system log event source
func SetSyslogName(name string) {
	natsEventSource = name
}

// SysLogger logs to the windows event logger
type SysLogger struct {
	writer *eventlog.Log
	debug  bool
	trace  bool
}

// NewSysLogger creates a log using the windows event logger
func NewSysLogger(debug, trace bool) *SysLogger {
	if err := eventlog.InstallAsEventCreate(natsEventSource, eventlog.Info|eventlog.Error|eventlog.Warning); err != nil {
		if !strings.Contains(err.Error(), "registry key already exists") {
			panic(fmt.Sprintf("could not access event log: %v", err))
		}
	}

	w, err := eventlog.Open(natsEventSource)
	if err != nil {
		panic(fmt.Sprintf("could not open event log: %v", err))
	}

	return &SysLogger{
		writer: w,
		debug:  debug,
		trace:  trace,
	}
}

// NewRemoteSysLogger creates a remote event logger
func NewRemoteSysLogger(fqn string, debug, trace bool) *SysLogger {
	w, err := eventlog.OpenRemote(fqn, natsEventSource)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Run the service installation/first start as Administrator so the event source registry key can be created
2. Pre-create the event source with PowerShell: New-EventLog -LogName Application -Source nats-server
3. Or fall back to file logging instead of syslog on Windows

Example fix

// before: run service as low-privilege user -> panic
// after: pre-register source as admin, then start service
# PowerShell (admin)
New-EventLog -LogName Application -Source nats-server

// Windows, before enabling syslog logging (admin PowerShell)
try { Get-EventLog -LogName Application -Newest 1 -Source nats-server *> $null
} catch { New-EventLog -LogName Application -Source nats-server }

// Go: wrap NewSysLogger so a panic becomes a controlled fallback
func newLoggerSafe(debug, trace bool) (logger natsd.Logger, err error) {
  defer func() {
    if r := recover(); r != nil {
      err = fmt.Errorf("syslog init failed: %v", r)
    }
  }()
  logger = loggerpkg.NewSysLogger(debug, trace)
  return
}

When it happens

Trigger: Starting the Windows service with syslog logging enabled when the process lacks permission to create the registry key HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\<source>, or eventlog.InstallAsEventCreate returns a different error.

Common situations: Running the NATS service under a non-admin account that cannot write HKLM registry keys; group policy restricting event log registration; corrupt event source registration.

Related errors

• could not open event log: %v
• ErrBadCryptoStoreProvider
• ErrBadRSAHashAlgorithm
• ErrBadSigningAlgorithm
• ErrStoreRSASigningError

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/0eeb0aaad119b853. Report an issue: GitHub.