What causes "could not open event log: %v" in nats-io/nats-server?

could not open event log

Error message

could not open event log: %v

What it means

After (possibly skipped) installation, NewSysLogger opens the nats-server event source via eventlog.Open; if that fails, it panics with this message wrapping the OS error, since the SysLogger cannot function without an open handle to the event log.

Solutions

Register the event source first (admin PowerShell: New-EventLog -LogName Application -Source nats-server) then restart the service
Verify the registry key HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\nats-server exists and is readable by the service account
Switch to file logging if the Windows event log is not required

Example fix

// before
w, err := eventlog.Open(natsEventSource) // fails: source missing
// after (ops fix, admin PowerShell)
New-EventLog -LogName Application -Source nats-server
// then start the service

Defensive patterns

Strategy: try-catch

Validate before calling

// Windows: verify the source is registered before enabling syslog
$src='HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\nats-server'
if (-not (Test-Path $src)) { New-EventLog -LogName Application -Source nats-server }

Try / catch

// Go: guard against the panic and fall back to file logging
defer func() {
  if r := recover(); r != nil {
    log.Printf("event log unavailable: %v; falling back to file log", r)
  }
}()
w := loggerpkg.NewSysLogger(debug, trace)

Prevention

Ensure the event source exists before the service starts (deployment script creates it)
Protect the event source registry key from cleanup scripts and AV tampering
Grant the service account read access to the event log registry key

When it happens

Trigger: eventlog.Open(natsEventSource) returns an error — typically when the event source registry key does not exist or is unreadable because installation was skipped/failed silently and Open proceeds anyway.

Common situations: Event source removed by cleanup scripts or AV tools; service moved to a machine/host where the source was never registered; registry permissions deny read access for the service account.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/c3b37d8afd904f06. Report an issue: GitHub.

Appendix: source

Thrown at logger/syslog_windows.go:49

// SysLogger logs to the windows event logger
type SysLogger struct {
	writer *eventlog.Log
	debug  bool
	trace  bool
}

// NewSysLogger creates a log using the windows event logger
func NewSysLogger(debug, trace bool) *SysLogger {
	if err := eventlog.InstallAsEventCreate(natsEventSource, eventlog.Info|eventlog.Error|eventlog.Warning); err != nil {
		if !strings.Contains(err.Error(), "registry key already exists") {
			panic(fmt.Sprintf("could not access event log: %v", err))
		}
	}

	w, err := eventlog.Open(natsEventSource)
	if err != nil {
		panic(fmt.Sprintf("could not open event log: %v", err))
	}

	return &SysLogger{
		writer: w,
		debug:  debug,
		trace:  trace,
	}
}

// NewRemoteSysLogger creates a remote event logger
func NewRemoteSysLogger(fqn string, debug, trace bool) *SysLogger {
	w, err := eventlog.OpenRemote(fqn, natsEventSource)
	if err != nil {
		panic(fmt.Sprintf("could not open event log: %v", err))
	}

	return &SysLogger{
		writer: w,

View on GitHub (pinned to 3a66a489d2)