nats-io/nats-server · critical

could not open event log: %v

Error message

could not open event log: %v

What it means

After (possibly skipped) installation, NewSysLogger opens the nats-server event source via eventlog.Open; if that fails, it panics with this message wrapping the OS error, since the SysLogger cannot function without an open handle to the event log.

Source

Thrown at logger/syslog_windows.go:49

// SysLogger logs to the windows event logger
type SysLogger struct {
	writer *eventlog.Log
	debug  bool
	trace  bool
}

// NewSysLogger creates a log using the windows event logger
func NewSysLogger(debug, trace bool) *SysLogger {
	if err := eventlog.InstallAsEventCreate(natsEventSource, eventlog.Info|eventlog.Error|eventlog.Warning); err != nil {
		if !strings.Contains(err.Error(), "registry key already exists") {
			panic(fmt.Sprintf("could not access event log: %v", err))
		}
	}

	w, err := eventlog.Open(natsEventSource)
	if err != nil {
		panic(fmt.Sprintf("could not open event log: %v", err))
	}

	return &SysLogger{
		writer: w,
		debug:  debug,
		trace:  trace,
	}
}

// NewRemoteSysLogger creates a remote event logger
func NewRemoteSysLogger(fqn string, debug, trace bool) *SysLogger {
	w, err := eventlog.OpenRemote(fqn, natsEventSource)
	if err != nil {
		panic(fmt.Sprintf("could not open event log: %v", err))
	}

	return &SysLogger{
		writer: w,

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Register the event source first (admin PowerShell: New-EventLog -LogName Application -Source nats-server) then restart the service
2. Verify the registry key HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\nats-server exists and is readable by the service account
3. Switch to file logging if the Windows event log is not required

Example fix

// before
w, err := eventlog.Open(natsEventSource) // fails: source missing
// after (ops fix, admin PowerShell)
New-EventLog -LogName Application -Source nats-server
// then start the service

// Windows: verify the source is registered before enabling syslog
$src='HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\nats-server'
if (-not (Test-Path $src)) { New-EventLog -LogName Application -Source nats-server }

// Go: guard against the panic and fall back to file logging
defer func() {
  if r := recover(); r != nil {
    log.Printf("event log unavailable: %v; falling back to file log", r)
  }
}()
w := loggerpkg.NewSysLogger(debug, trace)

When it happens

Trigger: eventlog.Open(natsEventSource) returns an error — typically when the event source registry key does not exist or is unreadable because installation was skipped/failed silently and Open proceeds anyway.

Common situations: Event source removed by cleanup scripts or AV tools; service moved to a machine/host where the source was never registered; registry permissions deny read access for the service account.

Related errors

• could not access event log: %v
• ErrBadCryptoStoreProvider
• ErrBadRSAHashAlgorithm
• ErrBadSigningAlgorithm
• ErrStoreRSASigningError

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/c3b37d8afd904f06. Report an issue: GitHub.