puppetlabs/puppet · error · Puppet::Util::Windows::Error

RegisterEventSourceW failed to open Windows eventlog

Error message

RegisterEventSourceW failed to open Windows eventlog

What it means

Puppet::Util::Windows::EventLog.new calls the Win32 API RegisterEventSourceW and raises EventLogError (carrying FFI.errno) when it returns a NULL handle: Windows refused to open an event-log handle for the requested source name. On Windows, puppet routes log output to the event log, so this typically fires when the :eventlog log destination is set up.

Source

Thrown at lib/puppet/util/windows/eventlog.rb:37

  EVENTLOG_ERROR_TYPE       = 0x0001
  EVENTLOG_WARNING_TYPE     = 0x0002
  EVENTLOG_INFORMATION_TYPE = 0x0004

  # These are duplicate definitions from Puppet::Util::Windows::ApiTypes,
  # established here so this class can be standalone from Puppet, and public so
  # we can reference them in tests.
  NULL_HANDLE = 0
  WIN32_FALSE = 0

  # Register an event log handle for the application
  # @param source_name [String] the name of the event source to retrieve a handle for
  # @return [void]
  # @api public
  def initialize(source_name = 'Puppet')
    @eventlog_handle = RegisterEventSourceW(FFI::Pointer::NULL, wide_string(source_name))
    if @eventlog_handle == NULL_HANDLE
      # TRANSLATORS 'Windows' is the operating system and 'RegisterEventSourceW' is a API call and should not be translated
      raise EventLogError.new(_("RegisterEventSourceW failed to open Windows eventlog"), FFI.errno)
    end
  end

  # Close this instance's event log handle
  # @return [void]
  # @api public
  def close
    DeregisterEventSource(@eventlog_handle)
  ensure
    @eventlog_handle = nil
  end

  # Report an event to this instance's event log handle. Accepts a string to
  #   report (:data => <string>) and event type (:event_type => Integer) and id
  # (:event_id => Integer) as returned by #to_native. The additional arguments to
  # ReportEventW seen in this method aren't exposed - though ReportEventW
  # technically can accept multiple strings as well as raw binary data to log,
  # we accept a single string from Puppet::Util::Log

View on GitHub (pinned to e227c27540)

Solutions

1. Use the default source name 'Puppet' — the puppet-agent installer registers its registry keys (including EventMessageFile) for it
2. Start the Windows Event Log service (Start-Service EventLog) and retry
3. For a custom source, register it under the EventLog Application tree with an EventMessageFile pointing at a message DLL, then retry
4. Read the Windows error code from the raised EventLogError (FFI.errno) to identify the OS-level reason

Example fix

# before
log = Puppet::Util::Windows::EventLog.new('MyCustomSource')  # unregistered source

# after
log = Puppet::Util::Windows::EventLog.new('Puppet')  # installer-registered source

require 'win32/service'
Win32::Service.status('EventLog').current_state == 'running' rescue nil # best-effort pre-check

begin
  log = Puppet::Util::Windows::EventLog.new('Puppet')
rescue Puppet::Util::Windows::EventLogError => e
  # fall back to another log destination instead of dying
  Puppet::Util::Log.newdestination(:console)
end

When it happens

Trigger: Constructing EventLog.new(source_name) (or EventLog.open) where source_name has no registration under the EventLog service's Application subkey in the registry; the Windows Event Log service is stopped or unreachable; the target log channel denies the caller.

Common situations: Running puppet or a gem reusing this class with a custom source name that no installer ever registered; stripped-down Windows images or containers with the Event Log service disabled; registry entries for the source deleted or corrupted.

Related errors

• ReportEventW failed to report event to Windows eventlog
• Failed to get computer name
• Failed to get user name
• FormatMessageW could not format code %{code}
• data must be a string, not %{class_name}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/8228f275db48e979. Report an issue: GitHub.