I have a Windows Server 2008 R2 configured to receive forwarded events from a large amount of clients (Windows 7\8.1). It receives events in the event ID range of 8000-8006 from the WLAN-Autoconfig source (the server does not have the source, but it can be added to the subscription to be able to receive from that source).
The server is installed with US english and has norwegian locale\culture. The clients are installed with NB-no norwegian and has norwegian locale\culture.
One of the first problems I encountered was that the server could not read the event properly. It gave this error:
The description for Event ID 8000 from source Microsoft-Windows-WLAN-AutoConfig cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
It was not a major problem, since the event object and content still arrived and could be used for the purpose it was gathered.
But later, when trying to write a Powershell-script to get and filter these events I came upon a few problems.
First I tried this method:
Get-WinEvent -ComputerName $ServerName -FilterHashtable @{logname = 'ForwardedEvents'; id = 8000, 8001, 8002, 8003; StartTime = $StartDate; EndTime = $EndDate } -MaxEvents 3
But this query returned no values. Removing the "StartTime" and "EndTime" from the filter made it work for some reason. Convinced that the "-FilterHashTable"-option did not work I tried using the "-FilterXML"-option, but to do that I had to create the filter in the event log to find the syntax.
I logged on to the server, opened event viewer, and created a custom view from the ForwardedEvents-log with these options:
Log = ForwardedEvents
IDs = 8000-8003
StartTime = SomeDate
EndTime = SomeDateLater
And to my suprise it returned NO EVENTS, even though I can see a lot of events that should match this filter in the event log.
Trying different filters got me these results:
Test 1
Log: ForwardedEvents
IDs: 8000-8003
StartDate: Not filled in
EndDate: Filled in
Result: Gets all results (even past EndDate)
Test 2
Log: ForwardedEvents
IDs: 8000-8003
StartDate: Filled in
EndDate: Not filled in
Result: Gets no results
Test 3
Log: ForwardedEvents
IDs: All Event IDs
StartDate: Filled in
EndDate: Not filled in
Result: Gets events with ID 111 (which I think is the subscription start notification for new clients)
Test 4
Log: ForwardedEvents
IDs: All Event IDs
StartDate: Filled in
EndDate: Filled in
Result: Gets events with ID 111 (which I think is the subscription start notification for new clients)
My question is then:
Why is this happening and how can I fix it?