Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing around on Serverfault and Technet, including this question

I got to the point of the XML for my task triggers being:

<Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Backup"&gt;&lt;Select Path="Microsoft-Windows-Backup"&gt;*[System[Provider[@Name='Microsoft-Windows-Backup'] and EventID=14]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="eventChannel">Event/System/Channel</Value>
        <Value name="eventExinfo">Event/EventData/Data[@Name='ComponentStatus']</Value>
        <Value name="eventRecordID">Event/System/EventRecordID</Value>
        <Value name="eventSeverity">Event/System/Level</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>

Unfortunately, this produces an error (a Launch Failiure on the Action). The very similar:

<Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Backup"&gt;&lt;Select Path="Microsoft-Windows-Backup"&gt;*[System[Provider[@Name='Microsoft-Windows-Backup'] and EventID=14]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="eventChannel">Event/System/Channel</Value>
        <Value name="eventExinfo">Event/EventData/Data[@Name='BackupTemplateID']</Value>
        <Value name="eventRecordID">Event/System/EventRecordID</Value>
        <Value name="eventSeverity">Event/System/Level</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>

Works fine and emails me the "BackupTemplateID" value.

I assume this is because the contents of "ComponentStatus" is itself XML but is not part of the Task Scheduler schema.

Does anyone know any way around this? Another method of getting the data is fine if this is not possible.

I would like this because the ComponentStatus section records if backup had a problem backing up Exchange as an Application, when the Event Description only indicates that the backup completed sucessfully.

share|improve this question
    
WHOA.... you are very much my hero today.. I've been working on a "backup log" script on and off for a few months and didn't even realize this option was in there. You learn something everyday! I am fiddling over here with my Exch 2010 VM and it might be due to the fact that the XML data is actually in a nested node under ComponentStatus as ComponentStatusItem. In my case, it shows 8 objects being backed up. But it isn't clear what the WriterID SIDs are referring to. Need to do more checking and get back to you. –  MikeAWood Aug 20 '11 at 1:44
    
I have found I can return the "Time" events and get a string like: <TimesList><Time Time="2011-08-22T08:11:50.243Z" /></TimesList> back. So it is not just the XML factor. –  Dominic Fitzpatrick Aug 22 '11 at 8:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.