Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just check off everything but this results in an xml query that is too big, so I'm trying to do wildcards for path rather than specify each path. I tried this:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="*">*[System[TimeCreated[timediff(@SystemTime) &lt;= 43200000]]]</Select>
  </Query>
</QueryList>

But it errors on Path="*".

How can I make a custom view that shows all events? I found an MSDN article on consuming events that says you can use the wildcard but I guess I'm using it wrong. Thanks

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You cannot "wildcard" the path - this one is required and must contain a certain event log. You only can use wildcards in the XPath expression for a given event log. In Addition, I remember there's a limit for the number of nodes you can have, but I don't recall what exactly it was...

There's a related post here: http://stackoverflow.com/questions/8671194/using-xpath-starts-with-or-contains-functions-to-search-windows-event-logs

share|improve this answer
    
Sadly it looks like this is the correct answer. How about everything in a root folder? The Microsoft folder holds most of the entries. Is there any way to specify the microsoft folder rather than Microsoft-something1, Microsoft-something2, etc. –  test Aug 28 '13 at 0:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.