I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:

  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='MyDemo' or @Name='AnotherDemo'] and (Level=2 or Level=3)]][EventData[Data[contains(.,'TCP Provider, error: 0')]]]</Select>

However this is seen as an invalid query - I'm guessing the contains statement is not recognised (as it looks like a special version of the XPath syntax is being used here. Does anyone know if what I'm attempting is possible / how to go about doing this?

Thanks in advance,



You can always use a powershell script and pass the XML through powershell's where function (supports -contains -like -match):


$Query = @"
    <Query Id="0" Path="System">
      <Select Path="System">

$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
    # Convert the event to XML
    $eventXML = [xml]$Event.ToXml()
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  Data -Value $eventXML.Event.EventData.Data
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView

A cmd to launch it (nv.cmd):

powershell.exe -executionpolicy bypass "& '.\nv.ps1'"
  • Unfortunately this results in pulling a potentially huge amount of events out of Get-WinEvent, which can be a problem for professional applications where those events might be getting sent over the wire.
    – bwerks
    Jan 25 '17 at 22:25

On further investigation I came across an answer to this on Stack Overflow: https://stackoverflow.com/questions/8671194/using-xpath-starts-with-or-contains-functions-to-search-windows-event-logs

So it looks like it's not possible to do wildcard searches in the event log.

  • That said I'm going to play to see if I can hack a solution by creating a linked server to the event log data source in SQL or through custom code. . . Should I find a hack I'll let you guys know
    – JohnLBevan
    Feb 26 '13 at 18:37
  • Did you ever find a way? Mar 9 '14 at 14:51
  • @MladenMihajlovic sadly I can't recall / don't even remember why I needed to do this. I don't think I did but if my subconscious come up with any memories in the next few sleeps I'll update.
    – JohnLBevan
    Mar 9 '14 at 16:33

In powershell:

get-winevent @{logname='application';providername='mydemo','anotherdemo';level=2,3} | 
  where { [xml]$xml = $_.toxml() 
  $xml.event.eventdata.data -match 'TCP Provider, error: 0' }

If it was a whole string match, this could be reduced to:

get-winevent @{logname='application';providername='mydemo','anotherdemo';level=2,3; 
  data='TCP Provider, error: 0'}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.