-1

I can create Event Viewer Tasks to react to Event IDs, but I'm having a tough time getting the XML working to react to an event ID to a specific task. I've been testing using the filter.

The task Details tab gives me:

<Data Name="TaskName">\MoveEDIFiles</Data> 

But creating a filter with:

<Select Path="Microsoft-Windows-TaskScheduler/Operational">*[EventData[Data[@Name = "MoveEDIFiles"]]]</Select>

returns 0 results. I've tried a slash in front, single quotes, etc. I'm pretty sure I'm working in the right directory, since when I make the Boolean !=, I can see that the task has events in the filtered log.

Does anyone have any ideas? Or a site to direct me to?

2 Answers 2

0

For anyone else who might get stuck here, here is the XML to trigger off of EventIDs from a specific event:

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-TaskScheduler/">
    <Select Path="Microsoft-Windows-TaskScheduler/Operational">
     *[EventData[  (Data='\MoveEDIFiles')]]
      and 
     *[System[(EventID=101 or EvendID = 103 or EventID = 104 or EventID = 130 or EventID = 204 or EventID = 205 or EventID = 305)]]
    </Select>
  </Query>
</QueryList>
0

You need to Google for XPATH Queries. Here's another example I wrote for an Event Trigger for a Siemens OpenScape cluster. It includes a time criteria to filter events older than one day.

<QueryList>
  <Query Path="System">
    <Select Path="System">
    *[System[TimeCreated[timediff(@SystemTime) <= 86400000]]] and
    ( (*[System[Provider[@Name='Microsoft-Windows-FailoverClustering'] and (Level=1 or Level=2)]])
      or (*[System[Provider[@Name='Service Control Manager'] and (Level=4 or Level=0) and (EventID=7036)]] and *[EventData[Data[1]='HiPath ProCenter']])
    )
    </Select>
  </Query>
</QueryList>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .