Windows Event Viewer - XML Custom Filter

Posted by Frank on Server Fault See other posts from Server Fault or by Frank
Published on 2011-02-02T22:22:14Z Indexed on 2011/02/02 23:27 UTC
Read the original article Hit count: 376

Filed under:
|
<QueryList>
    <Query Id="0" Path="Application">
        <Select Path="Application">
            *[EventData[Data and (Data="Error")]]
        </Select>
    </Query>
</QueryList>

I believe the above XML custom filter would work if I wanted to check for Events where "Data" equals the word "Error". However, what I want to express is that I want the Events where Data CONTAINS the word "Error" . . . how do I express that?

I've Goggled around, but I can find no references to Regular Expression like pattern matching in the Event Viewer. XPath has "contains", but if Event Viewer will support it, I cannot seem to figure out the syntax for invoking it.

© Server Fault or respective owner

Related posts about windows-7

Related posts about eventviewer