Windows Event Viewer - XML Custom Filter
Posted
by
Frank
on Server Fault
See other posts from Server Fault
or by Frank
Published on 2011-02-02T22:22:14Z
Indexed on
2011/02/02
23:27 UTC
Read the original article
Hit count: 376
windows-7
|eventviewer
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">
*[EventData[Data and (Data="Error")]]
</Select>
</Query>
</QueryList>
I believe the above XML custom filter would work if I wanted to check for Events where "Data" equals the word "Error". However, what I want to express is that I want the Events where Data CONTAINS the word "Error" . . . how do I express that?
I've Goggled around, but I can find no references to Regular Expression like pattern matching in the Event Viewer. XPath has "contains", but if Event Viewer will support it, I cannot seem to figure out the syntax for invoking it.
© Server Fault or respective owner