Event Log > Filter Current Log > XML > where EventData contains text

Question

I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='MyDemo' or @Name='AnotherDemo'] and (Level=2 or Level=3)]][EventData[Data[contains(.,'TCP Provider, error: 0')]]]</Select>
  </Query>
</QueryList>

However this is seen as an invalid query - I'm guessing the contains statement is not recognised (as it looks like a special version of the XPath syntax is being used here. Does anyone know if what I'm attempting is possible / how to go about doing this?

Thanks in advance,

JB

score 3 · Answer 1 · edited May 23 '17 at 12:41

3

On further investigation I came across an answer to this on Stack Overflow: https://stackoverflow.com/questions/8671194/using-xpath-starts-with-or-contains-functions-to-search-windows-event-logs

So it looks like it's not possible to do wildcard searches in the event log.

edited May 23 '17 at 12:41

Community

1

answered Feb 26 '13 at 18:37

JohnLBevan

1,134
7
20
44

That said I'm going to play to see if I can hack a solution by creating a linked server to the event log data source in SQL or through custom code. . . Should I find a hack I'll let you guys know – JohnLBevan Feb 26 '13 at 18:37
Did you ever find a way? – Mladen Mihajlovic Mar 09 '14 at 14:51
@MladenMihajlovic sadly I can't recall / don't even remember why I needed to do this. I don't think I did but if my subconscious come up with any memories in the next few sleeps I'll update. – JohnLBevan Mar 09 '14 at 16:33

score 3 · Accepted Answer · answered Oct 16 '15 at 18:01

You can always use a powershell script and pass the XML through powershell's where function (supports -contains -like -match):

nv.ps1

$Query = @"
  <QueryList>
    <Query Id="0" Path="System">
      <Select Path="System">
        *[System[(EventID=20001)]]
      </Select>
    </Query>
  </QueryList>
"@

$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
    # Convert the event to XML
    $eventXML = [xml]$Event.ToXml()
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  Data -Value $eventXML.Event.EventData.Data
}
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView
pause

A cmd to launch it (nv.cmd):

powershell.exe -executionpolicy bypass "& '.\nv.ps1'"

Unfortunately this results in pulling a potentially huge amount of events out of Get-WinEvent, which can be a problem for professional applications where those events might be getting sent over the wire. — bwerks, Jan 25 '17 at 22:25

js2010 · Answer 3 · 2020-04-14T16:57:05.183

0

In powershell:

get-winevent @{logname='application';providername='mydemo','anotherdemo';level=2,3} | 
  where { [xml]$xml = $_.toxml() 
  $xml.event.eventdata.data -match 'TCP Provider, error: 0' }

If it was a whole string match, this could be reduced to:

get-winevent @{logname='application';providername='mydemo','anotherdemo';level=2,3; 
  data='TCP Provider, error: 0'}

edited Apr 14 '20 at 16:57

answered Apr 14 '20 at 16:04

js2010

143
4

Event Log > Filter Current Log > XML > where EventData contains text

3 Answers3