XML query of event log not working

Question

I have been looking for a query to act as a trigger in the Task Scheduler. I want to restart my VPN if it RASClient ends (EventID 20226) for any reason except code 631 (The port was closed by the user)

I have found a query that Presser provided

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='RasClient'] and (EventID=20226)]] and *[EventData[Data[4]='829' or '629']]</Select>
  </Query>
</QueryList>

and while it finds terminations (20226) it only finds those caused by code 829 or 629. However, there are dozens or possible error codes, and adding each one linked with "or" makes this model unwieldy.

I tried a not equal command ( != ) but could not get it to work. I even found a post where a Owen recommended streamlining the above query by using

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='RasClient'] and (EventID=20226 or EventID=20227)]] and *[EventData[Data[4]!='631']]</Select>
  </Query>
</QueryList>

However, this query returns NO results, so I believe there must be a logic flaw in there somewhere.

The second query is closer to what I am looking for as it includes EventID 20226 and 20227 but I would still like to exclude code 631 from the query.

For now what I am using is

<QueryList>
      <Query Id="0" Path="Application">
        <Select Path="Application">*[System[Provider[@Name='RasClient'] and (EventID=20226 or EventID=20227)]]</Select>
      </Query>
</QueryList>

Of course this still restarts my VPN even if I disconnect, but it is a temporary work-around, until I find a better query. For now, if I manually disconnect, I use Ctrl-C to break the script from reconnecting.

Does anyone have any suggestions on how to write this query to include any EventID20226 that has any error code other than 631?

Answer 1

I think I found the answer. Instead of using a “not equal to” (!=) comparison, simply accept all events with EventID=20226 or EventID=20227. Then suppress those events that have EventID=20226 with a data element of '631'.

This works well since there are about 150 error codes associated with rasClient (https://support.microsoft.com/en-us/kb/163111)

Here is the query I came up with. Testing it in the event viewer; it seems to meet all the necessary criteria.

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='RasClient'] and (EventID=20226 or EventID=20227)]] </Select>
    <Suppress Path="Application">*[System[Provider[@Name='RasClient'] and (Level=4 or Level=0) and (EventID=20226)]]and *[EventData[Data[4]='631']]
</Suppress>
  </Query>
</QueryList>