xpath event filter not working

Question

I am attempting to create a XPath Event Filter to Execute a scheduled task upon completion of another one. My XPath looks like this

<QueryList>
    <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
        <Select Path="Microsoft-Windows-TaskScheduler/Operational">
            *[System[Provider[@Name='Microsoft-Windows-TaskScheduler'] and Task = 102 and (EventID=102)]]
        </Select>
        <Select Path="Microsoft-Windows-TaskScheduler/Operational">
            *[EventData[Data[@Name=’TaskName’] and (Data=’\Visual Studio Dark Theme′)]]
        </Select>
        <Select Path="OAlerts">
            *[System[Provider[@Name='Microsoft-Windows-TaskScheduler'] and Task = 102 and (EventID=102)]]
        </Select>
    </Query>
</QueryList>

The Event I am trying to find is this one.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
        <Provider Name="Microsoft-Windows-TaskScheduler" Guid="{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}" /> 
        <EventID>102</EventID> 
        <Version>0</Version> 
        <Level>4</Level> 
        <Task>102</Task> 
        <Opcode>2</Opcode> 
        <Keywords>0x8000000000000001</Keywords> 
        <TimeCreated SystemTime="2016-07-20T16:14:08.280937900Z" /> 
        <EventRecordID>13055</EventRecordID> 
        <Correlation ActivityID="{0A2EAFD2-B40E-4C60-A099-80C020CBA547}" /> 
        <Execution ProcessID="1164" ThreadID="6464" /> 
        <Channel>Microsoft-Windows-TaskScheduler/Operational</Channel> 
        <Computer>GXLT012660.CoyoteLogistics.local</Computer> 
        <Security UserID="S-1-5-18" /> 
    </System>
    <EventData Name="TaskSuccessEvent">
        <Data Name="TaskName">\Visual Studio Dark Theme</Data> 
        <Data Name="UserContext">COYOTELOGISTICS\benjamin.drolet</Data> 
        <Data Name="InstanceId">{0A2EAFD2-B40E-4C60-A099-80C020CBA547}</Data> 
    </EventData>
</Event>

Whenever Creating a custom filter on Event Viewer with the XPath query above, I get the following error.

One of more logs in the query have errors. Log: Microsoft-Windows-TaskScheduler/Operational Error: The specified query is invalid.

Stephen Stephen · Accepted Answer · 2017-04-18T09:40:26

This is rather old, so I hope you have found the answer since then, but I encountered the same problem.

What I found is that I used the wrong kind of single quotes in the query, hardly distinguishable in the editor, but when I see in your question *[EventData[Data[@Name=’TaskName’] and (Data=’\Visual Studio Dark Theme′)]], I suspect the issue is the same.

Try *[EventData[Data[@Name='TaskName'] and (Data='\Visual Studio Dark Theme')]]

xpath event filter not working

1 Answers