Task Scheduler Event Trigger When It Contains Text

Question

I'm trying to create a task scheduler event that triggers when our application runs into an exception. However, I only want it to look for a certain string of text. So is there a way to craft an XML event filter that will look for part of some text using a wildcard or contains? I've tried this, but it doesn't work:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">
                 *[EventData[Data and (Data='*non-base 64 character*')]]
               </Select>
  </Query>
</QueryList>

Respondent

Answer 1

It's not exactly what you were looking for, but I had a similar requirement and I could resolve it by filtering the actual XML behind the text. When you have a look at the details tab you'll probably see the "raw" data behind the text (in the XML view), what you could use instead of a contains filter.

I wanted to filter for a event with the text: "Volume R: (\Device\HarddiskVolume42) is healthy. No action is needed." So I was looking for something like "Volume R:" AND "healthy". But when having a closer look aht the XML view, I figured out that the drive name is actually stored in an own data. So my final filter was:

    <QueryList>
      <Query Id="0" Path="System">
        <Select Path="System">
        *[System[Provider[@Name='Microsoft-Windows-Ntfs']]]
        and
        *[System[(EventID='98')]]
        and
        *[EventData[Data[@Name='DriveName'] and (Data='R:')]]
        and
        *[EventData[Data[@Name='CorruptionActionState'] and (Data='0')]]
        </Select>
      </Query>
    </QueryList>

To test the query you can always create a custom view in the event viewer.

Shebat

More syntax here: techcommunity.microsoft.com/t5/ask-the-directory-services-team/… – Scraperboard

Answer 2

Using a guide to Event Viewer > Custom Views .xml filter testing is possible to 'look for part of some text using a wildcard': https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/advanced-xml-filtering-in-the-windows-event-viewer/ba-p/399761

For example then in Task Scheduler > Task > Custom Event Filter using that working .xml to detect Windows WiFi disconnecting by filtering text using a wildcard:

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-NetworkProfile/Operational">
    <Select Path="Microsoft-Windows-NetworkProfile/Operational">* 
    and 
    *[EventData[Data[@Name='Description'] and (Data='SSID')]]
    and
    *[System[(EventID='10001')]]
    </Select>
  </Query>
</QueryList>

Where SSID is the 'text' / name of your WiFi hotspot you are trying to reconnect to automatically and

EventID 10001 disconnected
EventID 10000 connected

Action > Start a Program "C:\Program Files\Nirsoft\wifiinfoview-x64\WifiInfoView.exe" Arguments: /ConnectAP "SSID" "MACADDRESS"

Scraperboard

Answer 3

Unfortunately, based on this post, it seems this isn't possible. I've spent a good hour searching for a way and trying different things and couldn't get anything to work, so even though it looks like there's no actual solution I'm posting here because this question came up much earlier than that one did in my searching (I found it once I started using "xpath" in my searches), so hopefully it'll save others some time.

Clothes