Using XPath starts-with or contains functions to search Windows event logs
Windows Event Log supports a subset of XPath 1.0. It has only three functions: position
, Band
, timediff
.
Reference: https://docs.microsoft.com/en-us/windows/desktop/WES/consuming-events#xpath-10-limitations
If you don't mind two passes, you can always use a powershell script to re-filter the data as its -where
operator supports -like
, -match
, and -contains
:
nv.ps1
$Query = @"
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">
*[System[(EventID=20001)]]
</Select>
</Query>
</QueryList>
"@
$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = [xml]$Event.ToXml()
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name Data -Value $eventXML.Event.EventData.Data
}
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView
pause
A cmd to launch it (nv.cmd):
powershell.exe -executionpolicy bypass "& '.\nv.ps1'"
A quick powershell to search for session* in data. Even if data were an array, this should work.
get-winevent application | where { $xml = [xml]$_.toxml()
$xml.event.eventdata.data -like 'session*' } | select -first 3
ProviderName: Microsoft-Windows-Winlogon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
2/22/2020 11:05:30 AM 6000 Information The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
2/22/2020 11:05:30 AM 6003 Information The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.
2/21/2020 6:28:38 PM 6000 Information The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
$xml.event.eventdata.data # the last one
SessionEnv
If you don't need the precision, it's easier to match on the message, which the data fields often appear in.
get-winevent application | where message -match session