TransWikia.com

Windows Event Filter to Trigger A Scheduled Task Using Custom Data

Server Fault Asked by Nime Cloud on November 6, 2020

I need to create a custom event filter to trigger a scheduled task to recover a hung process.

Here is the event log in XML format:

  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   
    <System>
      <Provider Name="ASP.NET 4.0.30319.0" /> 
      <EventID Qualifiers="32768">1309</EventID> 
      <Level>3</Level> 
      <Task>3</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2020-09-26T23:01:21.884208100Z" /> 
      <EventRecordID>12229</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>Web-Srv2</Computer> 
      <Security /> 
    </System>
   
     <EventData>
      <Data>3005</Data> 
      <Data>An unhandled exception has occurred.</Data> 
      <Data>30336b89c6e34e1e98387c2026f928a3</Data> 
      <Data>14</Data> 
      <Data>11</Data> 
      <Data>0</Data> 
      <Data>/LM/W3SVC/2/ROOT/Web-2-132456334351742952</Data> 
      <Data>Full</Data> 
      <Data>/WebSYS</Data> 
      <Data>WEB-SRV2</Data> 
      <Data /> 
      <Data>3772</Data> 
      <Data>w3wp.exe</Data> 
      <Data>Exception</Data> 
      <Data>CACHE_DATABASE_CONNECTIONS : cache error! at Webserver.Caching.Cache.Put(String key, Object val) at very very very long text here</Data> 
    </EventData>
      
  </Event>

What would be the custom event filter? I’ve tried this one it has triggered:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="System">*[System[(Level=3) and (EventID=1309)]]</Select>
  </Query>
</QueryList>

Then I wanted to combine error description and it didn’t work:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="System">*[System[(Level=3) and (EventID=1309)]] 
       and (Data='CACHE_DATABASE_CONNECTIONS$')
    </Select>
  </Query>
</QueryList>

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP