locked
Scheduled Task with custom filter not firing RRS feed

  • Question

  • I'm trying to fire a Scheduled Task when TrippLite UPS logs an Event that it's starting a shutdown. I have to use a custom query, because TrippLite uses the same Event for everything it logs. The only difference is in the Data, and I'm only interested in this specific Data: '01ups001: System shutdown initiated'

    The Event's XML is as follows (what I need to query is bolded):

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="PowerAlert Agent" /> 
      <EventID Qualifiers="0">100</EventID> 
      <Level>4</Level> 
      <Task>0</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2012-01-19T18:45:16.000000000Z" /> 
      <EventRecordID>602929</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>computer.company.local</Computer> 
      <Security /> 
      </System>
    - <EventData>
      <Data>01ups001: System shutdown initiated</Data> 
      </EventData>
      </Event>
    

    The XPath from my Event Task's Custom Filter is--

     

    <QueryList>
      <Query Id="0" Path="Application">
        <Select Path="Application">*[System[Provider[@Name='PowerAlert Agent'] and (EventID=100)]] and *[EventData[Data[1]='01ups001: System shutdown initiated']]</Select>
      </Query>
    </QueryList>
    


    The query was generated automatically except for the part I added, which is bolded.

    The Task never fires; I'd assume it's my EventData syntax. What's wrong?

    TIA


    • Edited by JRV529088 Friday, January 20, 2012 8:12 PM
    Friday, January 20, 2012 8:09 PM

Answers