CODEWITHSUNDEEP
xmlwindowsxpathevent-viewer
Tony Thomas
Tony Thomas

Reputation: 61

'Event viewer log files save as XML' saves only 305 records

I have 1450 event logs in my event viewer.

When I filter it using dates, say from Aug 25 2014 to Aug 31 2014, it gets reduced to 774. When I try to save the log files as XML by selecting the 'Save event file as' and then selecting XML as file type, it saves only the last 305 records.

When I save it as csv, I can see all 774 events saved. When I try to save the complete list of 1450 as XML it saves all logs. The problem only occurs when a date filter is applied.

Any ideas?

Upvotes: 6

Views: 3793

Answers (2)

Igor
Igor

Reputation: 1737

There's a funny workaround:

  1. Save All Events As... and save to .evtx
  2. Open saved file
  3. Save All Events As... and save to .csv / .xml ...

(source) At least, this works for me on Windows 10 x64 version 1709.

The issue itself is clearly a bug, you can vote for them to fix it on the Feedback Hub: for normal users, for insiders.

Upvotes: 7

asb
asb

Reputation: 833

if you check the xml section in filter, we have something like

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(Level=2) and TimeCreated[timediff(@SystemTime) &lt;= 3600000]]]</Select>
  </Query>
</QueryList>

Basically this is the one applying the filter. can you check in those lines, whether your entries will be discarded if not?

Upvotes: 0

Related Questions