XPath query for scheduled task
I am trying to create a Windows scheduled task to notify me every time some other scheduled task in a special folder has failed. To accomplish this, I set up a scheduled task to run with an On Event trigger using a custom event filter.
I want to take some action (send an email) when the final code of the scheduled task is NOT 0 (i.e. the task is not completed). For this I have set the following as my own XML / XPath:
<QueryList>
<Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
<Select Path="Microsoft-Windows-TaskScheduler/Operational">*[System[(EventID=201)]] and *[EventData[(Data[@Name="ResultCode"]!=0)]]</Select>
</Query>
</QueryList>
* [System [(EventID = 201)]] checks if EventID of event log 201 (action completed).
* [EventData [(Data [@ Name = "ResultCode"]! = 0)]] checks if the result code was NOT 0 (Failure)
Now here is my setup. I have a subset of scheduled tasks in a subfolder in Windows Task Scheduler:
-> Task Scheduler
-> Task Scheduler Library
-> XYZ
-> Task 1
-> Task 2
-> ...
I want my new notification task to notify me of task failures in this \ XYZ \ subfolder.
Below is an example of XML output from Windows event logs that will specify the task name \ XYZ \ TaskNameHere
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-TaskScheduler" Guid="{de7b24ea-73c8-4a09-985d-5bdadcfa9017}" />
<EventID>201</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>201</Task>
<Opcode>2</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2012-04-02T13:51:41.708Z" />
<EventRecordID>385206</EventRecordID>
<Correlation ActivityID="{EC12AB2E-C049-4AF5-9FAB-4540F2B3AD83}" />
<Execution ProcessID="2580" ThreadID="4960" />
<Channel>Microsoft-Windows-TaskScheduler/Operational</Channel>
<Computer>blah@whocares.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="ActionSuccess">
<Data Name="TaskName">\XYZ\Task Name Here</Data>
<Data Name="TaskInstanceId">{EC12AB2E-C049-4AF5-9FAB-4540F2B3AD83}</Data>
<Data Name="ActionName">C:\SomeProgram.exe</Data>
<Data Name="ResultCode">3762504530</Data>
</EventData>
</Event>
Here is the XPath I tried but it doesn't work and gives me a parsing error.
<Select Path="Microsoft-Windows-TaskScheduler/Operational">*[System[(EventID=201)]] and *[EventData[(Data[@Name="ResultCode"]!=0)]] and *[EventData[(Data[@Name="TaskName" and contains(text(),'\XYZ\')])]]</Select>
Any ideas?
source to share
Just in case someone was wondering what this answered my question:
http://msdn.microsoft.com/en-us/library/cc231312%28v=prot.10%29.aspx
It turns out that the Task Scheduler does not implement all XPath functionality, only a subset of it.
source to share
I think this can be achieved with the following snippet.
string queryString = "*[System/EventID=201] and *[EventData[(Data[@Name=\"ResultCode\"]=0)]]"; ;
var query = new EventLogQuery("Microsoft-Windows-TaskScheduler/Operational", PathType.LogName, queryString);
var reader = new EventLogReader(query);
//read...
var eventRec = reader.ReadEvent();
source to share