[gptalk] Re: Error on Vista Event Log 'Custom View' for GPOs with GPPES (GPOPrefs) Installed - Suggestions Anyone?

Well, I did duplicate this error in my testing. I also tried manually
modifying the filter and got the same error. So, I am guessing it's a bug,
either in the way the query is formed or a hard limit in the custom views. I
did find another reference to this issue on the Net with no resolution. Not
sure who to bug this with but I will fish around. Jerry you might be in a
better position to bug this with PSS than I am J



 

Darren

 

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Cruz, Jerome L
Sent: Thursday, April 17, 2008 10:28 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Error on Vista Event Log 'Custom View' for GPOs with
GPPES (GPOPrefs) Installed - Suggestions Anyone?

 

Any takers?

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Cruz, Jerome L
Sent: Tuesday, April 15, 2008 1:34 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Error on Vista Event Log 'Custom View' for GPOs with GPPES
(GPOPrefs) Installed - Suggestions Anyone?

 

After installing GPPEs on a Vista device, I wanted to update a Custom View
to display Event Log entries for all GPO activities including those from all
the new sources. However, I think I've run into a limitation of the
interface (or perhaps the language). Any time I add the 22nd source, the
interface fails. I can remove any 'one' entry anywhere in the list and get
the custom view created correctly.

 

As a work-around, I can create two separate custom views, but.I'd really
like them in one view.

 

Can anyone suggest `a work-around', perhaps with a manually entered filter?
Perhaps someone can come up with a filter that uses a differently ordered
XML syntax.

 

Note: The source doesn't have to be related to GPOs. just any one source
more....and Ka-Blam!

 

The error displayed is:

 

   Query Error

   !  One or more logs in the query have errors

 

   Log            Error

   Application    The specified query is invalid

   System         The specified query is invalid

   

   The events displayed are partial results.

   

                                   OK

 

========

 

The custom view is "By Source" and after adding the GPPEs, there are quite a
few new entries (e.g. Group Policy Client, Group Policy Data Sources, Group
Policy Drive Maps, etc.). There is no sub-filtering and All Event IDs are
used. The query listed below works fine at 21 sources.add anything else and
BLAM!

 

The XML version is:

<QueryList>

  <Query Id="0" Path="Application">

    <Select
Path="Application">*[System[Provider[@Name='Microsoft-Windows-Folder
Redirection' or @Name='Group Policy' or @Name='Group Policy Applications' or
@Name='Group Policy Client' or @Name='Group Policy Data Sources' or
@Name='Group Policy Device Settings' or @Name='Group Policy Drive Maps' or
@Name='Group Policy Environment' or @Name='Group Policy Files' or
@Name='Group Policy Folder Options' or @Name='Group Policy Folders' or
@Name='Group POlicy HTML View Extension' or @Name='Group Policy Ini Files'
or @Name='Group Policy Internet Settings' or @Name='Group Policy Local Users
and Groups' or @Name='Group Policy Mail Profiles' or @Name='Group Policy
Registry' or @Name='Microsoft-Windows-SoftwareRestrictionPolicies' or
@Name='Microsoft-Windows-User Profiles General' or
@Name='Microsoft-Windows-User Profiles Service' or @Name='Windows Script
Host'] and (Level=1  or Level=2 or Level=3 or Level=4 or Level=0 or
Level=5)]]</Select>

    <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Folder
Redirection' or @Name='Group Policy' or @Name='Group Policy Applications' or
@Name='Group Policy Client' or @Name='Group Policy Data Sources' or
@Name='Group Policy Device Settings' or @Name='Group Policy Drive Maps' or
@Name='Group Policy Environment' or @Name='Group Policy Files' or
@Name='Group Policy Folder Options' or @Name='Group Policy Folders' or
@Name='Group POlicy HTML View Extension' or @Name='Group Policy Ini Files'
or @Name='Group Policy Internet Settings' or @Name='Group Policy Local Users
and Groups' or @Name='Group Policy Mail Profiles' or @Name='Group Policy
Registry' or @Name='Microsoft-Windows-SoftwareRestrictionPolicies' or
@Name='Microsoft-Windows-User Profiles General' or
@Name='Microsoft-Windows-User Profiles Service' or @Name='Windows Script
Host'] and (Level=1  or Level=2 or Level=3 or Level=4 or Level=0 or
Level=5)]]</Select>

  </Query>

</QueryList>

Other related posts: