EvtSubscribe has strange behavior when using query criteria with EventRecordID.

Snshadow 0 Reputation points
2024-05-23T01:32:36.65+00:00

When using EvtSubscribe from winevt.h referencing the example code from here with query string including EventRecord ID(e.g. "Event/System[EventRecordID>10000]", it looked like it is working as expected. However, when getting future events, some event are being skipped, which can be acquired with event viewer or from powershell using "Get-EventLog". While testing it, I could find out using push subscription method does not filter future events that do not match the query criteria. It this a bug in EvtSubscribe or am I using it incorrectly?

For more details and reproducing the issue, you can refer to this github repository I created.

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,944 questions
Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,472 questions
Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
8,614 questions
{count} votes