Ambiguity in Windows XML Event Logs

Anish Jain 1 Reputation point
2021-09-01T06:47:30.963+00:00

Hi Team,

We are working on extracting keys and values from XML event logs for some data analytics applications. While working on designing the parser we came across a different behavior that is causing an issue defining the rules for the parser.

Consider an example event below:

<Event xmlns='http://xyz.pqr.abc/win/2004/08/events/event'>

<System>

<TimeCreated SystemTime='2021-03-11 10:06:17Z' />

</System>

<EventData>

<Data Name='WorkstationName'></Data>

<Data Name='TransmittedServices'>dummyvalue</Data>

</EventData>

</Event>

I have removed other irrelevant fields from the above event.

So what we expect is

Expected: Event.System.TimeCreated.SystemTime = 2021-03-11 10:06:17Z
Actual: Event.System.TimeCreated.SystemTime = 2021-03-11 10:06:17Z

and for (ambiguity is present here)

Expected: EventData.Data.Name.WorkstationName = <empty value>
Actual: EventData.Data.Name = WorkstationName

and for

Expected: EventData.Data.Name.TransmittedServices = dummyvalue
Actual: EventData.Data.Name.TransmittedServices = dummyvalue (since it has value)

But if we define a specific rule then this would not result in what we want, as you can see above.

Is there any way that can help us resolve this issue or any windows document which can define the rules for the format of the event?

Please suggest if there is some way to move ahead here.

Thank You

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,547 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 39,471 Reputation points
    2021-09-02T10:23:27.387+00:00

    Hello,

    Thank you for your question..

    As far I know you can create custom Query or View using XPath to fetch the event viewer data.

    Please have look on below Microsoft article which may help you further.

    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata

    https://devblogs.microsoft.com/scripting/data-mine-the-windows-event-log-by-using-powershell-and-xml/

    https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/advanced-xml-filtering-in-the-windows-event-viewer/ba-p/399761

    If the reply was helpful, please don’t forget to upvote or accept as answer.

    1 person found this answer helpful.