7

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing around on Serverfault and Technet, including this question

I got to the point of the XML for my task triggers being:

<Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Backup"&gt;&lt;Select Path="Microsoft-Windows-Backup"&gt;*[System[Provider[@Name='Microsoft-Windows-Backup'] and EventID=14]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="eventChannel">Event/System/Channel</Value>
        <Value name="eventExinfo">Event/EventData/Data[@Name='ComponentStatus']</Value>
        <Value name="eventRecordID">Event/System/EventRecordID</Value>
        <Value name="eventSeverity">Event/System/Level</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>

Unfortunately, this produces an error (a Launch Failiure on the Action). The very similar:

<Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Backup"&gt;&lt;Select Path="Microsoft-Windows-Backup"&gt;*[System[Provider[@Name='Microsoft-Windows-Backup'] and EventID=14]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="eventChannel">Event/System/Channel</Value>
        <Value name="eventExinfo">Event/EventData/Data[@Name='BackupTemplateID']</Value>
        <Value name="eventRecordID">Event/System/EventRecordID</Value>
        <Value name="eventSeverity">Event/System/Level</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>

Works fine and emails me the "BackupTemplateID" value.

I assume this is because the contents of "ComponentStatus" is itself XML but is not part of the Task Scheduler schema.

Does anyone know any way around this? Another method of getting the data is fine if this is not possible.

I would like this because the ComponentStatus section records if backup had a problem backing up Exchange as an Application, when the Event Description only indicates that the backup completed sucessfully.

2
  • 1
    WHOA.... you are very much my hero today.. I've been working on a "backup log" script on and off for a few months and didn't even realize this option was in there. You learn something everyday! I am fiddling over here with my Exch 2010 VM and it might be due to the fact that the XML data is actually in a nested node under ComponentStatus as ComponentStatusItem. In my case, it shows 8 objects being backed up. But it isn't clear what the WriterID SIDs are referring to. Need to do more checking and get back to you. Commented Aug 20, 2011 at 1:44
  • 1
    I have found I can return the "Time" events and get a string like: <TimesList><Time Time="2011-08-22T08:11:50.243Z" /></TimesList> back. So it is not just the XML factor. Commented Aug 22, 2011 at 8:17

0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.