1

I hope you can help, sometimes a backup task will fail, usually a transient VSS error, and re-running the backup will normally complete successfully. What I am trying to do is use the event filter within Task Schdeuler to trigger the backup to restart. I've had no problem doing this from just targeting the EventID (5635) but I have a number of backup jobs running so I need to be more specific which is where I'm coming up against a brick wall.

The XML event data looks like this:

<EventData>
<Data>
Backup job Server Backup 1 completed with warnings. Major Warning: One or more Hyper-V guests have reported errors that could result in an incomplete backup. Check each guest's event log and review any errors reported. Major Warning: Volume Shadow Copy Error 0x800423f4 - writer error: non retryable Destination: Local hard drive Bytes: 7191744309979 Start time: 01/01/2021 22:00:02 End time: 01/01/2021 22:12:25 Duration: 00:12:23.0745879 Job Execution ID: 1.679
</Data> 
</EventData>

I am trying to get the event filter to pick up on the "Server backup 1" text and I'm using the following query:

<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[System[Provider[@Name='BackupAssist'] and (Level=3) and (EventID=5635) and *[EventData[Data[1]='Server Backup 1']]]]</Select>
</Query>
</QueryList>

However this doesn't trigger when the event is recorded. I am suspecting it's a wildcard string issue but I am not sure.

Any help gratefully received Rob

Improve this question

1 Answer 1

Reset to default
0

This is not implemented, the documentation shows you the limitations and lists the three functions that you can use:

[...] Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. [...]

The position function, and its shorthand array reference, is supported (on leaf nodes only).
The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false.
The timediff function is supported.[...]

You can create a scheduled task with the Event ID trigger to start a remediation script in which you can perform additional verification to determine if the script should proceed further.

Improve this answer
1
  • Thanks for that, and I hadn't thought of triggering another script to do the query...so thanks again. Commented Jan 5, 2021 at 12:23

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.