Accessing results of event viewer value query in task scheduler action

2

I'm trying to implement a scheduled task in Windows 10. The task is triggered by multiple events, I want to pass the event ID that triggered the task to the action.

So I have the following value query:

      <ValueQueries>
         <Value name="eventID">Event/System/EventID</Value>
      </ValueQueries>

And the arguments in the ExecAction:

<Arguments>--event $(eventID)</Arguments>

But when the task is triggered, I get an error code: 2147942409

Translating that to Hex is 0x80070009.

Windows error? "Storage control block address is invalid" ?

I don't understand what it's trying to tell me?

The task executes fine without the $(eventID) on the command line (just doesn't do anything useful).

xml
windows
task
scheduler
asked on Stack Overflow Nov 22, 2018 by mikb

1 Answer

2

I found the answer, eventually - and been travelling a while, and not working on this project.

The script actually asks the task scheduler to trigger on two events, and had a separate trigger definition for each event id in the trigger collection. That works. What doesn't work is using the same name attribute for the value query in each definition. That's what was generating the error - despite it being valid XML, I was effectively declaring the same variable twice, so the scheduler decided to punish me by throwing a meaningless error.

The solution was to fold the two trigger definitions into one, which means only one value query is defined:

    <EventTrigger>
  <Enabled>true</Enabled>
  <Subscription>&lt;QueryList&gt;&lt;Query Id="0"&gt;&lt;Select Path="Microsoft-Windows-NetworkProfile/Operational"&gt;*[System[(EventID=10000) or (EventID=10001)]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
  <ValueQueries>
    <Value name="eventID">Event/System/EventID</Value>
  </ValueQueries>
</EventTrigger>

All happy now, and prototype delivered to the client!

answered on Stack Overflow Nov 27, 2018 by mikb

User contributions licensed under CC BY-SA 3.0