| Previous | Next |
| ERROR_EVT_INVALID_CHANNEL_PATH | ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND |
ERROR_EVT_INVALID_QUERY
The Event Log query is syntactically or semantically invalid
EvtQuery and EvtSubscribe accept either a restricted XPath expression or a structured QueryList document. Windows does not implement all of XPath 1.0: selectors must address event nodes, only limited axes and functions are available, and structured queries must follow the Event Log query schema. A query that is valid in a general XML tool can still be invalid here.
Call EvtGetExtendedStatus immediately on the same thread that received the error; it can identify the parsing position and reason. Test the smallest selector first, then add predicates one at a time. Also check whether the call uses EvtQueryTolerateQueryErrors, because tolerant mode changes how per-channel failures are reported and suppresses some extended XPath diagnostics.
What to inspect
- Capture EvtGetExtendedStatus before another Event Log API call.
- Distinguish a plain XPath selector from a QueryList XML document.
- Reduce the query until the unsupported expression or path is isolated.
References
- Microsoft: querying Windows events
- Microsoft: Event Log XPath subset and result behavior
- Microsoft: EvtGetExtendedStatus
- W3C: XPath 1.0 Recommendation
Looking for a different code? Search another status or error code.