| Previous | Next |
| ERROR_EVT_CHANNEL_NOT_FOUND | ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL |
ERROR_EVT_MALFORMED_XML_TEXT
The QueryList XML is malformed before XPath evaluation begins
A structured Event Log query is an XML document containing Query, Select and Suppress elements. XML well-formedness is checked before the contained XPath expressions can be evaluated. Unbalanced tags, invalid entity references, broken attribute quoting or stray control characters therefore produce this code even when the intended XPath predicate would otherwise be valid.
Call EvtGetExtendedStatus immediately on the failing thread to obtain the parser detail. Validate the QueryList as XML separately, then test each Select or Suppress expression. Do not confuse this error with ERROR_EVT_INVALID_QUERY, which can report a well-formed XML document whose XPath or Event Log query semantics are unsupported.
What to inspect
- Preserve the exact generated XML and inspect its encoding.
- Validate tag nesting, entities and quoted Path attributes.
- Read EvtGetExtendedStatus before another Event Log API call overwrites it.
References
- Microsoft: structured Event Log query schema
- Microsoft: EvtGetExtendedStatus
- W3C: XML specification
- Microsoft: querying Windows events
Looking for a different code? Search another status or error code.