| Previous | Next |
| ERROR_EVT_FILTER_INVARG | ERROR_EVT_FILTER_INVTYPE |
ERROR_EVT_FILTER_INVTEST
The Event Log XPath step contains an invalid test
Each location step in an Event Log selector must identify an element or attribute, or apply a predicate that evaluates an algebraic condition for nodes from the preceding step. An empty step, unsupported node test, misplaced comparison or predicate detached from an element path cannot be evaluated by the restricted parser.
Check separators, wildcard placement and bracket ownership. Build the query from a known-good event-root selector, add one child step, and only then add its predicate. Use the actual Event XML names; Event Viewer display labels are not node names. Extended status is useful because the generic code does not identify which step was malformed.
What to inspect
- Render a sample event as XML and copy its real element names.
- Attach each predicate to the element set it filters.
- Add steps incrementally until the invalid test is isolated.
References
- Microsoft: Event Log XPath subset and result behavior
- Microsoft: EvtGetExtendedStatus
- W3C: XPath 1.0 Recommendation
Looking for a different code? Search another status or error code.