| Previous | Next |
| ERROR_EVT_PUBLISHER_DISABLED | ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE |
ERROR_EVT_FILTER_OUT_OF_RANGE
The filter attempts to construct an out-of-range numeric value
The Event Log XPath evaluator parses numeric literals for comparisons, position tests, bit masks and functions such as timediff. A generated decimal or hexadecimal value can exceed the range accepted for the target operation, or a negative value can be used where the evaluator expects an unsigned quantity. The query may be grammatically correct but impossible to represent.
Inspect the final literal after configuration conversion, especially event IDs, keyword masks, FILETIME-related values and calculated millisecond windows. Avoid serializing sentinel values or full-width unsigned constants through a signed formatting path. Reduce the predicate to a smaller known-good number to confirm that the failure is numeric rather than structural.
What to inspect
- Log numeric literals exactly as emitted into the XPath.
- Check signedness, radix and multiplication used to build time windows.
- Keep values within the documented field or function range.
References
- Microsoft: Event Log XPath subset and result behavior
- Microsoft: EvtGetExtendedStatus
- W3C: XPath 1.0 Recommendation
Looking for a different code? Search another status or error code.