Article ID: 979389 - View products that this article applies to.
Consider the following scenario:
This issue occurs because the custom filter that collects events does not work for a server that is running Windows Server 2003. The Wevtfwd plug-in in Windows Server 2003 uses MSXML to apply the XPATH query to the event. Therefore, MSXML is used to select the event or to reject the event.
Additionally, MSXML 6.0 is used to parse the event. MSXML 6.0 does not support either the TIMEDFF function or string comparison by using the "<=" and ">=" constructs. Therefore, the parser rejects the query when the query contains these constructs. This behavior prevents the event from being forwarded to the event subscription.
To resolve this problem so that these kinds of queries function correctly, upgrade the source server to Windows Server 2008.
Article ID: 979389 - Last Review: February 20, 2010 - Revision: 1.0