I need to create a custom event filter to trigger a scheduled task to recover a hung process.
Here is the event log in XML format:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="ASP.NET 4.0.30319.0" />
<EventID Qualifiers="32768">1309</EventID>
<Level>3</Level>
<Task>3</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-09-26T23:01:21.884208100Z" />
<EventRecordID>12229</EventRecordID>
<Channel>Application</Channel>
<Computer>Web-Srv2</Computer>
<Security />
</System>
<EventData>
<Data>3005</Data>
<Data>An unhandled exception has occurred.</Data>
<Data>30336b89c6e34e1e98387c2026f928a3</Data>
<Data>14</Data>
<Data>11</Data>
<Data>0</Data>
<Data>/LM/W3SVC/2/ROOT/Web-2-132456334351742952</Data>
<Data>Full</Data>
<Data>/WebSYS</Data>
<Data>WEB-SRV2</Data>
<Data />
<Data>3772</Data>
<Data>w3wp.exe</Data>
<Data>Exception</Data>
<Data>CACHE_DATABASE_CONNECTIONS : cache error! at Webserver.Caching.Cache.Put(String key, Object val) at very very very long text here</Data>
</EventData>
</Event>
What would be the custom event filter? I've tried this one it has triggered:
<QueryList>
<Query Id="0" Path="Application">
<Select Path="System">*[System[(Level=3) and (EventID=1309)]]</Select>
</Query>
</QueryList>
Then I wanted to combine error description and it didn't work:
<QueryList>
<Query Id="0" Path="Application">
<Select Path="System">*[System[(Level=3) and (EventID=1309)]]
and (Data='CACHE_DATABASE_CONNECTIONS$')
</Select>
</Query>
</QueryList>
0 Answers