Win Svr 2022 exception System.Diagnostics.Eventing.Reader.EventLogRecord

%3CLINGO-SUB%20id%3D%22lingo-sub-3015801%22%20slang%3D%22en-US%22%3EWin%20Svr%202022%20exception%20System.Diagnostics.Eventing.Reader.EventLogRecord%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3015801%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20seeing%20the%20following%20error%20(pasted%20below)%20when%20attempting%20to%20call%20this%20API%20to%20read%20the%20Windows%20Event%20Log.%26nbsp%3B%20I've%20searched%20and%20found%20the%20following%20link%20that%20explains%20the%20error%2C%20but%20the%20link%20refers%20to%20Windows%2011%2C%20and%20we're%20seeing%20this%20on%20Windows%20Server%202022%20(with%20all%20latest%20Windows%20Updates%20applied).%3C%2FP%3E%3CP%3EWe%20have%20an%20app%20that%20reads%20details%20from%20the%20Event%20Log%2C%20and%20this%20error%20is%20going%20to%20make%20it%20such%20that%20we%20can't%20support%20Windows%20Server%202022.%26nbsp%3B%20We%20are%20hoping%20that%20the%20fix%20that%20was%20created%20for%20Windows%2011%20might%20also%20be%20applied%20to%20Windows%20Server%202022.%26nbsp%3B%20Thanks%20in%20advance%20for%20any%20details%20you%20can%20share.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere's%20the%20link%20about%20the%20Windows%2011%20occurrence%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fdotnet%2Fruntime%2Fissues%2F60740%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ESystem.Diagnostics.Eventing.Reader.EventLogRecord%20throws%20an%20InvalidOperationException%20on%20Windows%2011%20%C2%B7%20Issue%20%2360740%20%C2%B7%20dotnet%2Fruntime%20(github.com)%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere's%20the%20exception%20details%20when%20we%20try%20to%20call%20this%20API%3A%3CBR%20%2F%3E2021-11-29%2015%3A55%3A28%2C614%20%5B130%5D%20ERROR%20-%20Remote%20error%20thrown%20on%20Windows%20Event%20Watcher%20for%3A%20Domain%20Config%3A%204%3B%20Host%3A%2010.225.64.65%3B%20Log%3A%20Application%3CBR%20%2F%3ESystem.InvalidOperationException%3A%20We%20do%20not%20have%2018%20variants%20given%20for%20the%20UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues%20flag.%20(System%20Properties)%3CBR%20%2F%3Eat%20System.Diagnostics.Eventing.Reader.NativeWrapper.EvtRenderBufferWithContextSystem(EventLogHandle%20contextHandle%2C%20EventLogHandle%20eventHandle%2C%20EvtRenderFlags%20flag%2C%20SystemProperties%20systemProperties%2C%20Int32%20SYSTEM_PROPERTY_COUNT)%3CBR%20%2F%3Eat%20System.Diagnostics.Eventing.Reader.EventLogRecord.PrepareSystemData()%3CBR%20%2F%3Eat%20System.Diagnostics.Eventing.Reader.EventLogRecord.get_Level()%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3023329%22%20slang%3D%22en-US%22%3ERe%3A%20Win%20Svr%202022%20exception%20System.Diagnostics.Eventing.Reader.EventLogRecord%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3023329%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1232865%22%20target%3D%22_blank%22%3E%40WRyan000%3C%2FA%3E%26nbsp%3B%20my%20apologies%20-%20it%20looks%20as%20if%20I%20erroneously%20logged%20this%20under%20Microsoft%20Launcher.%26nbsp%3B%20I%20am%20working%20on%20finding%20the%20correct%20place%20to%20log%20this%20issue.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

We are seeing the following error (pasted below) when attempting to call this API to read the Windows Event Log.  I've searched and found the following link that explains the error, but the link refers to Windows 11, and we're seeing this on Windows Server 2022 (with all latest Windows Updates applied).

We have an app that reads details from the Event Log, and this error is going to make it such that we can't support Windows Server 2022.  We are hoping that the fix that was created for Windows 11 might also be applied to Windows Server 2022.  Thanks in advance for any details you can share.

 

Here's the link about the Windows 11 occurrence:
System.Diagnostics.Eventing.Reader.EventLogRecord throws an InvalidOperationException on Windows 11 ...

 

Here's the exception details when we try to call this API:
2021-11-29 15:55:28,614 [130] ERROR - Remote error thrown on Windows Event Watcher for: Domain Config: 4; Host: 10.225.64.65; Log: Application
System.InvalidOperationException: We do not have 18 variants given for the UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties)
at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtRenderBufferWithContextSystem(EventLogHandle contextHandle, EventLogHandle eventHandle, EvtRenderFlags flag, SystemProperties systemProperties, Int32 SYSTEM_PROPERTY_COUNT)
at System.Diagnostics.Eventing.Reader.EventLogRecord.PrepareSystemData()
at System.Diagnostics.Eventing.Reader.EventLogRecord.get_Level()

1 Reply

@WRyan000  my apologies - it looks as if I erroneously logged this under Microsoft Launcher.  I am working on finding the correct place to log this issue.