Smbd, please, do help me cause I`m out of fantasy...
I filter yesterday events of Microsoft-Windows-TerminalServices-Gateway/Operational log by means of Eventviewer GUI
...and take an XML-query string:
...and as far as I got, the string surrounded by <select></select> elements is an XPath string. Saving the filtered events to a file and opening it in Eventviewer helps to find out how to point an XML-query to the saved .evtx file.
returns an error in 1 and 3 variant of calling get-WinEvent , that is with -logname parameter and operational log and with -path parameter for working with .evtx file. An error message says that an XPath filter is incorrect.
The 2-nd call performs without errors and the 4-th in fact gets event records from file but throws an exception saying PoSh couldn't get information (data) about log <.evtx file> and that the path to the channel is incorrect...
What the hell is going on? What that God damned mistakes are in? Can some1 explain me why one the very same XPath string works ok within an XML-query document but generates a mistake if used with -FilterXPath parameter?