Blank Windows Event Details in Managed Workplace

  1. Last updated
    Feb 13, 2020
  2. Save as PDF

From time to time, Managed Workplace will report back blank details from Windows Event alerts. This is not a bug with Managed Workplace, but rather it is one in WMI and how to collects the data from Event Viewer, parses that data, and then sends it to Managed Workplace. For example, you might see the following alert.

Blank Event.png

In the Event Viewer, however, you might see something similar to this (note: this is the test put into application from the below section, so the event ID might not match). This is because in the Event Viewer there is a %% with a string of numbers following it. That %% does not parse well within WMI and thus does not transfer the data to Managed Workplace.

Event Viewer.png

To see an example of this, open the Command Prompt as Admin and enter in the following command. This will create an event with the %% issue:

eventcreate /L Application /T Error /ID 100 /D "test: %%12345678" /SO "Test"

After that runs, we then run the following command to send that information through WMI:

wmic ntevent where (LogFile='Application' and EventCode='100') get * /format:list

The following screenshot will show this in application:

Blank Event Test.png