Blank Windows Event Details in Managed Workplace
- Last updated
From time to time, Managed Workplace will report back blank details from Windows Event alerts. This is not a bug with Managed Workplace, but rather it is one in WMI and how to collects the data from Event Viewer, parses that data, and then sends it to Managed Workplace. For example, you might see the following alert.
In the Event Viewer, however, you might see something similar to this (note: this is the test put into application from the below section, so the event ID might not match). This is because in the Event Viewer there is a %% with a string of numbers following it. That %% does not parse well within WMI and thus does not transfer the data to Managed Workplace.
To see an example of this, open the Command Prompt as Admin and enter in the following command. This will create an event with the %% issue:
eventcreate /L Application /T Error /ID 100 /D "test: %%12345678" /SO "Test"
After that runs, we then run the following command to send that information through WMI:
wmic ntevent where (LogFile='Application' and EventCode='100') get * /format:list
The following screenshot will show this in application:
