Trying using the name that you get when you right-...
# windows
Trying using the name that you get when you right-click on the channel and go to properties, under the name field
That is the one giving me the error 50. I also realized that the file is a .etl file instead of a .evtx file, so it seems to be a special channel somehow.
I'm not too familiar with the Windows EventLog but a quick google search seems to suggest that if the channel writes to an
file, then it cannot be subscribed to, so no events will be generated that osquery can catch. Maybe though those can be queried via the
(which is not evented)
I see... so it is a eventlog without events 😄 Ill give it a try to that other table then
It would seem that error is similar via that table:
Copy code
osquery> SELECT * FROM windows_eventlog where channel="Microsoft-Windows-DNSServer/Analytical";
W0921 17:39:11.236779  5024 windows_eventlog.cpp:294] Failed to search event log for query with 50
Maybe am i missing something? Or i just hit a limitation?
According to MSFT docs, , error 50 is request not supported. If anyone has any ideas on how to overcome this , it would be greatly appreciated! Also thanks @defensivedepth and @Stefano Bonicatti for your insights.