Trying using the name that you get when you right click on t

Question

Trying using the name that you get when you right click on the channel and go to properties under the name field

Juan Alvarez · Answer

That is the one giving me the error 50 I also realized that the file is a etl file instead of a evtx file so it seems to be a special channel somehow

Stefano Bonicatti · Answer

I m not too familiar with the Windows EventLog but a quick google search seems to suggest that if the channel writes to an ` etl` file then it cannot be subscribed to so no events will be generated that osquery can catch Maybe though those can be queried via the `windows eventlog` table

Stefano Bonicatti · Answer

Stefano Bonicatti · Answer

which is not evented

Juan Alvarez · Answer

I see so it is a eventlog without events smile Ill give it a try to that other table then

Juan Alvarez · Answer

It would seem that error is similar via that table ```osquery gt SELECT FROM windows eventlog where channel= Microsoft Windows DNSServer Analytical W0921 17 39 11 236779 5024 windows eventlog cpp 294 Failed to search event log for query with 50``` Maybe am i missing something Or i just hit a limitation

Juan Alvarez · Answer

According to MSFT docs error 50 is request not supported If anyone has any ideas on how to overcome this it would be greatly appreciated Also thanks < defensivedepth> and < Stefano Bonicatti> for your insights