Trying using the name that you get when you right-click on the channel and go to properties, under the name field

That is the one giving me the error 50. I also realized that the file is a .etl file instead of a .evtx file, so it seems to be a special channel somehow.

I'm not too familiar with the Windows EventLog but a quick google search seems to suggest that if the channel writes to an

.etl

file, then it cannot be subscribed to, so no events will be generated that osquery can catch. Maybe though those can be queried via the

windows_eventlog

table.

I see... so it is a eventlog without events 😄 Ill give it a try to that other table then