WEVTUTIL displays more results than I want

[Simon_Weel]

I've set up a task that triggers on a Windows Defender event. This is the query:

<QueryList>
<Query Id="0" Path="Microsoft-Windows-Windows Defender/Operational">
<Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[( (EventID &gt;= 1005 and EventID &lt;= 1015) or (EventID &gt;= 1116 and EventID &lt;= 1119) or EventID=1127 or EventID=2001 or EventID=2003 or EventID=2006 or EventID=2012 or EventID=3002 or EventID=5001 or EventID=5008 or EventID=5010 or EventID=5012 or EventID=5013)]]</Select>
</Query>
</QueryList>

If one of the events occurs, it executes a cmd file to inform me by mail about the event. To filter out the particular event, I use wevtutil to retrieve the last occurrence of the event with this query:

wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /count:1 /rd:true /format:text /q:"*[System[((EventID>=1005 and EventID<=1012) or EventID=1014 or EventID=1015 or (EventID>=1116 and EventID<=1119) or EventID=1127 or EventID=2001 or EventID=2003 or EventID=2006 or EventID=2012 or EventID=3002 or EventID=5001 or EventID=5008 or EventID=5010 or EventID=5012)]]"

If I execute this on the command line, it only lists the most recent event. But when executed from TaskScheduler, instead of listing only the most recent one, it lists ALL events? I can't figure out why....

As a work-around, I added a filter for time, so the query now looks like this:

wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /count:1 /rd:true /format:text /q:"*[System[((EventID>=1005 and EventID<=1012) or EventID=1014 or EventID=1015 or (EventID>=1116 and EventID<=1119) or EventID=1127 or EventID=2001 or EventID=2003 or EventID=2006 or EventID=2012 or EventID=3002 or EventID=5001 or EventID=5008 or EventID=5010 or EventID=5012) and TimeCreated[timediff(@SystemTime) <= 300000]]]"

This should only list events of the last 5 minutes.

But I still don't know why I have to use this time filter since I already specified (/count:1) to list the most recent event only?

[Simon_Weel]

Well, filtering events by time also doesn't work when executed by Task Scheduler.

As a work-around, I ditched wevtutil in favor of Nirsoft FullEventLogView. It basically does the same thing, but in a different way. I configured it to only gather the specified events for the last 10 minutes. And this works ok. Only thing is - if the script is triggered by Task Scheduler and there's no specified event for the last 10 minutes, it creates an almost empty file and I'm sent an (empty) e-mail anyway. So I had to figure out the file size to determine if there's an actual event. And solved that by using the %~z variable, like For %%G in ("file") do set _filesize=%%~zG