FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Add limit check in Get-WinEvent by iSazonov · Pull Request #10648 · PowerShell/PowerShell · GitHub

Add limit check in Get-WinEvent - #10648

Merged
Ilya (iSazonov) merged 2 commits into
PowerShell:masterfrom
iSazonov:get-winevent-invalid-data
Oct 23, 2019
Merged

Add limit check in Get-WinEvent#10648
Ilya (iSazonov) merged 2 commits into
PowerShell:masterfrom
iSazonov:get-winevent-invalid-data

Conversation

Ilya (iSazonov) commented Sep 30, 2019
edited
Loading

Copy link
Copy Markdown
Collaborator

PR Summary

Fix #10637

Add check and terminating throw if filter returns logs more 256.

Error message after the change:

Get-WinEvent : Log count (441) is exceeded Windows Event Log API limit (256). Adjust filter to return less log names.
At line:1 char:1
+ Get-WinEvent
+ ~~~~~~~~~~~~
+ CategoryInfo          : LimitsExceeded: (:) [Get-WinEvent], Exception
+ FullyQualifiedErrorId : LogCountLimitExceeded,Microsoft.PowerShell.Commands.GetWinEventCommand

PR Context

ReadEvent() returns the error if our query contains number of logs more then 256.
I did not find that 256 limit is documented. Nevertheless, we can verify that the filter returns more 256 log names and issue an appropriate message.
The design was ok for Windows XP with 3 logs, it worked on Windows 7 with 183 logs but now Windows 10 has over 400 logs and the query is no longer even executed (with exception "Invalid data").

PR Checklist

Ilya (iSazonov) added the CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log label Sep 30, 2019
Ilya (iSazonov) added this to the 7.0.0-preview.5 milestone Sep 30, 2019
Ilya (iSazonov) self-assigned this Sep 30, 2019
Ilya (iSazonov) force-pushed the get-winevent-invalid-data branch from c7ae6d2 to 6dfb17b Compare October 21, 2019 12:13
Ilya (iSazonov) merged commit be54be4 into PowerShell:master Oct 23, 2019
Ilya (iSazonov) deleted the get-winevent-invalid-data branch October 23, 2019 17:29

Copy link
Copy Markdown

🎉v7.0.0-preview.6 has been released which incorporates this pull request.:tada:

Handy links:

Copy link
Copy Markdown

The 256 logname limit has been added to the get-winevent docs. No wonder I can't select all the logs in Event Viewer when making a custom view!

jszabo98 commented Mar 5, 2020
edited
Loading

Copy link
Copy Markdown

I would say as well that there's a 846 element limit in the providername. Odd number.

$a = get-winevent -ListProvider * | % providername
get-winevent -ProviderName $a[0..846]

Get-WinEvent: The data is invalid.
Get-WinEvent: The data is invalid.
Get-WinEvent: The data is invalid.

Thatgfsj (Thatgfsj) pushed a commit to Thatgfsj/PowerShell that referenced this pull request Aug 6, 2026
ReadEvent() returns the error if our query contains number of logs more then 256.
So add the limit check and issue user-friendly error message.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Get-WinEvent - Suggested enhancements

5 participants


Back | FazBrowse Home | New Git URL