check_eventlog with Windows Log Channels always returns "Ok - No entries found"

[FreiParken]

Hello everyone,
we are already successfully checking our standard Windows logs with snclient 0.31 and check_eventlog. Great tool - much smarter than our old one. Thanks a lot !!!

Now we want to check and filter Windows Log Channels for messages, but we always get an ‘Ok - No entries found’, no matter how we filter.
We have set the log level to trace and reproduced the behaviour as follows:
snclient test check_eventlog ‘filter=none’ ‘file=’Application‘’ ‘unique-index=0’ ‘scan-range = 10h’
-> provides me with all unfiltered log entries from the last 10 hours in the trace output
snclient test check_eventlog ‘filter=none’ ‘file=’Microsoft-Windows-AppID/Operational‘’ ‘unique-index=0’ ‘scan-range = 10h’
or
snclient test check check_eventlog ‘filter=none’ ‘file=’Microsoft-Windows-AppID'’ ‘unique-index=0’ ’scan-range = 10h’
-> always returns ‘Ok - No entries found’, although there are log entries.

You can find the trace output in the attachment. In the ‘AppID’ channel log, 10 events were visible in the event log viewer (4 x error, 6 x information).
The trace output includes: check_snclient_version, output of a working test and a test that returned no results.

We would be very happy to receive ideas on where our error lies.

Thank you very much,
Greetings,
Harald

check_eventlog_channel.txt

[sni]

This is a know issue and on the roadmap. Right now, windows eventlog data is fetched via wmi and that's limited to system logs. Application eventlogs can only be fetched via powershell and not by wmi.

[FreiParken]

Ok, thanks for the quick reply and the hint with Powershell.
I will implement this solution.