Get-WinEvent - The data is invalid - by ThomasICG

Status : 


Sign in
to vote
ID 800980 Comments
Status Active Workarounds
Type Bug Repros 11
Opened 9/16/2013 10:29:11 AM
Access Restriction Public


I cannot use get-WinEvent on any of my Windows 8 computers. I have heard from others from the internet that they are not experiencing the same issue. So i maybe thinking it's releated to the Danish version. Tried changing locale though, no change. 
Sign in to post a comment.
Posted by KWTPD on 9/18/2015 at 7:28 PM
How many years is a basic PowerShell builtin going to be broken? If MS wants more PowerShell users, the builtins need to work 100% of the time.
Posted by Brianna B on 6/5/2015 at 4:08 PM
For some reason the Workarounds tab wasn't working for me before. I didn't try duffwv's solution, but I did get to work for me. All the same I'm disappointed that this issue hasn't really been addressed, considering how important event logs are to troubleshooting..
Posted by Brianna B on 6/5/2015 at 3:58 PM
I'm experiencing this on Windows 2012r2. 2 years since this is originally posted and there's no response from Microsoft? Could we at least get a workaround?
Posted by Andres P on 5/4/2015 at 11:07 PM
Inded, seems the same limit applies when i do Custom view in Event viewer and select all logs from Application and Services Logs types. ( Sometime i need full view whats häppening in system for some limited small time window) When all logs selected i do get Error 13 , unselecting some allows data be returned.
Windows 2012 r2 with latest patches.
Posted by duffwv on 12/10/2014 at 12:49 PM
I can confirm that there is a 256 log limit when creating a custom view in eventvwr.msc. It give the following error when feeding 257+ logs in a custom view query: Event Viewer cannot open the event log or custom view. Verify that the Event Log service is running or query is too long. If you trim the custom view down to 256 logs, it works.

So, this is a limit deeper in Windows than powershell.
Posted by duffwv on 12/10/2014 at 12:05 PM
There appears to be a 256 log limit.

I experience the same issue. I did a search and found this. I found that by specifying a log name Get-WinEvent works; event multiple log names.

Get-WinEvent -LogName Security,System

But, I was working on a script to pull the last day's error events from all logs. It occurred to me to pull the names of the logs out into an array and see just which logs were causing the issue.

$arr = (Get-WinEvent -ListLog *).LogName
Get-WinEvent -LogName $arr[0..255] #Go
Get-WinEvent -Logname $arr[-1..-256] #Go
Get-WinEvent -LogName $arr[0..256] #No Go

My windows 8.1 machine has 375 logs.
My windows 7 and 2008R2 machines have 167 logs.
My windows 2012 machine has 179 logs.

Apparently there are a lot more logs in windows 8.1 than in previous versions.
Posted by Joseph1000010 on 11/11/2013 at 5:52 PM
I a couple months back when I noticed that one of my scripts which used get-winevent returned exceptions when run on windows 8 and powershell v3.

Error message (repeats for every event queried from the log):
get-winevent : The data is invalid
At line:1 char:1
+ get-winevent
+ ~~~~~~~~~~~~
    + CategoryInfo         : NotSpecified: (:) [Get-WinEvent], EventLogInvalidDataException
    + FullyQualifiedErrorId : The data is invalid,Microsoft.PowerShell.Commands.GetWinEventCommand

I started to troubleshoot, I ran the same commands that failed on windows 8 on several different computers to see if it worked or not:
Windows 8.1 - PowerShell V4: Failed
Windows 8 - PowerShell V3: Failed
Windows 7 - PowerShell V3: Succeeded
Windows 7 - PowerShell V2: Succeeded
Server 2008 R2 - PowerShell V2: Succeeded
Server 2008 R2 - PowerShell V3: Succeeded

I asked sever other people running windows 8 to test this, the command returned the error for every single one of them without exception. This but has been around for two stable releases of PowerShell, why has it not been fixed yet.
Posted by ThomasICG on 10/25/2013 at 8:05 AM
Has anyone from MS seen this, there has been no comments and it's been over a month?