"ERROR: Invalid FILTER Operator" Error Message When You Use the /FI FILTERNAME Parameter with Eventquery.vbs in the Chinese Language Version of Windows Server 2003 (817874)


The information in this article applies to:

  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Small Business Server 2003, Standard Edition
  • Microsoft Windows Small Business Server 2003, Premium Edition

SYMPTOMS

In the Chinese-Hong Kong and Traditional Chinese language versions of Windows Server 2003, if you use the Eventquery.vbs command-line tool, you may not be able to use the /fi FilterName parameter to specify the types of events that you want to include or exclude from your event log query. For example, when you type cscript eventquery.vbs /fi "type eq information" at the command prompt to query event logs for "information" events, you receive the following error message:
ERROR: Invalid FILTER operator 'type' specified for the filter 'type eq error'

CAUSE

This problem occurs because the ' the filters as given by the user and ' Define const for filter separation when OR or ANDis specified in filter sections of the Eventquery.vbs file in the Chinese-Hong Kong and Traditional Chinese language versions of Windows Server 2003 contain incorrect content.

WORKAROUND

To work around this problem, manually edit the ' the filters as given by the user and ' Define const for filter separation when OR or ANDis specified in filter sections of the Eventquery.vbs file to include the correct content. To do so, follow these steps.

Note Before you perform the following procedure, you may want to make a backup copy of the Eventquery.vbs file. This file is located in the %Systemroot%\System32 folder on the hard disk.
  1. Start Notepad, and then click Open on the File menu.
  2. Click All Files in the Files of type box, click the Eventquery.vbs file in the %Systemroot%\System32 folder, and then click Open.
  3. Locate the ' the filters as given by the user section.
  4. Copy and paste the following lines to replace the existing ' the filters as given by the user section:

    ' the filters as given by the user
CONST L_UserFilterDateTime_Text         = "datetime"
CONST L_UserFilterType_Text             = "type" 
CONST L_UserFilterUser_Text             = "user" 
CONST L_UserFilterComputer_Text         = "computer"
CONST L_UserFilterSource_Text           = "source"
CONST L_UserFilterDateCategory_Text     = "category"
CONST L_UserFilterId_Text               = "id"

  5. Locate the ' Define const for filter separation when OR or ANDis specified in filter section.
  6. Copy and paste the following lines to replace the existing ' Define const for filter separation when OR or ANDis specified in filter section:

    ' Define  const for  filter  separation when OR  or ANDis specified in filter 
CONST L_OperatorOR_Text           = " OR "
CONST L_OperatorAND_Text           = " AND "

  7. On the File menu, click Save, and then quit Notepad.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

For more information about Eventquery.vbs, visit the following Microsoft Web site:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/entserver/eventquery.asp

Modification Type:MajorLast Reviewed:3/1/2004
Keywords:kbprb kbpending KB817874
©2004 Microsoft Corporation. All rights reserved.