Invalid Windows Event XML is not readable by System Center Operations Manager


When using a custom application that logs Windows Events to the Event Log, you may notice that some of these events are not discovered by Operations Manager even though events are being monitored. If you open the Windows Event Viewer and select one of these events, and then click on Details and then XML View, you will notice an error such as the one below:

This event is not displayed correctly because the underlying XML is not well formed.


This issue occurs when the event XML is invalid. A situation like this may happen most commonly due to the fact that when the application creates the event, it will enter an Event Description with special characters that are not converted to HTML/XML entities.


To resolve this issue, update the custom application so that any special characters are written in proper HTML/XML format.

More Information

In newer versions of .NET such as .NET 4.0, the APIs used to create an Event in a Windows Event Log will automatically format the Event Strings (like Description) and convert any special characters to HTML/XML entries. An example of such a function that could be used is: EventLog::WriteEntry. See for more information.

Earlier versions of .NET, depending on what API is being used, may not automatically format strings like the Event Description and convert the special characters into HTML/XML entries.

As an example, one of these special characters is the > sign which in XML should be written as >

Article ID: 2859188 - Last Review: Jun 17, 2013 - Revision: 1

Microsoft System Center Operations Manager 2007, Microsoft System Center Operations Manager 2007 R2, Microsoft System Center Operations Manager 2007 Service Pack 1, Microsoft System Center 2012 Operations Manager, Microsoft System Center 2012 Operations Manager Service Pack 1