Invalid Windows Event XML is not readable by System Center Operations Manager

When using a custom application that logs Windows Events to the Event Log, you may notice that some of these events are not discovered by Operations Manager even though events are being monitored. If you open the Windows Event Viewer and select one of these events, and then click on Details and then XML View, you will notice an error such as the one below:

This event is not displayed correctly because the underlying XML is not well formed.
This issue occurs when the event XML is invalid. A situation like this may happen most commonly due to the fact that when the application creates the event, it will enter an Event Description with special characters that are not converted to HTML/XML entities.

To resolve this issue, update the custom application so that any special characters are written in proper HTML/XML format.
More information
In newer versions of .NET such as .NET 4.0, the APIs used to create an Event in a Windows Event Log will automatically format the Event Strings (like Description) and convert any special characters to HTML/XML entries. An example of such a function that could be used is: EventLog::WriteEntry. See for more information.

Earlier versions of .NET, depending on what API is being used, may not automatically format strings like the Event Description and convert the special characters into HTML/XML entries.

As an example, one of these special characters is the > sign which in XML should be written as >
SCOM, Event, XML, Operations Manager, formed, entities opsmgr 2007 opsmgr 2012
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Article ID: 2859188 - Last Review: 06/17/2013 21:11:00 - Revision: 2.0

Microsoft System Center Operations Manager 2007, Microsoft System Center Operations Manager 2007 R2, Microsoft System Center Operations Manager 2007 Service Pack 1, Microsoft System Center 2012 Operations Manager, Microsoft System Center 2012 Operations Manager Service Pack 1

  • KB2859188