Bug in .DotNet methods when handlig date-strings prepared by Get-WinEvent RRS feed

  • Question

  • $s='‎2018‎-‎08‎-‎14T04:01:13.496081100Z.';
    Write-Host "$s, s.Length="$s.Length;
    Write-Host "$t, t.Length="$t.Length;
    Write-Host "$l, l.Length="$l.Length;
    $s1 = $s.Substring(0,30);
    $t1 = $t.Substring(0,30);
    $l1 = $l.Substring(0,30);
    Write-Host $s1.Length $s1;
    Write-Host $t1.Length $t1;
    Write-Host $l1.Length $l1;

    Output is:2018‎-‎08‎-‎14T04:01:13.496081100Z., s.Length= 36
    ‎2015‎-11‎-‎23T04:11:28.8109953237., t.Length= 35
    ....+....1....+....2....+....3., s.Length= 31
    30 ‎2018‎-‎08‎-‎14T04:01:13.49608
    30 ‎2015‎-11‎-‎23T04:11:28.810995
    30 ....+....1....+....2....+....3

    • Moved by Bill_Stewart Wednesday, December 12, 2018 5:05 PM Not a question
    Tuesday, August 14, 2018 2:40 PM

All replies

  • HexDump helped to understand what happend: you see, date-strings above was not prepared "by-hand" but copyed from the WinEvent property Message. And it appeared that it MAY contain INVISIBLE Unicode charactes with a code 0x0E20. These charactes presence caused strange results of the both of my today messages. I'm sory but was too frustrated when the code that run many month without errors have failed today on one of the events.
    Tuesday, August 14, 2018 4:25 PM
  • Do not extract data from the message.  Use the Properties collection to get the values.  They will not be altered by the message formatter which is system dependent..


    Tuesday, August 14, 2018 4:28 PM
  • "Use the Properties collection to get the value". Well, 1st of all Message is an event property. DateTime strings are present in the Message property for the ID=12,13 of the SYSTEM events. Likewise date-strings for the events 100,200 of the Microsoft-Windows-Diagnostics-Performance/Operational, are present nor in the Message property but in the Event.EventData.Data and I've never have problems withe these date strings. In any case very glad that got a reason of the bug happend. Many thanks for the pations.
    Tuesday, August 14, 2018 4:41 PM
  • I have no idea which events you are having an issue with.  This is the easiest method of getting the string without extra characters:

    $ev = get-winevent application -MaxEvents 1
    $timestring = $ev.Properties[3].Value

    Extracting the string from the message body will not always get you a correct string.  As noted, the message is a converted string that is system and event dependent and may have Unicode characters that make the conversion fail.

    I guarantee you that this is not a bug although it is possible that aa provider/source may be sending bad data to the event log.  Check if this is source related.  If so the bug is in the provider and not in Get-WinEvent or in PowerShell.


    Tuesday, August 14, 2018 5:13 PM