I'm trying to subscribe on upcoming events using function EvtSubscribe
:
hsubscription = microsoft_EvtSubscribe(
NULL, // session
NULL, // signal
NULL, // channel path
L"<QueryList><Query Id="0" Path='Application'><Select>*[System[EventRecordID >= 1037374]]</Select></Query></QueryList>" // query
NULL, // bookmark
context, // context
clbk, // callback
EvtSubscribeToFutureEvents // flags
);
But the callback has never been called back.
I tried several approaches using XPath + channel path: Event/System[EventRecordID=1037374]
, *[System/EventRecordID=1037374]
, but it doesn't work neither.
BTW, whenever the subscription is created for any other field (like: *[System/Computer="windows-build"]
) everything works perfectly fine.
What am I doing wrong? Thanks