Cannot save changes to LogMode property

I get an error in this resource:

Exception calling "SaveChanges" with "0" argument(s): "The parameter is incorrect"
    + CategoryInfo          : NotSpecified: (:) [], CimException
    + FullyQualifiedErrorId : EventLogException
    + PSComputerName        : LocalHost

I've added some verbose output to track down which .SaveChanges() method is causing the error. It turns out to be .LogMode property that is causing the error.

I've done some testing with Get-WinEvent on Windows Server 2012 R2 (PS. 5.1) and Windows 10, both have the same results.

I can see the property has changed, but I cannot save the change:

PS C:\> Write-Host "Get log: `n"
$log = Get-WinEvent -ListLog Microsoft-Windows-DeviceSetupManager/Analytic
$log

Write-host "`nChange log mode`n"
$log.LogMode = "Retain"

Write-Host "Check property has changed:`n"
$log

Write-Host "`nSave change:`n"
$log.SaveChanges()


#Output:

Get log: 

LogMode   MaximumSizeInBytes RecordCount LogName                                                                                                                                                                                    
-------   ------------------ ----------- -------                                                                                                                                                                                    
Circular             1052672             Microsoft-Windows-DeviceSetupManager/Analytic                                                                                                                                              

Change log mode

Check property has changed:

Retain               1052672             Microsoft-Windows-DeviceSetupManager/Analytic                                                                                                                                              

Save change:

Exception calling "SaveChanges" with "0" argument(s): "The parameter is incorrect"
At line:12 char:1
+ $log.SaveChanges()
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : EventLogException

In the GUI, I see "Archive the log when full" (AutoBackup) option is grayed out. Also the GUI grays out all options if the log is enabled, so I have made sure the event is disabled, but it still does not allow me to save the setting.

Perhaps as this resource is using the Get-WinEvent and I have shown that Get-WinEvent is the issue, you can't help. Nevertheless, others may have the same issue.

[tom-henderson]

@arcotek-ltd I'm having the exact same issue setting up the Microsoft-Windows-DNSServer/Analytical log. Did you find a solution?

@tom-henderson Afraid not and MS obviously don't think this one has any merit as nobody has picked it up!

[pekkaar]

Having the same issue with a different Analytic log (DSC). Performing a Get-Member on your $log variable will show that the LogMode property's definition is System.Diagnostics.Eventing.Reader.EventLogMode... which makes me wonder if this is some kind of enum -- as opposed to a simple string like "circular" ?

[hkelley]

I tried it with the enum but had the same result.

$eventlogSettings.LogMode = [System.Diagnostics.Eventing.Reader.EventLogMode]::Retain
$eventlogSettings.IsEnabled = $false
$eventlogSettings.SaveChanges()
Exception calling "SaveChanges" with "0" argument(s): "The parameter is incorrect"

[johlju]

It seems something is blocking changing this by code, since it is possible to change this in the GUI (at least to either Circular or Retain). Happy to review a PR if someone in the community finds a solution to this.

Just code to reproduce.

$eventLog = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration 'Microsoft-Windows-DeviceSetupManager/Analytic'
$eventlog.LogMode = [System.Diagnostics.Eventing.Reader.EventLogMode]::Circular
$eventlog.SaveChanges()

Exception calling "SaveChanges" with "0" argument(s): "The parameter is incorrect"
At line:1 char:1
+ $eventlog.SaveChanges()
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : EventLogException

[johlju]

Wonder if it possible to changing the registry directly to workaround this https://docs.microsoft.com/en-us/windows/desktop/eventlog/eventlog-key

I rather not use the registry to change this, since it is probably not supported modifying the registry manually, and since it could break at some point or make other problems?

[GenesisCoast]

This works fine for me, including the code mentioned above. I wonder if its environment related? Or specific to an Event Log?

$log = Get-WinEvent -ListLog 'Application'
$log.LogMode = [System.Diagnostics.Eventing.Reader.EventLogMode]::Circular
$log.SaveChanges()

[johlju]

It is that particular event log. Seems this does not work on some of the event logs, but it is possible to change it in the GUI.

[hkelley]

@GenesisCoast , can you try your snippet against an analytical/debug log (file ends with *.evtx or *.etl). Those have a different structure and I believe that is the difference.

$log = Get-WinEvent -ListLog Microsoft-Windows-DeviceSetupManager/Analytic

This works fine for me, including the code mentioned above. I wonder if its environment related? Or specific to an Event Log?

$log = Get-WinEvent -ListLog 'Application'
$log.LogMode = [System.Diagnostics.Eventing.Reader.EventLogMode]::Circular
$log.SaveChanges()

[GenesisCoast]

@hkelley I have just tried the following and I think your hypothesis is correct.

$log = Get-WinEvent -ListLog 'Microsoft-Windows-DeviceSetupManager/Analytic'
$log.LogMode = [System.Diagnostics.Eventing.Reader.EventLogMode]::Circular
$log.SaveChanges()

Which results in the following error:

Exception calling "SaveChanges" with "0" argument(s): "The parameter is incorrect"
At line:3 char:1
+ $log.SaveChanges()
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : EventLogException

If I use the same snippet against a different Event Log for example 'Internet Explorer' it works fine!

$log = Get-WinEvent -ListLog 'Internet Explorer'
$log.LogMode = [System.Diagnostics.Eventing.Reader.EventLogMode]::Retain
$log.SaveChanges()

[johlju]

I suggest submitting a user voice for this issue https://windowsserver.uservoice.com/forums/295047-general-feedback

[mavratar]

Hello Everyone,

I have been working on adding functionality to this resource that would allow for the creation of new event logs. I have run into a lot of “gotcha’s” with creating new event logs as well as saving certain properties of existing event logs. I have detailed below the gotcha’s I have run into and have built in conditions that would make the resource usable given the limitations of what properties can be changed based on the .IsClassicLog .LogType value.

1. When creating new event logs using the New-Event Log cmdlet, the event log type created is classic. The IsEnabled property cannot be changed/saved from $true to $false on classic event logs. There is a limitation on what can be changed in the System.Diagnostics.Eventing.Reader class. The class is based around the legacy Event Log API that was deprecated with Windows Vista. The channels it creates are considered legacy channels, because they use a different set of registry keys, and certain operations simply aren’t supported on legacy channels (such as changing their enablement).

   • The resource will query the .IsClassicLog boolean value. If $true, a verbose message will indicate that
   the. IsEnabled parameter cannot be changed. If $false, the Set-IsEnabled function will run.

2. Changing LogMode only works on Operational and Administrative LogTypes. It does not seem to work on Debug or Analytic event logs. Changing the GUI from Retain to Circular does not seem to work as suggested either in my testing. Although you can change the radio button to Circular, when you apply changes and then enable the log, a Query Error pop-up indicates that “The requested operation cannot be performed over an enabled direct channel. The channel must first be disabled before performing the requested operation.” Even if I disable the log file, change from Retain to Circular, and then enable the log file, the error persists.

   • The resource will query the .LogType value. If Administrative or Operational, the Set-LogMode
   function will run. If the .LogType value is other than Administrative or Operational, a verbose message
   will indicate that the .LogMode property cannot be set.

3. Changing the security descriptor on Analytic log files can only be done if you disable and save the event log prior to making the desired change.

   • In order to set existing event log security descriptor values for Analytic log types, the .IsEnabled value
   must be set to $false and saved before the Set-SecurityDescriptor function runs; otherwise it will fail.
   This does not appear to be an issue when creating new event logs.

4. Changing the Maximum Size in Bytes can only be done if you disable and save the event log prior to making the desired change.

   • In order to set existing event log MaximumSizeInBytes values for Debug log types, the .IsEnabled
   value must be set to $false and saved before the Set-SecurityDescriptor function runs; otherwise it will
   fail. This does not appear to be an issue when creating new event logs.

Does anyone have any issue with how this resource would work? I hope to have a PR submitted next week and am working on finishing the Unit and Integration tests now.