how to catch a System.Diagnostics.Eventing.Reader error in powershell - powershell

Question

The code looks like this:
foreach ($machine in $lbx_workstations.SelectedItems)
{
$temp = (get-winevent -computername $machine -FilterXML $commandString -ErrorAction SilentlyContinue -ErrorVariable eventerr|
Select MachineName, TimeCreated, LevelDisplayName, ID, ProviderName, Message)
blah blah blah...
I made a custom error variable, $eventerr, which works just fine when the get-winevent cmdlet can't find any events that match the criteria in the XML commandstring. However, the problem is this: If the XML commandstring is invalid, the error is created in the $error variable instead of the $eventerr variable. I'd like to get that error stored in my custom error variable, but I don't know where it is coming from or what is generating it. Or why it isn't already in my custom variable, actually. When I look at these two different types of errors, this is the output I get:
PS C:\Temp> $error[0].fullyqualifiederrorid
System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWinEventCommand
PS C:\Temp> $error[1].fullyqualifiederrorid
NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand
I can catch the "NoMatchingEventsFound" error in the custom variable, but not the System.Diagnostics.Eventing... error.
Is there any way to get the "System.Diagnostics.Eventing... error into my custom error variable?

Answer 1

It's probably happening when PowerShell is trying to convert $commandString into an XmlDocument (the type of the -FilterXml parameter). I don't think you'll be able to capture the error in your error variable since it is happening before the call into Get-WinEvent. Your best bet is to validate $commandString before trying to pass it to Get-WinEvent.
try
{
$xmlDoc = New-Object 'Xml.XmlDocument'
$xmlDoc.LoadXml( $commandString )
}
catch
{
# Or do some other kind of error handling. You're the driver!
Write-Error ('Oh no! Bad XML! What are you thinking?!')
}
$lbx_workstationg.SelectedItems |
ForEach-Object { Get-WinEvent -ComputerName $_ -FilterXml $commandString -ErrorAction SilentlyContinue -ErrorAction eventerr } |
Select-Object MachineName, TimeCreated, LevelDisplayName, ID, ProviderName, Message
That being said, I have noticed that sometimes using the -ErrorVariable doesn't result in all the errors from getting put in the error variable specified. I never found out why. I usually end up falling back to using $Error. You can get the errors specific to your command by proper indexing:
$errorCount = $Error.Count
$lbx_workstationg.SelectedItems |
ForEach-Object { Get-WinEvent -ComputerName $_ -FilterXml $commandString -ErrorAction SilentlyContinue } |
Select-Object MachineName, TimeCreated, LevelDisplayName, ID, ProviderName, Message
$winEventError = $Error[0..($Error.Count - $errorCount)]

Answer 2

The two different errors make different types of error messages. These types have different properties.
$eventerr.message holds the text I need if the error is
TypeName: System.Management.Automation.CmdletInvocationException
The specified query is invalid
$eventerr.exception holds the error text if the error is this type:
TypeName: System.Management.Automation.ErrorRecord
No events were found that match the specified selection criteria.
I'm not clear on how a single variable (eventerr) can hold different object types. But this seems to be the case. If anyone has a good explanation for how this can be, I'd sure like to hear it. Meanwhile, I'm going to mark this as the answer.