From fa664090c75dec518f5edb1676aa2ad3d42009f6 Mon Sep 17 00:00:00 2001
From: amadeuskonopko <67250169+amadeuskonopko@users.noreply.github.com>
Date: Wed, 7 Aug 2024 21:13:13 -0400
Subject: [PATCH] Update Event-Log-Diagnostics.xml

The XPath event filter has a syntax error returning a Query Error  when used in an Event Viewer custom view.
---
 wef-subscriptions/Event-Log-Diagnostics.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wef-subscriptions/Event-Log-Diagnostics.xml b/wef-subscriptions/Event-Log-Diagnostics.xml
index d01ee10..78cc347 100644
--- a/wef-subscriptions/Event-Log-Diagnostics.xml
+++ b/wef-subscriptions/Event-Log-Diagnostics.xml
@@ -26,7 +26,7 @@
         <!-- 1104: The security log is now full. -->
         <!-- 1105: Event log automatic backup. -->
         <!-- 1108: The event logging service encountered an error while processing an incoming event published from %1 -->
-        <Select Path="Security">*[System[(EventID=1100 or EventID=1104 OR EventID=1105 OR EventID=1108)]]</Select>
+        <Select Path="Security">*[System[(EventID=1100 or EventID=1104 or EventID=1105 or EventID=1108)]]</Select>
     </Query>
     </QueryList>]]></Query>
   <ReadExistingEvents>true</ReadExistingEvents>