Windows Server 2008 Task Scheduler: Trigger XML Syntax for email notification task isn't triggering based on failure events from another task

Question

Scenarios I need to solve with task scheduler in Windows Server 2008:

(#1) task A tries to run a program > task A succeeds and runs the exe file > task B looks at events of task A and emails recipients that task A ran successfully.

Events of scenario #1 (notice group of times in screen shot for reference):

100-Task Started
319-Task Engine received message to start task
110-Task triggered by user
200-Action started
129-Created Task Process
201-Action completed
102-Task completed

(#2) task A tries to run a program > task A fails to run the exe file because exe file doesn't exist > task B looks at events of task A and emails recipients about failure.

Events of scenario #2 (notice group of times in screen shot for reference):

319-Task engine received message to start task
110-Task triggered by user
100-Task Started
200-Action started
203-Action failed to start
103-Action start failed

Here are events of task A. Read them from top to bottom. I've re-written in correct order above.

Here is the XPath query for scenario #1 that works. I cannot figure out what XPath for scenario #2 (task that sends failure email).

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
    <Select Path="Microsoft-Windows-TaskScheduler/Operational">

*[System[EventID=201]] 
and *[EventData[Data[@Name='ResultCode']='0' 
or Data[@Name='ResultCode']='1']] 
and *[EventData[Data[@Name='TaskName']='\test_email_task']]

</Select>
  </Query>
</QueryList>

=================

Update 6/8/2012 @ 1:55

More specifically, scenario #1 doesn't work. And scenario #2 does work. For scenario #1, I'm thinking the system is unable to trigger the event because of the ResultCode of 2147942402. This means Windows could not find the file.

Scenario #1:

... task2 doesn't send email
... task1 has EventID 103 and ResultCode 2147942402
... task1 has EventID 203 and ResultCode 2147942402

• Create 2 tasks.
• Call task #1 "task1_execute_program"; add an Action to open a program in "c:\windows\system32\bogus.exe" (invalid program)
• Call task #2 "task2_send_email_based_on_result_of_task1"; add an Action to send an email ... enter details and SMTP server .... then add a Trigger based on an event .... click XML tab and enter the XPath query below:

Scenario #2:

... task2 sends email because it found write.exe
... task1 has EventID 102-Task Completed

• keep everything the same, but change the Action program in task #1 from "c:\windows\system32\bogus.exe" (invalid program)" to "c:\windows\system32\write.exe" (valid program)

=====================

<QueryList>
    <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
        <Select Path="Microsoft-Windows-TaskScheduler/Operational">

        *[System[EventID=203] and 
        *[EventData[Data[@Name='TaskName']='\task1_execute_program']]]

        or

        *[System[EventID=102]] 
        and *[EventData[Data[@Name='TaskName']='\task1_execute_program']]

        </Select>
    </Query>
</QueryList>

Answer 1

Guess it's not a bug. I used different attributes to solve it. Task vs. EventID. The columns in the event history don't match the name in the XPath syntax. "EventID" does work (along with "Task"), but only when you don't have the Result Code mentioned. So there could very well be a bug in Task Manager. But this is a good workaround.

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
    <Select Path="Microsoft-Windows-TaskScheduler/Operational">

    *[
        System
        [
            Provider[@Name='Microsoft-Windows-TaskScheduler'] 
            and (Level=0 or Level=1 or Level=2 or Level=3 or Level=4 or Level=5) and (Task = 103 or Task = 203)
        ]       
        or
        System
        [
            Provider[@Name='Microsoft-Windows-TaskScheduler'] 
            and (Level=0 or Level=1 or Level=2 or Level=3 or Level=4 or Level=5) and (Task = 102)
        ]       
    ]

    and 

    *[
        EventData
        [
            Data
            [
                @Name='TaskName'
            ]='\task1_execute_program'
        ]
    ]

    </Select>
  </Query>
</QueryList>