KBI 311372 Issue Addressed: Bad Syntax Error When Comparison Text In Event Log Rule Contains Double Quote


Argent for Compliance 3.1A-1601-C or earlier


Tuesday, 12 April 2016


If comparison text in Windows Event Log Rule contains double quotes, bad syntax error can be resulted when being saved in Win32 main GUI

Though the Rule might be saved successfully using Argent Global Manager, the Engine won’t be able to run this Rule due to the syntax error

The issue has been addressed in Argent AT 3.1A-1601-T8

The double quotes are escaped before saving into database and restored by Engine when reading back from database

Technical Background



Upgrade to Argent AT 3.1A-1601-T8 or later