Error deserializing Windows logs as PSObjects?

Question

Trying to deserialize Powershell logs using "PSSerializer.Deserialize(log) as PSObject;" but keep getting error:

"System.Xml.XmlException: 'Element 'Objs' with namespace name 'http://schemas.microsoft.com/powershell/2004/04' was not found. Line 1, position 2.'"

Log example:

"<Obj RefId=\"0\">
    <MS>
        <Obj N=\"PowerShell\" RefId=\"1\">
            <MS>
                <Obj N=\"Cmds\" RefId=\"2\">
                    <TN RefId=\"0\">
                        <T>System.Collections.Generic.List`1[[System.Management.Automation.PSObject, System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]</T>
                        <T>System.Object</T>
                    </TN>
                    <LST>
                        <Obj RefId=\"3\">
                            <MS> ......

Do you have an array at root level of xml. Most log files using xml format just append data to end of file. So you need to read using XmlReader with Fragment option. — jdweng, Mar 19 '20 at 17:03

nityomki · Answer 1 · 2020-03-23T16:42:24.767

0

Appending this worked for me:

<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"> 
..Log...
</Objs>

edited Mar 23 '20 at 16:42

answered Mar 23 '20 at 10:52

nityomki

1
1

Error deserializing Windows logs as PSObjects?

1 Answers1