In the Event Viewer, if you create a custom query and do this:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">
        *[System[(Level=0) and TimeCreated[timediff(@SystemTime) <= 400400000]]]
    </Select>
  </Query>
</QueryList>

This will retrieve all Application log Information messages for the given time, in this case about 5 days.

Do the same for warning message by doing this:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">
        *[System[(Level=3) and TimeCreated[timediff(@SystemTime) <= 400400000]]]
    </Select>
  </Query>
</QueryList>

When doing this, I have found out that the same query for information message does not grab all information messages. In fact, it is missing a lot of them. Only a few are returned.

How is it possible that the same command does not work on a particular level?