powershell - Powershell Write-EventLog/Get-WinEvent消息问题

Question

第一个命令在事件日志中创建一个条目，它似乎正在工作，因为我可以在事件查看器中看到消息数据。问题是从powershell读回该消息时，该字段为空。

write-eventlog System -source 'Microsoft-Windows-Kernel-General' -eventid 999 -message 'Kernel something or other'

get-winevent -filterHashTable @{Logname = 'System'; ID = '999'}| select-object -first 10

也许这张照片可以更好地说明。请注意，消息列为空白。

Answer 1

该事件已正确写入，要重新读取该事件，请使用以下命令:

get-winevent -filterHashTable @{Logname = 'System'; ID = '999'}| 
    select-object -first 10 | select timecreated,providername,
    @{n="Message";e={$_.properties.Value}}

启动 eventvwr时，很明显在消息列中看不到它的原因:

The description for Event ID 999 from source Microsoft-Windows-Kernel-General cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

如果要使用 New-EventLog cmdlet从自定义来源编写自定义消息，请参见Scripting Guy的教程: http://blogs.technet.com/b/heyscriptingguy/archive/2013/06/20/how-to-use-powershell-to-write-to-event-logs.aspx