powershell:get-winevent 没有消息数据？

Question

当我运行下面的脚本来检索日志文件时，get-winevent“消息”字段是空白的，但如果我运行 get-eventlog 有数据。任何想法为什么？

#has message data 
Get-Eventlog -LogName application -Newest 10

 #date 10 days ago 
$EventStartDate = get-date("10 May 2012") 
$EventEndDate = get-date("11 May 2012") 
$EventLogNames = @("Application", "system")

#critea for winevent 
$EventCritea = @{logname = $EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndDate}

#Retrieves the event log 
$RetreivedEvents = Get-WinEvent -computername localhost -FilterHashtable $EventCritea
$RetreivedEvents | fl id, logname, MachineName, Message, TimeCreated

Answer 1

你在什么语言环境下运行？

存在一个 .NET 错误，其中底层 .NET 方法(Get-WinEvent 使用的)无法在某些语言环境(例如 Message )中填充本地化字段(例如 en-GB )。

修复是切换到 en-US对于命令:

$orgCulture = Get-Culture
[System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"
# Perform Get-WinEvent
[System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture