如何用PowerShell设置Windows事件日志中的%2、%3等占位符
背景
在PowerShell脚本中向Windows事件查看器写入错误日志时,我找到了合适的源Application Error和事件ID1000。
当调用Write-EventLog -LogName "Application" -Source "Application Error" -EventId "1000" -Message "TEST MESSAGE"时,事件日志消息如下:
Faulting application name: TEST MESSAGE, version: %2, time stamp: 0x%3 Faulting module name: %4, version: %5, time stamp: 0x%6 Exception code: 0x%7 Fault offset: 0x%8 Faulting process id: 0x%9 Faulting application start time: 0x%10 Faulting application path: %11 Faulting module path: %12 Report Id: %13 Faulting package full name: %14 Faulting package-relative application ID: %15
问题
我无法找到从Write-EventLog中正确设置%2、%3等参数的方法:
-Message参数会被设为字符串%1。-RawData参数对应%2,但会被解析为十六进制字符串。例如传入-RawData $utf8Encoding.GetBytes("1.2.7")时,消息显示为version: 312E322E37,而预期应为version: 1.2.7。
问题问询
是否存在方法可以在PowerShell中设置Windows事件日志消息中的%2、%3等参数?
补充说明:
New-WinEvent无法处理超过8个参数:
PS C:\> New-WinEvent -ProviderName "Application Error" -Id 1000 -Payload @( >> 'DummyApp.exe', # Application name >> '1.2.3.4', # Application version >> '12345678', # Time stamp >> 'dummyModule.dll', # Faulting module name >> '2.3.4.5', # Module version >> '87654321', # Module time stamp >> 'c0000005', # Exception code >> '0000000000012345', # Fault offset >> '0x1234', # Process ID >> '0x5D3E7F22', # Application start time >> 'C:\Program Files\DummyApp\DummyApp.exe', # Application path >> 'C:\Windows\System32\dummyModule.dll', # Module path >> 'dummy-report-id', # Report ID >> 'dummy-package-name', # Faulting package full name >> 'dummy-app-id' # Faulting package-relative application ID >> ) New-WinEvent : The number of String parameters must not exceed 8. Parameter name: eventPayload At line:1 char:1 + New-WinEvent -ProviderName "Application Error" -Id 1000 -Payload @( + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [New-WinEvent], ArgumentOutOfRangeException + FullyQualifiedErrorId : System.ArgumentOutOfRangeException,Microsoft.PowerShell.Commands.NewWinEventCommand
当仅传入8个参数给该事件ID时,会出现以下错误:
PS C:\> New-WinEvent -ProviderName "Application Error" -Id 1000 -Payload @( >> 'DummyApp.exe', # Application name >> '1.2.3.4', # Application version >> '12345678', # Time stamp >> 'dummyModule.dll', # Faulting module name >> '2.3.4.5', # Module version >> '87654321', # Module time stamp >> 'c0000005', # Exception code >> '0000000000012345' # Fault offset >> ) WARNING: Provided payload does not match with the template that was defined for event id 1000. The defined template is following: <template xmlns="http://schemas.microsoft.com/win/2004/08/events"> <data name="AppName" inType="win:UnicodeString" outType="xs:string"/> <data name="AppVersion" inType="win:UnicodeString" outType="xs:string"/> <data name="AppTimeStamp" inType="win:UnicodeString" outType="xs:string"/> <data name="ModuleName" inType="win:UnicodeString" outType="xs:string"/> <data name="ModuleVersion" inType="win:UnicodeString" outType="xs:string"/> <data name="ModuleTimeStamp" inType="win:UnicodeString" outType="xs:string"/> <data name="ExceptionCode" inType="win:UnicodeString" outType="xs:string"/> <data name="FaultingOffset" inType="win:UnicodeString" outType="xs:string"/> <data name="ProcessId" inType="win:HexInt32" outType="win:HexInt32"/> <data name="ProcessCreationTime" inType="win:HexInt64" outType="win:HexInt64"/> <data name="AppPath" inType="win:UnicodeString" outType="xs:string"/> <data name="ModulePath" inType="win:UnicodeString" outType="xs:string"/> <data name="IntegratorReportId" inType="win:UnicodeString" outType="xs:string"/> <data name="PackageFullName" inType="win:UnicodeString" outType="xs:string"/> <data name="PackageRelativeAppId" inType="win:UnicodeString" outType="xs:string"/> </template>
内容的提问来源于stack exchange,提问作者SATO Yusuke
相关产品推荐
相关产品推荐

