You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

如何用PowerShell设置Windows事件日志中的%2、%3等占位符

背景

在PowerShell脚本中向Windows事件查看器写入错误日志时,我找到了合适的源Application Error和事件ID1000。

当调用Write-EventLog -LogName "Application" -Source "Application Error" -EventId "1000" -Message "TEST MESSAGE"时,事件日志消息如下:

Faulting application name: TEST MESSAGE, version: %2, time stamp: 0x%3
Faulting module name: %4, version: %5, time stamp: 0x%6
Exception code: 0x%7
Fault offset: 0x%8
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Faulting package full name: %14
Faulting package-relative application ID: %15
问题

我无法找到从Write-EventLog中正确设置%2、%3等参数的方法:

  • -Message参数会被设为字符串%1。
  • -RawData参数对应%2,但会被解析为十六进制字符串。例如传入-RawData $utf8Encoding.GetBytes("1.2.7")时,消息显示为version: 312E322E37,而预期应为version: 1.2.7。
问题问询

是否存在方法可以在PowerShell中设置Windows事件日志消息中的%2、%3等参数?

补充说明:

New-WinEvent无法处理超过8个参数:

PS C:\> New-WinEvent -ProviderName "Application Error" -Id 1000 -Payload @(
>>         'DummyApp.exe',                            # Application name
>>         '1.2.3.4',                                 # Application version
>>         '12345678',                                # Time stamp
>>         'dummyModule.dll',                         # Faulting module name
>>         '2.3.4.5',                                 # Module version
>>         '87654321',                                # Module time stamp
>>         'c0000005',                                # Exception code
>>         '0000000000012345',                        # Fault offset
>>         '0x1234',                                  # Process ID
>>         '0x5D3E7F22',                              # Application start time
>>         'C:\Program Files\DummyApp\DummyApp.exe',  # Application path
>>         'C:\Windows\System32\dummyModule.dll',     # Module path
>>         'dummy-report-id',                         # Report ID
>>         'dummy-package-name',                      # Faulting package full name
>>         'dummy-app-id'                             # Faulting package-relative application ID
>>     )
New-WinEvent : The number of String parameters must not exceed 8.
Parameter name: eventPayload
At line:1 char:1
+ New-WinEvent -ProviderName "Application Error" -Id 1000 -Payload @(
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-WinEvent], ArgumentOutOfRangeException
    + FullyQualifiedErrorId : System.ArgumentOutOfRangeException,Microsoft.PowerShell.Commands.NewWinEventCommand

当仅传入8个参数给该事件ID时,会出现以下错误:

PS C:\> New-WinEvent -ProviderName "Application Error" -Id 1000 -Payload @(
>>         'DummyApp.exe',                            # Application name
>>         '1.2.3.4',                                 # Application version
>>         '12345678',                                # Time stamp
>>         'dummyModule.dll',                         # Faulting module name
>>         '2.3.4.5',                                 # Module version
>>         '87654321',                                # Module time stamp
>>         'c0000005',                                # Exception code
>>         '0000000000012345'                         # Fault offset
>> )
WARNING: Provided payload does not match with the template that was defined for event id 1000.
The defined template is following:
<template xmlns="http://schemas.microsoft.com/win/2004/08/events">
  <data name="AppName" inType="win:UnicodeString" outType="xs:string"/>
  <data name="AppVersion" inType="win:UnicodeString" outType="xs:string"/>
  <data name="AppTimeStamp" inType="win:UnicodeString" outType="xs:string"/>
  <data name="ModuleName" inType="win:UnicodeString" outType="xs:string"/>
  <data name="ModuleVersion" inType="win:UnicodeString" outType="xs:string"/>
  <data name="ModuleTimeStamp" inType="win:UnicodeString" outType="xs:string"/>
  <data name="ExceptionCode" inType="win:UnicodeString" outType="xs:string"/>
  <data name="FaultingOffset" inType="win:UnicodeString" outType="xs:string"/>
  <data name="ProcessId" inType="win:HexInt32" outType="win:HexInt32"/>
  <data name="ProcessCreationTime" inType="win:HexInt64" outType="win:HexInt64"/>
  <data name="AppPath" inType="win:UnicodeString" outType="xs:string"/>
  <data name="ModulePath" inType="win:UnicodeString" outType="xs:string"/>
  <data name="IntegratorReportId" inType="win:UnicodeString" outType="xs:string"/>
  <data name="PackageFullName" inType="win:UnicodeString" outType="xs:string"/>
  <data name="PackageRelativeAppId" inType="win:UnicodeString" outType="xs:string"/>
</template>

内容的提问来源于stack exchange,提问作者SATO Yusuke

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级,最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分), 限时 9.9 元起

最近更新时间:2026.06.15 16:25:56