Powershell事件转发

发布于 2024-08-16 11:13:09 字数 798 浏览 11 评论 0原文

抱歉英语不好。

我在 powershell 和其中的事件转发机制方面遇到了一些麻烦。我试图做这样的事情：

$remoteComputer = "."
$session = New-PsSession $remoteComputer

Unregister-Event CatchEvent -ErrorAction SilentlyContinue
Invoke-Command $session {

    ## The WMI query to detect a stopping service
    $query = @"
        SELECT *
        FROM __instancecreationevent
        WHERE TargetInstance ISA 'Win32_NtLogEvent'
        and targetinstance.eventcode = '7036'
"@
    Register-WmiEvent -Query $query "CatchEvent" -Forward
}
$null = Register-EngineEvent CatchEvent -Action { $GLOBAL:MyEvent = $event}

$MyEvent 变量最后不包含事件信息，而是包含 system.string 类数据。替代文本 http://eosfor.fileave.com/powershell.png

此脚本有什么问题？

原文

Sorry for bad english.

I have some troubles with powershell and events forwarding mechanism in it. Im trying to do something like this:

$remoteComputer = "."
$session = New-PsSession $remoteComputer

Unregister-Event CatchEvent -ErrorAction SilentlyContinue
Invoke-Command $session {

    ## The WMI query to detect a stopping service
    $query = @"
        SELECT *
        FROM __instancecreationevent
        WHERE TargetInstance ISA 'Win32_NtLogEvent'
        and targetinstance.eventcode = '7036'
"@
    Register-WmiEvent -Query $query "CatchEvent" -Forward
}
$null = Register-EngineEvent CatchEvent -Action { $GLOBAL:MyEvent = $event}

$MyEvent variable at last contains not an event information, but a system.string class data.
alt text http://eosfor.fileave.com/powershell.png

Whats wrong with this script?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

兮子 2024-08-23 11:13:09

瓦西里·古谢夫给了我一个答案。

$query = "SELECT * FROM __instancecreationevent WHERE TargetInstance ISA 'Win32_NtLogEvent' AND TargetInstance.eventcode = '7036'"
Register-WmiEvent -Query $query -ComputerName client1 -Action {write-host "Service Stopped"}

再次。抱歉英语不好。如果有什么问题请纠正我:)

Vasily Gusev gives me an answer.

$query = "SELECT * FROM __instancecreationevent WHERE TargetInstance ISA 'Win32_NtLogEvent' AND TargetInstance.eventcode = '7036'"
Register-WmiEvent -Query $query -ComputerName client1 -Action {write-host "Service Stopped"}

again. sorry for bad english. just correct me if something wrong :)

回复收藏 0 原文

~没有更多了~