Powershell Write-EventLog / Get-WinEvent消息问题

Question

The first command creates an entry in the event log, it seems to be working because I can see the message data in event viewer. The issue is when reading it back from powershell the message field is empty.

write-eventlog System -source 'Microsoft-Windows-Kernel-General' -eventid 999 -message 'Kernel something or other'

get-winevent -filterHashTable @{Logname = 'System'; ID = '999'}| select-object -first 10

Maybe this picture explains it better. Notice the message column is blank.

Answer 1

The event is being written correctly, to read it back use this:

get-winevent -filterHashTable @{Logname = 'System'; ID = '999'}| 
    select-object -first 10 | select timecreated,providername,
    @{n="Message";e={$_.properties.Value}}

The reason you can't see it in the message column is evident when launching eventvwr :

The description for Event ID 999 from source Microsoft-Windows-Kernel-General cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If you want to write custom messages from custom sources use New-EventLog cmdlet, here is the Scripting Guy's tutorial: http://blogs.technet.com/b/heyscriptingguy/archive/2013/06/20/how-to-use-powershell-to-write-to-event-logs.aspx

Answer 2

Here is the snip that ended up making it work. Credit to Raf for the link where I found this answer.

$source = "Some Name"
If ([System.Diagnostics.EventLog]::SourceExists("$source") -eq $false)
{New-EventLog -LogName $log -Source "$source"}