为错误写入事件日志

Question

When running the following one liner:

Write-EventLog -LogName Application -Source 'Application Error' -EntryType Error -EventID 1001 -Message 'Problem description'

We see the entry in the log Application :

According to Microsoft for EventID 1001, one should provide the values for %1, %2 and %3:

Detection of product '%1', feature '%2' failed during request for component '%3'

How is this possible in PowerShell? When adding the switch -RawData 10, 20 only the type is filled in as following:

Is there a way to not have the other text available without creating a new log name or source in the Event log? Or to be able to fill in the variables? I'm writing to Application error in case the custom made log name or source isn't available. So there is somewhere a trace.

Thank you for your help.

Answer 1

The Event ID 1001 description you link to is specific to the MsiInstaller source.

For your own custom error events, use a custom Source identifier. You can check whether a source definition already exists on the machine, and if not, create it:

$CustomSource = 'MyCustomApplication'

# Wrap check i try/false to catch SourceExists() throwing access denied on failure
$SourceExists = try {
    [System.Diagnostics.EventLog]::SourceExists($CustomSource)
} catch {
    $false
}

if(-not $SourceExists)
{
    # Create the Source definition
    New-EventLog -Source $CustomSource -LogName Application
}

Write-EventLog -LogName Application -Source $CustomSource -EntryType Error -EventID 1001 -Message 'Problem description'

If you have a message resource file (the file containing the "templates" for your events), you can also include that in the call to New-EventLog