[英]Unique identifier for an event in Event Log
I have a Windows Event Log file (.evt/.evtx) and I want to select a particular event from the Event Log using power shell. 我有一个Windows事件日志文件(.evt / .evtx),我想使用Power Shell从“事件日志”中选择一个特定的事件。 I see cmdlets like
我看到像这样的cmdlet
$provider = Get-WinEvent -listprovider $EventSource
$ProviderEvent = $provider.events | Where-Object {($_.ID -eq 4)}
to query the event log, but in my .evtx, there are multiple events with same ID. 查询事件日志,但是在我的.evtx中,有多个具有相同ID的事件。
Hence, my question is - how to pin point to an individual event, (using what fields)? 因此,我的问题是-如何确定指向单个事件(使用哪些字段)?
检查RecordId属性:
$provider.events | Where-Object {$_.ID -eq 4} | foreach {$_.RecordId}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.