使用XPath启动或包含搜索Windows事件日志的函数

Question

通过在Windows事件查看器中手动编辑XML过滤器查询,我可以找到数据与字符串完全匹配的事件:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[EventData[Data and (Data="Session end: imzcjflrrsq1sfdk3okc4jpf")]]</Select>
  </Query>
</QueryList>

现在,我想做一个部分匹配:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[EventData[Data and (Data[starts-with(.,"Session")])]]</Select>
  </Query>
</QueryList>

事件日志给我错误:

指定的查询无效

我的语法有错吗？

Answer 1

Windows事件日志支持XPath 1.0的子集.它仅包含3个功能:position,Band,timediff.

参考:http://msdn.microsoft.com/en-us/library/windows/desktop/dd996910(v=vs.85).aspx#limitations

Answer 2

如果你不介意两遍,你总是可以使用PowerShell脚本作为其重新过滤的数据          -where运营商支持-like,-match以及-contains:

nv.ps1

$Query = @"
  <QueryList>
    <Query Id="0" Path="System">
      <Select Path="System">
        *[System[(EventID=20001)]]
      </Select>
    </Query>
  </QueryList>
"@

$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
    # Convert the event to XML
    $eventXML = [xml]$Event.ToXml()
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  Data -Value $eventXML.Event.EventData.Data
}
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView
pause

用于启动它的cmd(nv.cmd):

powershell.exe -executionpolicy bypass "& '.\nv.ps1'"