使用XPath开始 – 带或包含function来searchWindows事件日志

通过在Windows事件查看器中手动编辑XMLfilter查询,我可以find数据完全匹配string的事件:

<QueryList> <Query Id="0" Path="Application"> <Select Path="Application">*[EventData[Data and (Data="Session end: imzcjflrrsq1sfdk3okc4jpf")]]</Select> </Query> </QueryList> 

现在,我想做一个部分匹配:

 <QueryList> <Query Id="0" Path="Application"> <Select Path="Application">*[EventData[Data and (Data[starts-with(.,"Session")])]]</Select> </Query> </QueryList> 

事件日志给我的错误:

指定的查询无效

我的语法错了吗?

Solutions Collecting From Web of "使用XPath开始 – 带或包含function来searchWindows事件日志"

Windows事件日志支持XPath 1.0的一个子集。 它只包含3个函数: positionBandtimediff

参考: http : //msdn.microsoft.com/en-us/library/windows/desktop/dd996910(v=vs.85).aspx#limitations

如果你不介意-match ,你总是可以使用powershell脚本来重新过滤数据,因为它的运算符支持-like -match-match

nv.ps1

 $Query = @" <QueryList> <Query Id="0" Path="System"> <Select Path="System"> *[System[(EventID=20001)]] </Select> </Query> </QueryList> "@ $events = Get-WinEvent -FilterXml $Query ForEach ($Event in $Events) { # Convert the event to XML $eventXML = [xml]$Event.ToXml() Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name Data -Value $eventXML.Event.EventData.Data } $Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView pause 

一个cmd启动它(nv.cmd):

 powershell.exe -executionpolicy bypass "& '.\nv.ps1'"