Question

Sorry for bad english.

I have some troubles with powershell and events forwarding mechanism in it. Im trying to do something like this:

$remoteComputer = "."
$session = New-PsSession $remoteComputer

Unregister-Event CatchEvent -ErrorAction SilentlyContinue
Invoke-Command $session {

    ## The WMI query to detect a stopping service
    $query = @"
        SELECT *
        FROM __instancecreationevent
        WHERE TargetInstance ISA  Win32_NtLogEvent 
        and targetinstance.eventcode =  7036 
"@
    Register-WmiEvent -Query $query "CatchEvent" -Forward
}
$null = Register-EngineEvent CatchEvent -Action { $GLOBAL:MyEvent = $event}

$MyEvent variable at last contains not an event information, but a system.string class data. alt text http://eosfor.fileave.com/powershell.png

Whats wrong with this script?

Answer 1

Vasily Gusev gives me an answer.

$query = "SELECT * FROM __instancecreationevent WHERE TargetInstance ISA  Win32_NtLogEvent  AND TargetInstance.eventcode =  7036 "
Register-WmiEvent -Query $query -ComputerName client1 -Action {write-host "Service Stopped"}

again. sorry for bad english. just correct me if something wrong :)

友情链接