xml 使用 XPath 开始或包含函数来搜索 Windows 事件日志
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8671194/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Using XPath starts-with or contains functions to search Windows event logs
提问by Keith Walton
By editing the XML filter query manually in Windows event viewer, I can find events where the data matches a string exactly:
通过在 Windows 事件查看器中手动编辑 XML 过滤器查询，我可以找到数据与字符串完全匹配的事件：
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[EventData[Data and (Data="Session end: imzcjflrrsq1sfdk3okc4jpf")]]</Select>
</Query>
</QueryList>
Now, I want to do a partial match:
现在，我想做一个部分匹配：
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[EventData[Data and (Data[starts-with(.,"Session")])]]</Select>
</Query>
</QueryList>
Event log gives me the error:
事件日志给了我错误：
The specified query is invalid
指定的查询无效
Do I have the syntax wrong?
我的语法错误吗？
采纳答案by Kirill Polishchuk
Windows Event Log supports a subset of XPath 1.0. It contains only 3 functions: position, Band, timediff.
Windows 事件日志支持 XPath 1.0 的一个子集。它只包含 3 个函数：position、Band、timediff。
Reference: https://docs.microsoft.com/en-us/windows/desktop/WES/consuming-events#xpath-10-limitations
参考：https: //docs.microsoft.com/en-us/windows/desktop/WES/sumption-events#xpath-10-limitations
回答by Richard Sandoz
If you don't mind two passes, you can always use a powershell script to re-filter the data as its -whereoperator supports -like, -match, and -contains:
如果你不介意两遍，你总是可以使用PowerShell脚本来重新过滤的数据作为其 -where运营商的支持-like，-match以及-contains：
nv.ps1
ps1
$Query = @"
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">
*[System[(EventID=20001)]]
</Select>
</Query>
</QueryList>
"@
$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = [xml]$Event.ToXml()
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name Data -Value $eventXML.Event.EventData.Data
}
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView
pause
A cmd to launch it (nv.cmd):
启动它的 cmd (nv.cmd)：
powershell.exe -executionpolicy bypass "& '.\nv.ps1'"
回答by js2010
A quick powershell to search for session* in data. Even if data were an array, this should work.
在数据中搜索 session* 的快速 powershell。即使数据是一个数组，这也应该有效。
get-winevent application | where { $xml = [xml]$_.toxml()
$xml.event.eventdata.data -like 'session*' } | select -first 3
ProviderName: Microsoft-Windows-Winlogon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
2/22/2020 11:05:30 AM 6000 Information The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
2/22/2020 11:05:30 AM 6003 Information The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.
2/21/2020 6:28:38 PM 6000 Information The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
$xml.event.eventdata.data # the last one
SessionEnv
If you don't need the precision, it's easier to match on the message, which the data fields often appear in.
如果您不需要精度，则更容易匹配数据字段经常出现在其中的消息。
get-winevent application | where message -match session
