EventLog Consumer : InsertionStringTemplates argument writes %1% to eventlog

Mar 28, 2011 at 11:27 AM


I use the following code

Import-Module PowerEvents
$MyFilter = New-WMIEventFilter -Name NICDisabledTrigger -Query "Select * from __InstanceModificationEvent within 2 Where TargetInstance ISA 'Win32_NetworkAdapter' AND TargetInstance.ConfigManagerErrorCode = 22"
$MyConsumer = New-WMIEventConsumer -Name NICDisabledActionner -ConsumerType EventLog -EventType Information -EventID 20 -SourceName MyAppLogSource -InsertionStringTemplates "Adapter %TargetInstance.Name% entered the state disabled"

New-WMIFilterToConsumerBinding -Filter $MyFilter -Consumer $MyCons

It checks if a network adapter has been disabled. The problem is that in the eventlog source MyAppLogSource (that already exists of course), the evnt is well created, but the description is %1%, instead of 'Adapter %TargetInstance.Name%....'

Do you know why ?


Thx a lot and good job btw

Aug 3, 2011 at 5:06 PM


Sorry I don't get notifications for these discussion messages unfortunately.

Anyway, the event log provider seems to need some sort of DLL to match event log messages to friendly names. I'm not sure exactly how to fix this, but I went ahead and implemented the capability anyway.

Trevor Sullivan