Export (0) Print
Expand All

New-PefEventLogTrigger

Windows Server 2012 R2 and Windows 8.1

Updated: September 10, 2014

Applies To: Windows 8.1, Windows PowerShell 4.0, Windows Server 2012 R2

New-PefEventLogTrigger

Creates a trigger that signals when an event log logs an entry.

Syntax

Parameter Set: Default
New-PefEventLogTrigger [-LogName] <String> [-CheckTimerPeriodMs <Int32> ] [-EventId <Int32> ] [-EventSourceName <String> ] [-MachineName <String> ] [-Repeat] [ <CommonParameters>]




Detailed Description

The New-PefEventLogTrigger cmdlet creates a trigger that signals when a specified entry is logged in an event log. An event log trigger waits for a specific event from the System log, Application log, or Security log. You can monitor a remote computer or the local computer. The trigger becomes active when you associate it to a Protocol Engineering Framework (PEF) action.

Parameters

-CheckTimerPeriodMs<Int32>

Specifies how often, in milliseconds, to check for an event. The trigger checks whether the specified log contains the event. The default value is 2000 ms.


Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-EventId<Int32>

Specifies the event ID of the event to wait for. If you do not specify an ID, the trigger waits for an event with any ID.


Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-EventSourceName<String>

Specifies the source name of the event to wait for. If you do not specify a name, the trigger waits for an event with any source name.


Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-LogName<String>

Specifies the name of the event log to check. The acceptable values for this parameter are: 

-- Application
-- Security
-- System


Aliases

none

Required?

true

Position?

1

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-MachineName<String>

Specifies the name of the computer to monitor for the event. The default value is the local computer.


Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-Repeat

Indicates that the trigger runs on each occurrence of the event. If you do not specify this parameter, the trigger runs only once.


Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

<CommonParameters>

This cmdlet supports the common parameters: -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer, and -OutVariable. For more information, see    about_CommonParameters.

Inputs

The input type is the type of the objects that you can pipe to the cmdlet.

Outputs

The output type is the type of the objects that the cmdlet emits.

Examples

Example 1: Create an event log trigger that stops a trace session

This example creates an event log trigger, and then associates it to a Trace Session. The Trace Session stops when the trigger finds the specific event in the Application log.

The first command creates a trigger object for an Application log event from the PEFTestSource source, and then stores it in the $Trigger01 variable.

The second command uses the New-PefTraceSession cmdlet to create a Trace Session object, and then stores it in the $TraceSession01 variable.

The third command uses the Add-PefMessageSource cmdlet to specify a provider for the session that is stored in the $TraceSession01 variable.

The fourth command uses the Stop-PefTraceSession cmdlet to create a stop action for the event log trigger that is stored in the $Trigger01 variable, and associates that action with the session that is stored in the $TraceSession01 variable.

The final command uses the Start-PefTraceSession cmdlet to start the Trace Session that is stored in the $TraceSession01 variable.


PS C:\> $Trigger01 = New-PefEventLogTrigger -LogName "Application" -EventSourceName "PEFTestSource" -EventID 1234
PS C:\> $TraceSession01 = New-PefTraceSession -Mode Circular -Force -Path "C:\Traces\EventLog" -TotalSize 50 -SaveOnStop 
PS C:\> Add-PefMessageSource -PEFSession $TraceSession01 -Source "Microsoft-Pef-WFP-MessageProvider"
PS C:\> Stop-PefTraceSession -PEFSession $TraceSession01 -Trigger $Trigger01
PS C:\> Start-PefTraceSession -PEFSession $TraceSession01

Related topics

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft