Issues with NTEventLogEventConsumer

Hi, 

I am trying to create WMI permanent event subscription using MOF.

I have created an event provider which provides around 10 properties along with a custom event ID which I want to write to the event log.

I tried using NTEventLogEventConsumer. I am able to receive the 10 properties which I have specified in InsertionStringTemplates. However, NTEventLogEventConsumer instance does not allow customizing EventID through mof. Also for any EventID it gives the description -

The description for Event ID 1234 from source xyz cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

How can this description be customized or removed completely?

August 21st, 2015 6:41am

We would not do it this way in PowerShell or in modern Windows.

Go to the eventlog and right click on any event. Select to create a task and define a script task. modify the event XML to pass the event data to the script.

http://blogs.technet.com/b/wincat/archive/2011/08/25/trigger-a-powershell-script-from-a-windows-event.aspx

Free Windows Admin Tool Kit Click here and download it now
August 21st, 2015 11:40am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics