none
Get-Winevent doesn't return the Message field

    Question

  • Hi,

    I have a w2008R2 server acting as a print server. From the event viewer console, I can see details about each print job :

    I need to access these pieces of information from the commande line using Get-WinEvent but the message field does not get filled :

    PS C:\> Get-WinEvent -LogName "Microsoft-Windows-PrintService/Operational" | select message,timecreated,providername,id,taskdisplayname

    Message         : TimeCreated     : 24.02.2012 10:59:16 ProviderName    : Microsoft-Windows-PrintService Id              : 800 TaskDisplayName :

    PS C:\> Get-WinEvent -LogName "Microsoft-Windows-PrintService/Operational" | select -first 1 | select message | gm
       TypeName: Selected.System.Diagnostics.Eventing.Reader.EventLogRecord
    Name        MemberType   Definition ----        ----------   ---------- Equals      Method       bool Equals(System.Object obj) GetHashCode Method       int GetHashCode() GetType     Method       type GetType() ToString    Method       string ToString() Message     NoteProperty  Message=null
    PS C:\> (Get-WinEvent -LogName "Microsoft-Windows-PrintService/Operational" | select -first 1 | select message).message PS C:\>


    Any help appreciated

    Wednesday, February 29, 2012 9:54 AM

Answers

  • I have looked into the issue on several computers but have not been able to replicate it. It would be useful if we could describe a scenario in which this always occurs so we can find out is going awry here.

    Grant has a machine that he was working on but didn't respond to my suggestion about SP1. 

    There is also an update to Net 4.0 that may be the culprit.  On WIn7 and WS2008R2 the update shows up as optional.  Under WSUS it can be approved but is not automatically approved under the OS. I suspect this may be because it is a 'breaking' patch because it alters the behavior of PowerSHell and other system bits as well as any dependent programs.  It has a big effect on the ability to use XPath queries in Get-WinEvent.  Without the patch the XPath will fail under some circumstances.  I am sorry I didn't record the exact issues when I found them but assumed everyone else would see the patches.


    ¯\_(ツ)_/¯

    Friday, March 09, 2012 5:34 PM

All replies

  • Please see this thread.

    Rich Prescott | Infrastructure Architect, Windows Engineer and PowerShell blogger | MCITP, MCTS, MCP

    Engineering Efficiency
    @Rich_Prescott
    Windows System Administration tool
    AD User Creation tool

    Thursday, March 01, 2012 12:54 AM
    Moderator
  • I have looked into the issue on several computers but have not been able to replicate it. It would be useful if we could describe a scenario in which this always occurs so we can find out is going awry here.
    Thursday, March 01, 2012 8:43 AM
    Moderator
  • Have we decided it requires .NET 3.5 SP1? Having .NET 4.0 does not suffice.


    Richard Mueller - MVP Directory Services

    Friday, March 09, 2012 5:26 PM
    Moderator
  • I have looked into the issue on several computers but have not been able to replicate it. It would be useful if we could describe a scenario in which this always occurs so we can find out is going awry here.

    Grant has a machine that he was working on but didn't respond to my suggestion about SP1. 

    There is also an update to Net 4.0 that may be the culprit.  On WIn7 and WS2008R2 the update shows up as optional.  Under WSUS it can be approved but is not automatically approved under the OS. I suspect this may be because it is a 'breaking' patch because it alters the behavior of PowerSHell and other system bits as well as any dependent programs.  It has a big effect on the ability to use XPath queries in Get-WinEvent.  Without the patch the XPath will fail under some circumstances.  I am sorry I didn't record the exact issues when I found them but assumed everyone else would see the patches.


    ¯\_(ツ)_/¯

    Friday, March 09, 2012 5:34 PM
  • I have the full .net 4.0 installed.  3.5 is not supported for Windows 7 (according to the documentation), so I didn't attempt to install it on my Win 7 machine.  That's as far as that experiment went.

    Grant Ward, a.k.a. Bigteddy

    What's new in Powershell 3.0 (Technet Wiki)

    Friday, March 09, 2012 5:55 PM
  • Look for the update for Net 4.0.  It is an optional install.


    ¯\_(ツ)_/¯

    Friday, March 09, 2012 8:50 PM