Write-Eventlog -EventID 7036 Description Issue

Hi
I am attempting to write a service stop event to the system event log. An example of the command s I have been using is:
write-eventlog -logname system -source "Service Control Manager" -entrytype information -eventid 7036 -message "The server service has entered the stop state."
The event populates into the Correct log with the correct details with one exception, the description. The description on the general tab within the system log on Event Viewer displays:
The description for Event ID 7036 from source Service Control Manager cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the
local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
The Server service entered the stopped state.
the message resource is present but the message is not found in the string/message table
As opposed to the description when a manual stop of the Server Service is performed:
The Server service entered the running state.
I need the description to appear like it does when the manual stop is performed. Can someone tell me how (if) I can achieve this?
Thanks in advance.

This issue is described here: http://marcoshaw.blogspot.com/2010/10/using-write-eventlog.html
Mike Crowley | MVP
My Blog --
Planet Technologies

Similar Messages

Write-EventLog adds garbage text

Hi Guys,
My PowerShell rule writes an event:
Write-Eventlog -Logname "Operations Manager" -Source 'HealthService' -EventID 100 -EntryType Warning -Message "String `"$string`" has not been found in URL `"$url`" authenticated with username `"$user`" and password `"$password`"."
Also my correct script's output, the NT event always adds garbage text like this:
"The description for Event ID 100 from source HealthService cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can
install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event."
I'm using a source that I have confirmed that it is created. I have found that Stefan Stranger
here creates before the Source if it doesn't exist to avoid this error, but this is not my case.
Thanks in advance mates!

Hi Jonathan! thanks for your reply. It doesn't work, I receive same message:
The description for Event ID 100 from source HealthService cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install
or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
MY MESSAGE
the message resource is present but the message is not found in the string/message table
I think that The registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Operations
Manager\HealthService\EventMessageFilepoints to a file that contains valid sources, messages and IDs.
In that case, the string value for this registry key is "E:\Program Files\System Center 2012\Operations Manager\Server\HealthServiceMessages.dll;C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE"
I'm going to try to add my own source in "Operations Manager", something like this:
$source = "Test"
$log = "Operations Manager"
if ([Security.Diagnostics.EventLog]::SourceExists($source) -eq $false)
write-host "Creating event source $source on event log $log"
[Security.Diagnostics.EventLog]::CreateEventSource($source, $log)
write-host -foregroundcolor green "Event source $source created"
else
write-host -foregroundcolor yellow "Warning: Event source $source already exists. Cannot create this source on Event log $log"
But I don't know what is the name for "Operations Manager" log. Instead of:
Security.Diagnostics.EventLog
Something like this (it doesn't work)
'Operations Manager'.Diagnostics.EventLog
Does someone how to do this?
If I add a new Source manually the garbage text doesn't appear:
New-EventLog -LogName "Operations Manager" -Source "SCOM Team"

Write-EventLog from a command line using a variable for -Message

My apologies for the possibly confusing title of this post, so let me explain...
My ultimate goal is to capture log information during the execution of a batch script and write it to the Application log. Simple, you might think? I couldn't figure it out in batch so gave up and moved on to try using PowerShell via
the @powershell command.
I started with the following test, which worked like a charm:
@PowerShell -NoProfile -command "Write-EventLog -LogName Application -Source MyApp -EntryType Information -EventID 99 -Message "Test1" -ComputerName MyServer"
Great I thought, now how to capture multiple "events" as my batch script executes so that I can write them all in one go to the Application log using a single @powershell command. Capturing multiple lines of text in an environment variable
was a struggle and I wasn't even sure if I could then use the environment variable in the PowerShell command, so I tried writing the events to a text file with the intend of reading that text file using Get-Content, and then writing it to the event log.
So test #2 went like this:
@PowerShell -NoProfile -command "$OutText = 'Some text';Write-EventLog -LogName Application -Source MyApp -EntryType Information -EventID 99 -Message $OutText -ComputerName MyServer"
This worked, and "Some text" was successfully written to the event log entry, so the last step was to read my entries from the text file and write them instead:
For reference, the text file looked like this:
Test Entry 1
Test Entry 2
Test Entry 3
@PowerShell -NoProfile -command "$OutText = Get-Content .\TestLog.txt;Write-EventLog -LogName Application -Source MyApp -EntryType Information -EventID 99 -Message $OutText -ComputerName MyServer"
Unfortunately I failed at the last hurdle as PowerShell didn't seem to like, I am guessing, the CRLFs in the text file?
Write-EventLog : Cannot convert 'System.Object[]' to the type 'System.String'
required by parameter 'Message'. Specified method is not supported.
At line:1 char:211
+ ... yServer -Message $OutText
+                    ~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Write-EventLog], Parameter
   BindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Comma
   nds.WriteEventLogCommand
Any suggestions on how to solve my dilemma, either by solving the last step, or maybe by taking a different approach?
Many thanks, in advance,
Andy

Here is how we write to the event log from a batch file. It is easy and more flexible than howyou are doing this:
eventcreate /?
eventcreate /L application /SO MyApp /ID 99 /D %messagetext% /S MyServer
Adding one big block of text to the event log is not how the EL can work. The message size is limited.
The Event Log should not be used as a general tracing log on a regular basis. It should be used to log errors that are critical and to log critical small pieces of information.
Why use batch if you have access to PowerShell. It is far less flexible and muc harder to manage.
¯\_(ツ)_/¯

Write-EventLog add a list with filter to EventViewer?

Hi
I have created a scriptblock that will merge some files from shared folder to a one specific file on the server. On top of that i will also need the information of which files(list of all files)that have been merged
and send that information to EventViewer. (notice! I haven't paste the whole script)
I have used this
$date = Get-Date -Format "yyyyMMdd"
$server = C:\
$logFile = "MergeFileMT535-$date.log"
$basePath = 'MergeFile\
$list = Get-Content -path $server$basePath$logFile
Write-EventLog -LogName Application -EntryType Information -Source MQMergeFile -EventID 10 -Message $server$basePath$list
But it does not work as I've thought.
How can I filter out some columns in the list sent to EventViewer. The log in EventViewer should only present some columns e.g. Name and TimeStamp. Should i create a separate list for that or what should i do? Anyone have an idé?? Please
help..with any command.
Br Peraya

Hi,
Please try using the following command:
$message = gc -path $server$basePath$logFile|Select-String "Name|TimeStamp"
Reference article:
http://powershell.com/cs/blogs/tips/archive/2013/06/25/use-select-string-for-fast-textfile-parsing.aspx
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

I have a Windows 7 Professional, 64 bits on my computer and have recently installed iTunes 11.1.3.8. but i started having this msg :"The folder iTunes is on a locked disk or you do not have write permission for this folder" issues: how can i solve it?

I have a Windows 7 Professional, 64 bits on my computer and have recently installed iTunes 11.1.3.8. but i started having this msg :"The folder iTunes is on a locked disk or you do not have write permission for this folder" issues: how can i solve it?

Right-click on your main iTunes folder and click Properties, then go to the Security tab and click Advanced. If necessary grant your account and SYSTEM full control of this folder, subfolders and files, then tick the option to replace permissions on child objects which will repair permissions throughout the library. This is the XP dialog but Windows 7 shouldn't be too different.
If it won't let you change the permissions use the Owner tab to take ownneship from an account with administror privileges.
tt2

Write-eventlog on remote computer

I am trying to write an event to an eventlog on a remote computer. If the user that log's in to the remote computer (using Enter-PSSession) is in the 'local administrators' group on the remote computer, I can write successfully to the remote eventlog.
If the user is not in the 'local administrators' group on the remote computer I get the message:
The registry key for the log "Application" for source "FTPS" could not be opened.
I have tried the following:
- changing permissions in the registry
- adding the user to all other 'local' users group except the administrators group
- enabling firewall rules "Remote Eventlog...."
I have also tried the following command:
write-eventlog -computername computername -logname logname -source
source
Again, this only works if the user that is connecting to the remote computer is an local administrator.
Can anybody help me with this problem?
Kind Regards,

This is because the event log is not intended to be used for ad-hic logging. A process must be registered for logging and it must use a source that is unique. Admins can override this to some degree.
The Enter-PsSession is already logged in the event log. It will have all needed information. It should be in the WInRM event log. YOu do not need to also write an event.
\_(ツ)_/

GR55 Description issue

Hello Gurus,
I am trying to execute GR55 with a group of profit centers.
In report output some times i am not getting description of profitcenter and with same user id and password and on same machine i am getting with proper description. This issue is occuring once in a while.
Any idea how to rectify this issue?
Thanks,
Hari

Check the below
Go to GRR2
Select your Report
Menubar -> Formatting - Report Layout -> Lead Column
Select "Description"
Lead column - Width - 50
Now try to execute
GR55 - Execute - Double click on your report
Tahnks

SCSM 2012 - creating incident fro email - description issue

Hello, I have SCSM 2012 RTM and I am trying to use out-of-the-box create incident from e-mail functionality.
It is working but I have issue with description field of created incident- it comes with the last part of the eml file.
Description field of Incident looks like :
-_000_47499D6C4A5DAE4EB0FF86A4F6184D7EFB0023D9ex2010mbx1podra_
Content-Dis; filename="winmail.dat"
Content-Transfer-Encoding: base64 .....
I can not use Exchange Connector because I can not install SP1 for SCSM 2012 - Service Manager databases are on SQL 2008 - which is not supported for SP1 for SCSM 2012.
Any help is welcome.
Best regards,
Dubravko

Thanks for your reply, but my Service manager databases are on consolidated SQL 2008 SP2 cluster.
SQL 2008 SP2 is not supported for SCSM 2012 R2. Because on that SQL 2008 SP2 cluster are also other bussiness databases which has some compatibility issues I can not do the upgrade to SQL 2008 R2.
Best regards,
Dubravko

SCSM 2012 - creating incident from email - description issue

Hello, I have SCSM 2012 RTM and I am trying to use out-of-the-box create incident from e-mail functionality.
It is working but I have issue with description field of created incident- it comes with the last part of the eml file.
Description field of Incident looks like :
-_000_47499D6C4A5DAE4EB0FF86A4F6184D7EFB0023D9ex2010mbx1podra_
Content-Dis; filename="winmail.dat"
Content-Transfer-Encoding: base64 .....
I can not use Exchange Connector because I can not install SP1 for SCSM 2012 - Service Manager databases are on SQL 2008 - which is not supported for SP1 for SCSM 2012.
Any help is welcome.
Best regards,
Dubravko

Thanks for your reply, but my Service manager databases are on consolidated SQL 2008 SP2 cluster.
SQL 2008 SP2 is not supported for SCSM 2012 R2. Because on that SQL 2008 SP2 cluster are also other bussiness databases which has some compatibility issues I can not do the upgrade to SQL 2008 R2.
Best regards,
Dubravko

Anyone have PDF Writer or print to PDF issues following iTunes installation?

Since initially loading iTunes on my laptop, I can no longer print to a PDF utilizing my PDF Writer software. I don't believe it is a coincidence, as nothing else changed around the same time frame. Has anyone else experienced this and if so, what was the fix?
Thanks!

Thanks for your suggestion, I however tried that a couple weeks ago. But, the issue was indeed in the cryptographic dlls. I had overlooked one line in Filemon output that stated slbRcCsp.dll was missing. Looking the dll up in google resulted in a page in another forum which directed me to this: http://docs.info.apple.com/article.html?artnum=305999
Replacing slbRcCsp.dll from dllcache and re-registering other dlls as instructed in the article solved my issue. Hooray!
And a big warm thanks to you polydorus for pointing me to the direction of Filemon. Without your help I'd still have a non-working itunes

Travel description Issue

Hi Experts
Am facing an issue for few exp types ;when i am trying to create trip details in PR05 , after selecting the expense type i used to enter the Mandatory Description details...(i.e Additional info pop up) i could not see description pop up window now ? please advice..
Shan
Edited by: »» ShäN* ♫ on May 17, 2011 7:05 PM

Hi Shan,
Check V_T706B1_B. Give Trip Provision Variant. Double Click on required Expense Type and Make sure the description field is made as Required.
Hope this would solve your problem.
Thanks,
Praisty

Description issue: Role Import in CUP from ERM

Hi All
While importing roles from ERM in CUP, the description column shows some numeric values in some strange sequence (like 0,1,10,100,1000,1001,1002,1003, and so on). In ERM, roles were uploaded from backend using Mass role Import and Role description are properly available there. For the roles created in ERM itself, correct description is available, when imported in CUP.
Not able to understand this....Please suggest
Thanks
Abhijeet

Hi Abhijeet,
I have found out the cause of this issue.
This issue is coming for those roles which doesn't have detailed description in ERM.
In ERM you can see role name, Role description and also role detailed description.
If the role's detailed description is null in ERM then after importing that role into CUP the description of that particular role will become four digit numeric character. So, We can't say it is a bug because the program is witten like this.
You can see this detailed description in role in the backend ECC system using pfcg.
I hope you understand the point what I wanted to say.
Thanks,
Sudip

M-Series read + Write, threading or async , performance issues

I have a slightly unusual issue: Using 2 USB-6251 and 2 USB-6015 within the same application.
1 of the USB-6251s reads data on a 50 msec look (Driven by an async timer).
Depending on the input the code decides to output a 40 Hz, 300 usec waveform of varying amplitude - the output goes one until there is a user event that might make it stop.
Now , here is the problem. I have implemented the output function using a sepereate high priority thread and the delay( delay_in_sec) command.
I find that while the data acquisition timer is NOT running the frequency of the output is very close to 40 Hz. When the data acquisition IS running , the frequency of the output varies considerably - most likely reflecting USB delays.
I was able to see the output 40Hz, 300 usec waveform using a seperate app using a single async timer w/o any data acq and the timing was immaculate.
My questions are:
1. Could I use 2 different async timers in the same app - I tried to do this and the output was still wacky when I turned data acquisition on
2. Is there any way outside the delay() command that could improve the timing accuracy of the analog output thread?
3. I measured the time to create a 300 usec pulse of a certain amplitude, write it to the USB-6251 and start the task and it was ~ 13 msec. This is way too slow for 300 samples at 1 MHz - is it a USB bus limitation, or I should look at my design to see what is going on?
4. Any NI hardware that would allow me to handle 4 analog outputs more gracefuly? (FYI, 2 of my outputs are at 1 MHz and 2 of them at 50 Hz).
Thanks
AP

THanks for taking the time to look at my message.
I am using 4 DAQs. First one, USB-6251 is used to collect data (4 analog inputs @ 20Hz) and also occasionally provide analog output @ 1 MHz.
Second DAQ is a USB-6251 occasionally provide analog output @ 1 MHz.
Third and Fourth DAQ areUSB-6015 occasionally providing analog output @ 50 Hz.
All devices are connected via USB to a Dell Dual Core notebook.
THis is how I create & configure the analog output channels - using 1 task per device.
                    DAQmxErrChk(DAQmxCreateAOVoltageChan(TaskAnalogX,channelstring , "Ramp 1",0 , 10, DAQmx_Val_Volts, ""));
                   DAQmxErrChk(DAQmxCfgSampClkTiming(TaskAnalogX, "",1MHz OR 50Hz, DAQmx_Val_Rising, DAQmx_Val_FiniteSamps     , SECONDS*1MHz));
                   DAQmxErrChk(DAQmxWriteAnalogF64 (TaskAnalog1, ( int32 )SECONDS*1MHz OR 50Hz ), 0, DAQmx_Val_WaitInfinitely, DAQmx_Val_GroupByChannel , PHAOarr, &sampsPerChanWritten, NULL));
THe design/architecture is pretty complex but on a very high level whenever I need to deliver analog output I configure the output waveforms and then write it to the DAQs and then use some timers/logic to deliver the waveform from the DAQ as needed.
Now the challenge has been that in one specific case I need to deliver analog output of uknown duration (whereas everything else is deterministic). In that case i created a seperate thread and write each 300 usec pulse individually to the analog output (using USB 6251)using the following tASK:
                    DAQmxErrChk(DAQmxCreateTask("Tonic Output Task", &TaskTonic));
                   DAQmxErrChk(DAQmxCreateAOVoltageChan(TaskTonic, channelstring , "PulseToPulse",0 , 10, DAQmx_Val_Volts, ""));
                   DAQmxErrChk(DAQmxCfgSampClkTiming(TaskTonic, "",1.0E+06, DAQmx_Val_Rising, DAQmx_Val_FiniteSamps , 301));
As described in my first message this is very sensitive to timing and it takes 13 msec to stop the task , write the array to the DAQcard and then start the task again.
On the hardware timing recommendation. I tried to configure the DAQ using the DAQmx_Val_HWTimedSinglePoint samplemode but it seems not to be supported by the hardware I am using. Is there a CVI example of using hardware timing that I can take a look at?
THanks
AP
Hi AP,
My first impression is that you would want to use hardware timing
rather than software timing. Try using a DAQmx Timing command and
specify the rate there. Aside from that, could you be more specific
about your application? How do you have your hardware set up and which
devices are handling each part of the task? How are you generating the
output?
Regards,
Joe S.

Mega 180: MSI DVD Writer DR-16B and other issues...

I just get hand on a MSI DVD Writer DR-16B and installed it on my Mega PC unfortunatelly whenever i open the tray using the mega pc front panel button it will hang my mega pc badly and i have to reboot.
However i found a trick: It will not hang if i open the DVD using the Drive button, it is not convenient but at last works...
Other issue i have with my Mega PC:
* If i connect my USB bluetooth dongle the mega PC will not boot
* Sometimes after booting i loose the sound (nvmixer wont load complaining there is no nforce sound chipset on my mega pc !!) and i have to unplug the power for a while to get it back
* The remote control is crappy unless you can stay 2 meter and aim exactly at the mega pc...anybody found a replacement ??
* The last one was one of my RAM was corrupted and make my PC crash every days or so and corrupt some of my files on the HD :( :( it took me 3 months to find the problem....
Do you know if MSI have any plan to fix these issues some days ??? i am getting tired and thinking of replace my Mega PC with some shuttles ....

Thanks for the advice and here are my reply:
For DVD i want a 16x DVD writer i already tried several devices out there and this one will be my latest try..i can accomodate to eject with the drive button for now...I was hopping that using a MSI model would make it compatible but this one is not... :(
For missing sound devices i use the latest nforce drivers and i already found the root cause on this forum, it seems that if you start the PC when the HIFI mode is already open it will lock the sound device in HIFI and the PC mode cannot find it. The solution is to switch off HIFI mode BEFORE going PC mode...well weird
For USB bluetooth well it would have been nice to leave it all the time because i use it to synch my sony erricson P900 anyway i heard that it is a bios firmware problem so i am back to sync with the phone craddle (USB craddle but this one will not freeze the boot) The USB bluetooth is a PCI GW-BH02U.

Email attachment description issue

Hi Gurus,
Our issue is not really BI but we're not sure which other forum to post it under:
We're broadcasting to burst PDF reports to an internal web portal (not BI Portal). The portal has Sharepoint as backend, which is having problems parsing the attachment file because SAP's email service is appending a description tag to the email. This tag has the name of the file without the .pdf. Sharepoint reads this tag and thinks the file has no extension.
This description field can be seen in SAP Business Workplace (SBWP) /New Message/Create Attachment../Attachments tab. Does anyone know how to modify this field so it includes the file extension, or remove this field altogether when the email is sent?
Thanks in advance!

HI,
From the Safari Menu Bar click Safari/Preferences then select the Security tab. Click: Show Cookies
Delete all AT&T cookies. Relaunch Safari. Try sending an e-mail w/attachment. If you still have problems, go to the Safari Menu Bar, click Safari/Reset Safari. Select the first 7 buttons, click Reset.
Now try again. If you still can't send an attachment, Go to the Safari Menu Bar, click Safari/Preferences. Make note of all the preferences under each tab. Quit Safari. Now go to ~/Library/Preferences and move this file com.apple.safari.plist to the Desktop.
Relaunch Safari and see if that makes a difference. If not, move the .plist file back to the Preferences folder. If Safari functions as it should, move that .plist file to the Trash.
And repair disk permissions...
Launch Disk Utility. (Applications/Utilities) Select MacintoshHD in the panel on the left, select the FirstAid tab. Click: Repair Disk Permissions. When it's finished from the Menu Bar, Quit Disk Utility and restart your Mac. If you see a long list of "messages" in the permissions window, it's ok. That can be ignored. As long as you see, "Permissions Repair Complete" when it's finished... you're done. Quit Disk Utility and restart your Mac.
Carolyn

Write-Eventlog -EventID 7036 Description Issue

Similar Messages

Maybe you are looking for