PowerShell, Scripting, wmi, WQL
comments 6

Attaching scripts or tasks to Windows event log entries using PowerShell and WMI

During a few load test iterations on a SharePoint farm, I started seeing some SQL exceptions in the application log of SharePoint servers. If you are familiar with SharePoint platform, you may have seen these events such as event ID 3355. This event complains that the SharePoint server cannot connect to SQL server. This need not really mean that the DB server is offline. So, to find out the real reason behind these event logs, I needed to start some trace activities whenever event ID 3355 gets logged.

Initially, I was looking for eventtriggers.exe which is meant for attaching a script or task to an event log. However, I could neither find this on Windows Server 2008 R2 nor an external download. So, I wanted to look at other options I had.  I found that there are multiple ways to achieve this.

Attach to script or task to the event in Windows Event Viewer

You can find this option in event viewer. This link is available in the actions pane of event viewer upon selecting an event.

Attach Task or Script

However, this method is available only if the event log entry you are interested exists in the log. Which meant that, this wizard cannot be used to specify the event ID I wanted to monitor without actually pre-selecting the event entry. In my case, I cleared the even log after some tests and did not have the entry for ID 3355 in the application log. So, this method was not an option for me to attach a script to this specific event ID. By the way, this method create a scheduled task. This will appear under Event Viewer tasks in Task Scheduler.

Update: We can use Task Scheduler to create an event trigger. If you go to task scheduler and click on ‘Create Task’, you can select an event as the trigger and specify an event ID there. Take a look at the image below:

Task Scheduler

I did not use this technique. Instead, chose to use PowerShell to do this for me.

Create a WMI event subscription using Register-WMIEvent or Management Event Watcher .NET class in PowerShell

The System.Management.ManagementEventWatcher .NET class can be used to create an event watcher. This takes a WMI query and starts listening for any specified events. For example,

Or, Register-WMIEvent — available in PowerShell v2 — can do the same job.

The WMI query here simple. We just want to monitor Application log for any event with event code 3355. Both the above methods have a drawback. They are only temporary event consumers. A temporary event consumer exists only as long as the host is alive. The moment we close the PowerShell host, we lose these event subscriptions. However, I did not know when this even will happen again. So, I need the WMI event subscription to survive system reboots.

Create a permanent WMI event consumer in PowerShell

So, the best choice for me here was to create a permanent event consumer that can survive system reboots as well. I can create a WMI permanent consumer of command-line type in PowerShell.

You need to have the knowledge of WMI Query language to create WMI event consumers (permanent or temporary) in PowerShell.  If you are new to WMI or WMI query language, refer to my eGuide on ‘WMI Query Language via PowerShell‘ available at

As I explained in the last chapter of my WQL eguide, creating a WMI event consumer in PowerShell requires lot of typing. So, I chose a shortcut and used the PowerEvents module. This module provides an easy way to create WMI event consumers using cmdlets. So, as a solution to my event log monitoring problem, I used the following 4 lines of PowerShell code. 🙂

The above code is really self-explanatory. Whenever there is an event ID with a code 3355, this permanent WMI event consumer will trigger C:\debug\event.cmd which in turn starts a trace or some kind of logging.

This is it for today. Hope this is helpful.

Filed under: PowerShell, Scripting, wmi, WQL


Ravikanth is a principal engineer and the lead architect for Microsoft and VMware virtualized and hybrid cloud solutions within the Infrastructure Solutions Group at Dell EMC. He is a multi-year recipient of Microsoft Most Valuable Professional (MVP) award in Windows PowerShell (CDM) and Microsoft Azure. Ravikanth is the author of Windows PowerShell Desired State Configuration Revealed (Apress) and leads Bangalore PowerShell and Bangalore IT Pro user groups. He can be seen speaking regularly at local user group events and conferences in India and abroad.