1. PowerShell event processing usually has three steps: publishing events, subscribing events, and processing events
2. Commands related to PowerShell events are:
- Register-ObjectEvent
- Register-EngineEvent
- Register-WmiEvent
- Register-CimIndicationEvent
- Unregister-Event
- Get-Event
- New-Event
- Remove-Event
- Wait-Event
- Get-EventSubscriber
[1] Publish events through Net-Event. The events published by this command are all EngineEvents, which can be subscribed through the Register-EngineEvent command. The relevant parameters to be sent to the handler can be specified in this command
[2] The first four commands that start with Register and end with Event are all commands used to subscribe to events, and the fifth command is used to unsubscribe.
[3] You can obtain the established event subscriber object through Get-EventSubscriber, which is the object returned after Register-*Event is executed.
[4] If the Action parameter is not specified when subscribing to an event, then when the subscribed event is triggered, the event information will be stored in the PowerShell event queue as an object. You can obtain the event information object of a specific event through the Get-Event command. , you can also use the Remove-Event command to remove the event object from the event queue, you can also use the Wait-Event command to wait for an event to occur, and the script will block and hang
[5] If the Action parameter is specified when subscribing to an event, then after the event is triggered, the event information will be packaged into the ScriptBlock specified by the Action parameter in a series of automatic variables. The ScriptBlock can have a return value or not. You can pass To access the subscription object (such as $es) returned by the subscription command, the return value of the ScriptBlock: $es.Action.Output, which contains all the return values of the ScriptBlock
[6] In addition to the three built-in event sources, EngineEvent comes from the events customized by the user through New-Event. Except for these customized events, the triggering of the events of the other three event source sets is not up to you. , you can only subscribe to them, process them
3. The event object is the basis for handling events. Before actually handling events, you must be familiar with this object
The following is an example of an event object
Here's the help for the event object:
The Get-Event cmdlet returns a PSEventArgs object (System.Management.Automation.PSEventArgs) with the following properties.
-- ComputerName: The name of the computer where the event occurred. This property value is only populated when the event is forwarded from a remote computer.
-- RunspaceId: A GUID that uniquely identifies the session in which the event occurred. This property value is only populated when the event is forwarded from a remote computer.
-- EventIdentifier: An integer (Int32) that uniquely identifies event notifications in the current session.
-- Sender: The object that generated the event. In the value of the Action parameter, the $Sender automatic variable contains the sender object.
-- SourceEventArgs: The first argument derived from EventArgs, if present.
For example, in a Timer Elapsed event with a signature of the form "Object sender, Timers.ElapsedEventArgs e" , the SourceEventArgs property contains Timers.ElapsedEventArgs. In the value of the Action parameter, the $EventArgs automatic variable contains this value.
[The help of the original 2.0 version is wrong, it specifies $SourceEventArgs, and the 5.0 help specifies that $EventArgs contains this value, or the later version has been modified]
-- SourceArgs: All parameters of the original event signature. For standard event signatures, $Args[0] represents the sender and $Args[1] represents the SourceEventArgs. In the value of the Action parameter, the
$Args automatic variable contains this value. [There is an error in the help file of the original 2.0 version, the 5.0 version specifies $Args, or it is due to the modification of the later version]
-- SourceIdentifier: String used to identify the event subscription. In the value of the Action parameter, the SourceIdentifier property of the $Event automatic variable contains this value.
-- TimeGenerated: A DateTime object representing the generation time of the event. In the value of the Action parameter, the TimeGenerated property of the $Event automatic variable contains this value.
-- MessageData: The data associated with the event subscription. The user specifies this data when registering for the event. In the value of the Action parameter, the MessageData property of the $Event automatic variable contains this value.
The summary is as follows:
[1] The available automatic variables in Action are: $Event/$Sender/$EventArgs/$Args
[2] From the $Event automatic variable, you can get ComputerName/RunspaceId/EventIdentifier/Sender/SourceEventArgs/SourceIdentifier/TimeGenerated/MessageData
[3] Although the $Event automatic variable object has the SourceArgs property, it cannot be accessed through $Event.SourceArgs, please use the $Args automatic variable to access this property
[4] Both $Sender and $Event.Sender are available access methods