| 0x1 | 記憶體不足。%0 |
Out of memory.%0 |
| 0x2 | 無法開啟輸出檔: %1!s!。%0 |
Failed to open output file: %1!s!.%0 |
| 0x3 | 無法開啟設定檔: %1!s!。%0 |
Failed to open config file: %1!s!.%0 |
| 0x4 | 不正確的設定檔。%0 |
Invalid config file.%0 |
| 0x5 | 無法從設定檔讀取。%0 |
Failed to read from config file.%0 |
| 0x6 | 無法初始化 COM。%0 |
Failed to initialize COM.%0 |
| 0x7 | 無法從設定檔讀取訂閱識別碼。%0 |
Failed to read subscription id from config file.%0 |
| 0x8 | 無法開啟訂閱。%0 |
Failed to open subscription.%0 |
| 0x9 | 無法儲存訂閱。%0 |
Failed to save subscription.%0 |
| 0xA | 已順利儲存訂閱，但目前無法啟用。請使用 retry-subscription 命令來重試訂閱。如果訂閱正在執行中，您也可以使用 get-subscriptionruntimestatus 命令來取得延伸錯誤狀態。 |
The subscription is saved successfully, but it can't be activated at this time.Use retry-subscription command to retry the subscription. If subscription is running,you can also use get-subscriptionruntimestatus command to get extended error status. |
| 0xB | 無法刪除訂閱。%0 |
Failed to delete subscription.%0 |
| 0xC | 無法開啟訂閱列舉。%0 |
Failed to open subscription enumeration.%0 |
| 0xD | 無法列舉訂閱。%0 |
Failed to enumerate subscriptions.%0 |
| 0xE | 無法取得 %1!s! 內容。%0 |
Failed to get %1!s! property.%0 |
| 0xF | 無法設定 %1!s! 內容。%0 |
Failed to set %1!s! property.%0 |
| 0x10 | 無法重試事件來源: %1!s!。%0 |
Failed to retry event source: %1!s!.%0 |
| 0x11 | 無法重試訂閱。%0 |
Failed to retry subscription. %0 |
| 0x12 | 不支援此格式。%0 |
Format is not supported.%0 |
| 0x13 | 不正確的傳遞模式 %d。%0 |
Invalid delivery mode %d.%0 |
| 0x14 | 不正確的內容格式 %d。%0 |
Invalid content format %d.%0 |
| 0x15 | 不正確的內容值 '%1!s!' (%2!s!)。%0 |
Invalid property value '%1!s!' (%2!s!).%0 |
| 0x16 | 不支援命令 %1!s!。%0 |
Command %1!s! is not supported.%0 |
| 0x17 | 不正確的選項 %1!s!。未指定選項名稱。%0 |
Invalid option %1!s!. Option name is not specified.%0 |
| 0x18 | 不正確的選項 %1!s!。選項已經被指定過一次以上。%0 |
Invalid option %1!s!. Option is specified more than once.%0 |
| 0x19 | 不正確的選項 %1!s!。選項不是整數。%0 |
Invalid option %1!s!. Option is not integer.%0 |
| 0x1A | 不正確的選項 %1!s!。未指定選項值。%0 |
Invalid option %1!s!. Option value is not specified.%0 |
| 0x1B | 不正確的選項 %1!s!。選項不是布林值。%0 |
Invalid option %1!s!. Option is not Boolean.%0 |
| 0x1C | 不正確的選項 %1!s!。不支援此選項。%0 |
Invalid option %1!s!. Option is not supported.%0 |
| 0x1D | 指定太多引數。%0 |
Too many arguments are specified.%0 |
| 0x1E | 未指定必要引數。%0 |
Required argument(s) is/are not specified.%0 |
| 0x1F | 內部錯誤。%0 |
Internal error.%0 |
| 0x20 | 無法讀取密碼。%0 |
Failed to read password.%0 |
| 0x21 | 未指定 EventSourceAddress。%0 |
EventSourceAddress is not specified.%0 |
| 0x22 | 未指定命令。%0 |
Command is not specified.%0 |
| 0x23 | 找不到此訂閱的事件來源。%0 |
No event source is found for this subscription.%0 |
| 0x24 | 設定檔的根節點不是訂閱，或其命名空間不正確。%0 |
Root node of config file is not Subscription or in correct namespace.%0 |
| 0x25 | 警告: 事件來源 %1!s! 已停用。%0 |
Warning: event source %1!s! is disabled.%0 |
| 0x26 | 訂閱 %1!s! 已存在。%0 |
Subscription %1!s! already exists.%0 |
| 0x27 | 如果事件來源 %1!s! 已存在，則無法新增。%0 |
Can not add event source %1!s! when it already exists.%0 |
| 0x28 | Windows Event Collector 公用程式可讓您建立與管理從支援 WS-Management 通訊協定的遠端事件來源所轉送來之事件的訂閱。使用方式:您可以使用短 (如，es, /f) 或長 (如 enum-subscription, /format) 版本的命令和選項名稱。命令、選項和選項值不會區分大小寫。(全部字母大寫 = 變數)wecutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]命令:es (enum-subscription) 列出現存的訂閱。gs (get-subscription) 取得訂閱設定。gr (get-subscriptionruntimestatus) 取得訂閱執行階段狀態。ss (set-subscription) 設定訂閱設定。cs (create-subscription) 建立新訂閱。ds (delete-subscription) 刪除訂閱。rs (retry-subscription) 重試訂閱。qc (quick-config) 設定 Windows Event Collector 服務。常用選項:/h|? (help)取得 wecutil 程式的一般說明。wecutil { -help | -h | -? }若要了解引數和選項，請參閱特定命令的使用方式:wecutil COMMAND -? |
Windows Event Collector UtilityEnables you to create and manage subscriptions to events forwarded from remoteevent sources that support WS-Management protocol.Usage:You can use either the short (i.e. es, /f) or long (i.e. enum-subscription, /format)version of the command and option names. Commands, options and option values arecase-insensitive.(ALL UPPER-CASE = VARIABLE)wecutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]Commands:es (enum-subscription) List existent subscriptions.gs (get-subscription) Get subscription configuration.gr (get-subscriptionruntimestatus) Get subscription runtime status.ss (set-subscription) Set subscription configuration.cs (create-subscription) Create new subscription.ds (delete-subscription) Delete subscription.rs (retry-subscription) Retry subscription.qc (quick-config) Configure Windows Event Collector service.Common options:/h|? (help)Get general help for the wecutil program.wecutil { -help | -h | -? }For arguments and options, see usage of specific commands:wecutil COMMAND -? |
| 0x29 | 建立遠端訂閱。使用方式:wecutil { cs | create-subscription } CONFIGURATION_FILE [/OPTION:VALUE [/OPTION:VALUE] ...]CONFIGURATION_FILE指定包含訂閱設定的 XML 檔案之路徑的字串。此路徑可以是目前目錄的絕對或相對路徑。選項:您可使用短 (如 /cun) 或長 (如 /CommonUserName) 版本的選項名稱。選項與其值不區分大小寫。/cun:USERNAME (CommonUserName)為本身沒有使用者認證的事件來源設定共用使用者認證。此選項只適用於收集器起始訂閱。注意: 如果指定此選項，則會忽略設定檔中個別事件來源的UserName/UserPassword 設定。若想針對特定事件來源使用不同的認證，請針對該事件來源使用 ss (set-subscription) 命令來設定。/cup:PASSWORD (CommonUserPassword)設定共用使用者認證的使用者密碼。當 PASSWORD 設為 * (星號) 時，會從主控台讀取該密碼。此選項僅在指定 /cun (CommonUserName) 選項時才有效。範例:建立收集器起始訂閱，將事件從遠端電腦 mySource.myDomain.com 的應用程式事件記錄檔轉送到 ForwardedEvents 記錄檔。wecutil cs ci_subscription.xmlci_subscription.xml 的內容: SampleCISubscription CollectorInitiated Collector Initiated Subscription Sample true http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog Custom 20 60000 thisMachine.myDomain.com 2010-01-01T00:00:00.000Z * ]] false http RenderedText ForwardedEvents Default mySource.myDomain.com myUserName 範例:建立來源起始的訂閱，將事件從遠端電腦 mySource.myDomain.com 的應用程式事件記錄檔轉送到 ForwardedEvents 記錄檔。wecutil cs si_subscription.xmlsi_subscription.xml 的內容: SampleSISubscription SourceInitiated Source Initiated Subscription Sample true http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog Custom 1 1000 2018-01-01T00:00:00.000Z Event[System/EventID='999'] ]] true http RenderedText ForwardedEvents O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)請注意，當建立來源起始的訂閱時，如果 AllowedSourceDomainComputers、AllowedSourceNonDomainComputers/AllowedIssuerCAList、AllowedSubjectList 以及 DeniedSubjectList 都是空的，則預設會提供AllowedSourceDomainComputers - O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)。此 SDDL 預設值會將引發此訂閱事件的功能授與 Domain Computers 網域群組成員，以及本機 Network Service 群組 (針對本機轉寄站)。 |
Create a remote subscription.Usage:wecutil { cs | create-subscription } CONFIGURATION_FILE [/OPTION:VALUE [/OPTION:VALUE] ...]CONFIGURATION_FILEString that specifies the path to the XML file that contains subscription configuration.The path can be absolute or relative to the current directory.Options:You can use either the short (i.e. /cun) or long (i.e. /CommonUserName) version of theoption names. Options and their values are case-insensitive./cun:USERNAME (CommonUserName)Sets shared user credential to be used for event sources that do not have their ownuser credentials. This option applies to collector initiated subscriptions only.Note: if this option is specified, UserName/UserPassword settings for individual eventsources from the configuration file are ignored. If you want to use different credentialfor a specific event source, use ss (set-subscription) command to set it for the eventsource./cup:PASSWORD (CommonUserPassword)Sets the user password for the shared user credential. When PASSWORD is set to *(asterisk), the password is read from the console. This option is only valid when/cun (CommonUserName) option is specified.Example:Create a collector initiated subscription to forward events from the Application event log ofa remote computer mySource.myDomain.com to ForwardedEvents log.wecutil cs ci_subscription.xmlContent of ci_subscription.xml: SampleCISubscription CollectorInitiated Collector Initiated Subscription Sample true http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog Custom 20 60000 thisMachine.myDomain.com 2010-01-01T00:00:00.000Z * ]] false http RenderedText ForwardedEvents Default mySource.myDomain.com myUserName Example:Create a source initiated subscription to forward events from the Application event log ofa remote computer mySource.myDomain.com to ForwardedEvents log.wecutil cs si_subscription.xmlContent of si_subscription.xml: SampleSISubscription SourceInitiated Source Initiated Subscription Sample true http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog Custom 1 1000 2018-01-01T00:00:00.000Z Event[System/EventID='999'] ]] true http RenderedText ForwardedEvents O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)Note, that when creating a source initiated subscription, if AllowedSourceDomainComputers, AllowedSourceNonDomainComputers/AllowedIssuerCAList,AllowedSubjectList, and DeniedSubjectList are all empty, then a default willbe provided for AllowedSourceDomainComputers - O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS). This SDDL default grants members of the Domain Computers domain group, as wellas the local Network Service group (for local forwarder), the ability to raise events for this subscription. |
| 0x2A | 列出所有現存的遠端事件訂閱的名稱。使用方式:wecutil { es | enum-subscription }範例:列出事件訂閱。wecutil es |
List the names of all existent remote event subscriptions.Usage:wecutil { es | enum-subscription }Example:List event subscriptions.wecutil es |
| 0x2B | 顯示遠端訂閱的設定資訊。使用方式:wecutil { gs | get-subscription } SUBSCRIPTION_ID [/OPTION:VALUE [/OPTION:VALUE] ...]SUBSCRIPTION_ID唯一識別訂閱的字串，由用來建立訂閱的 XML 設定檔的 標記所指定選項:您可以使用短 (如 /f) 或長 (如 /format) 版本的選項名稱。選項與其值不區分大小寫。/f:VALUE (format)VALUE 可以是 XML 或 Terse。如果 VALUE 為 XML，則會以 XML 格式列印輸出。如果VALUE 為 Terse (預設)，則會將值列印為名稱值組。/u:VALUE (unicode)顯示 Unicode 格式輸出 (UTF-16)。VALUE 可以是 true 或 false。如果 VALUE 為true，則以 Unicode 格式輸出。範例:輸出名為 sub1 訂閱的設定資訊。wecutil gs sub1輸出範例:Subscription Id: sub1SubscriptionType: CollectorInitiatedDescription: Push Collector Initiated SubscriptionEnabled: trueUri: http://schemas.microsoft.com/wbem/wsman/1/windows/EventLogConfigurationMode: CustomDeliveryMode: PushDeliveryMaxItems: 1DeliveryMaxLatencyTime: 1000HostName: thisMachine.myDomain.comHeartbeatInterval: 60000Expires: 2010-01-01T00:00:00.000ZQuery: * ReadExistingEvents: trueTransportName: httpContentFormat: RenderedTextLocale: en-USLogFile: ForwardedEventsCredentialsType: DefaultCommonUserName: AdministratorCommonUserPassword: *EventSource[0]: Address: mySource.myDomain.com Enabled: true UserName: myUserName UserPassword: *EventSource[1]: Address: mySource1.myDomain.com Enabled: true UserName: myUserName UserPassword: * |
Displays remote subscription configuration information.Usage:wecutil { gs | get-subscription } SUBSCRIPTION_ID [/OPTION:VALUE [/OPTION:VALUE] ...]SUBSCRIPTION_IDString that uniquely identifies a subscription, specified by the tagof the XML configuration file used to create the subscriptionOptions:You can use either the short (i.e. /f) or long (i.e. /format) version of the optionnames. Options and their values are case-insensitive./f:VALUE (format)VALUE can be XML or Terse. If VALUE is XML, print output in XML. If VALUE is Terse(default), print value as name-value pairs./u:VALUE (unicode)Display output in unicode (UTF-16). VALUE can be true or false. If VALUE is true then output isin Unicode.Example:Output configuration information on a subscription named sub1.wecutil gs sub1Example output:Subscription Id: sub1SubscriptionType: CollectorInitiatedDescription: Push Collector Initiated SubscriptionEnabled: trueUri: http://schemas.microsoft.com/wbem/wsman/1/windows/EventLogConfigurationMode: CustomDeliveryMode: PushDeliveryMaxItems: 1DeliveryMaxLatencyTime: 1000HostName: thisMachine.myDomain.comHeartbeatInterval: 60000Expires: 2010-01-01T00:00:00.000ZQuery: * ReadExistingEvents: trueTransportName: httpContentFormat: RenderedTextLocale: en-USLogFile: ForwardedEventsCredentialsType: DefaultCommonUserName: AdministratorCommonUserPassword: *EventSource[0]: Address: mySource.myDomain.com Enabled: true UserName: myUserName UserPassword: *EventSource[1]: Address: mySource1.myDomain.com Enabled: true UserName: myUserName UserPassword: * |
| 0x2C | 顯示訂閱執行階段狀態。使用方式:wecutil { gr | get-subscriptionruntimestatus } SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]SUBSCRIPTION_ID唯一識別訂閱的字串，由用來建立訂閱的 XML 設定檔的 標記指定EVENT_SOURCE唯一識別當作事件來源之電腦的字串 (使用完整網域名稱、NetBIOS 名稱或 IP 位址)。範例:顯示名為 sub1 訂閱的執行階段狀態。wecutil gr sub1Subscription: sub1 RunTimeStatus: Active LastError: 0 ErrorMessage: ErrorTime: 2007-01-01T12:00:00.000 NextRetryTime: LastHeartbeatTime: EventSources: MYSOURCE$ RunTimeStatus: Active LastError: 0 ErrorMessage: ErrorTime: NextRetryTime: LastHeartbeatTime: 2007-01-01T12:15:00.000 |
Displays subscription runtime status.Usage:wecutil { gr | get-subscriptionruntimestatus } SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]SUBSCRIPTION_IDString that uniquely identifies a subscription, specified by the tag of the XML configuration file used to create the subscriptionEVENT_SOURCEString that identifies a machine serving as a source of events using fully-qualifieddomain name, NetBIOS name, or an IP address.Example:Display runtime status of subscription named sub1.wecutil gr sub1Subscription: sub1 RunTimeStatus: Active LastError: 0 ErrorMessage: ErrorTime: 2007-01-01T12:00:00.000 NextRetryTime: LastHeartbeatTime: EventSources: MYSOURCE$ RunTimeStatus: Active LastError: 0 ErrorMessage: ErrorTime: NextRetryTime: LastHeartbeatTime: 2007-01-01T12:15:00.000 |
| 0x2D | 刪除特定訂閱，並取消訂閱將事件傳遞到該訂閱的事件記錄檔的所有事件來源。不會刪除任何已收到和記錄的事件。使用方式:wecutil { ds | delete-subscription } SUBSCRIPTION_IDSUBSCRIPTION_ID唯一識別訂閱的字串，由用來建立訂閱的 XML 設定檔的 標記指定範例:刪除名為 sub1 的訂閱。wecutil ds sub1 |
Deletes a specific subscription and unsubscribes from all event sources that deliverevents into the Event Log for the subscription. Any events already received andlogged are not deleted.Usage:wecutil { ds | delete-subscription } SUBSCRIPTION_IDSUBSCRIPTION_IDString that uniquely identifies a subscription, specified by the tag ofthe XML configuration file used to create the subscriptionExample:Delete a subscription named sub1.wecutil ds sub1 |
| 0x2E | 建立連線並傳送遠端訂閱要求，來嘗試重新啟動所有或指定的事件來源，以重試非使用中的訂閱。停用的來源不會重試。使用方式:wecutil { rs | retry-subscription } SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]SUBSCRIPTION_ID唯一識別訂閱的字串，由用來建立訂閱的 XML 設定檔的 標記指定EVENT_SOURCE唯一識別當作事件來源之電腦的字串 (使用完整網域名稱、NetBIOS 名稱或IP 位址)。範例:重試訂閱名稱為 sub1 的所有來源。wecutil rs sub1 |
Retries inactive subscription by attempting to reactivate all or specified eventsources by establishing a connection and sending a remote subscription request.Disabled sources are not retried.Usage:wecutil { rs | retry-subscription } SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]SUBSCRIPTION_IDString that uniquely identifies a subscription, specified by the tag ofthe XML configuration file used to create the subscriptionEVENT_SOURCEString that identifies a machine serving as a source of events using fully-qualifieddomain name, NetBIOS name, or an IP address.Example:Retry all sources of a subscription named sub1.wecutil rs sub1 |
| 0x2F | 從命令列變更訂閱參數或使用 XML 設定檔，以設定訂閱設定。使用方式:wecutil { ss | set-subscription } SUBSCRIPTION_ID [/OPTION:VALUE [/OPTION:VALUE] ...]wecutil { ss | set-subscription } /c:CONFIG_FILE [/cus:USERNAME [/cup:PASSWORD] ...]SUBSCRIPTION_ID唯一識別訂閱的字串，由用於建立訂閱的 XML 設定檔的 標記所指定選項:您可使用短 (即 /q) 或長 (即 /Query) 版本的選項名稱。選項與其值不區分大小寫。常用選項 (適用於所有類型的訂閱):/c:CONFIG_FILE (Config)此字串指定包含訂閱設定之 XML 檔案的路徑。此路徑可以是目前目錄的絕對或相對路徑。此選項只能與選用的 /cus (CommonUserName) 與 /cup (CommonUserPassword) 選項搭配使用，不能與所有其他選項同時存在。/e[:VALUE] (enabled)啟用或停用訂閱。VALUE 可以是 true 或 false。此選項的預設值為 true。/d:DESCRIPTION (Description)描述訂閱的字串。/ex:DATE_TIME (Expires)指定訂閱到期時間的字串。DATE_TIME 值是以標準 XML 或 ISO8601 日期時間格式指定: yyyy-MM-ddThh:mm:ss[.sss][Z]，其中 T 是時間分隔字元，而 Z 是指 UTC 時間。/uri:URI指定訂閱使用之事件類型的字串。事件來源電腦的位址與 URI 可唯一識別事件來源。/cm:CONFIGURATION_MODE (ConfigurationMode)指定設定模式的字串。CONFIGURATION_MODE 可以是下列其中一個字串: Normal、Custom、MinLatency 或 MinBandwidth。Normal、MinLatency 以及 MinBandwidth 模式可設定傳遞模式、最大傳遞項目、活動訊號間隔以及最大傳遞延遲時間。只有在設定模式設為 Custom 時，才能指定 /dm (DeliveryMode)、/dmi (DeliveryMaxItems)、/hi (HeartbeatInterval) 或 /dmlt (DeliveryMaxLatencyTime) 選項。/q:QUERY (Query)指定訂閱之查詢字串的字串。此字串的格式依不同的 URI 值而不同，並且適用於訂閱中的所有來源。/dia:DIALECT (Dialect)指定查詢字串所使用方言的字串。/cf:FORMAT (ContentFormat)指定傳回事件格式的字串。FORMAT 可以是 Events 或 RenderedText。當值為 RenderedText 時，會以附加至該事件的本地化字串 (如事件描述) 傳回事件。FORMAT 的預設值為 RenderedText。/l:LOCALE (Locale)指定以 RenderedText 格式傳遞本地化字串之地區設定的字串。LOCALE 是語言/國家(地區) 文化識別碼，例如 \"en-US\"。此選項只有在 /cf (ContentFormat) 選項設為\"RenderedText\" 時才有效。/ree[:VALUE] (ReadExistingEvents)指定要為訂閱傳遞的事件。VALUE 可以是 true 或 false。當 VALUE 為 true 時，會從訂閱事件來源讀取所有現存事件。當 VALUE 為 false 時，只會傳遞未來 (抵達) 事件。若 /ree 選項沒有值，預設值為 true。若未指定 /ree 選項，預設值為 false。/lf:FILENAME (LogFile)此字串指定用於儲存從事件來源接收之事件的本機事件記錄檔。/pn:PUBLISHER (PublisherName)指定發行者名稱的字串。這必須是擁有或匯入 /lf (LogFile) 選項指定之記錄的發行者。/dm:MODE (DeliveryMode)指定傳遞模式的字串。如果是收集器起始的訂閱，則 MODE 可以是 pull 或 push，如果是來源起始的訂閱，則只可以是 push。此選項只有在 /cm (ConfigurationMode) 選項設為 Custom 時才有效。/dmi:NUMBER (DeliveryMaxItems)指定批次傳遞最大項目數的數字。此選項只有在 /cm (ConfigurationMode) 設為Custom 時才有效。/dmlt:MS (DeliveryMaxLatencyTime)指定傳遞事件批次之最大延遲值的數字。MS 為毫秒數。此選項只有在 /cm (ConfigurationMode) 設為 Custom 時才有效。/hi:MS (HeartbeatInterval)指定 push 訂閱之活動訊號間隔或 pull 訂閱的輪詢間隔的數字。MS 為毫秒數。此選項只有在 /cm (ConfigurationMode) 設為 Custom 時才有效。/tn:TRANSPORTNAME (TransportName)指定用於連線至遠端事件來源之傳輸名稱的字串。可以是 http 或 https。 |
Sets subscription configuration by changing subscription parameters from the commandline or by using an XML configuration file.Usage:wecutil { ss | set-subscription } SUBSCRIPTION_ID [/OPTION:VALUE [/OPTION:VALUE] ...]wecutil { ss | set-subscription } /c:CONFIG_FILE [/cus:USERNAME [/cup:PASSWORD] ...]SUBSCRIPTION_IDString that uniquely identifies a subscription, specified by the tag ofthe XML configuration file used to create the subscriptionOptions:You can use either the short (i.e. /q) or long (i.e. /Query) version of theoption names. Options and their values are case-insensitive.COMMON OPTIONS (for all type of subscriptions):/c:CONFIG_FILE (Config)String that specifies the path to the XML file that contains subscription configuration.The path can be absolute or relative to the current directory. This option may only beused with the optional /cus (CommonUserName) and /cup (CommonUserPassword) options andis mutually exclusive with all other options./e[:VALUE] (enabled)Enable or disable a subscription. VALUE can be true or false. The default value of thisoption is true./d:DESCRIPTION (Description)String that describes the subscription./ex:DATE_TIME (Expires)String that specifies the subscription expiration time. DATE_TIME value is specified instandard XML or ISO8601 date-time format: yyyy-MM-ddThh:mm:ss[.sss][Z], where T is thetime separator and Z indicates UTC time./uri:URIString that specifies the type of the events consumed by the subscription. The addressof the event source machine along with the URI uniquely identifies the source of theevents./cm:CONFIGURATION_MODE (ConfigurationMode)String that specifies the configuration mode. CONFIGURATION_MODE can be one of thefollowing strings: Normal, Custom, MinLatency or MinBandwidth. The Normal, MinLatency,and MinBandwidth modes set delivery mode, delivery max items, heartbeat interval, anddelivery max latency time. The /dm (DeliveryMode), /dmi (DeliveryMaxItems),/hi (HeartbeatInterval) or /dmlt (DeliveryMaxLatencyTime) option may only be specifiedif the configuration mode is set to Custom./q:QUERY (Query)String that specifies that query string for the subscription. The format of this stringmay be different for different URI values and applies to all sources in the subscription./dia:DIALECT (Dialect)String that specifies the dialect the query string uses./cf:FORMAT (ContentFormat)String that specifies the format of the returned events. FORMAT can be Events orRenderedText. When the value is RenderedText, the events are returned with the localizedstrings (such as event description) attached to the event. The default value of FORMATis RenderedText./l:LOCALE (Locale)String that specifies the locale for delivery of the localized strings in RenderedTextformat. LOCALE is a language/country culture identifier, for example, \"en-US\". Thisoption is valid only if /cf (ContentFormat) option is set to \"RenderedText\"./ree[:VALUE] (ReadExistingEvents)Specifies which events are to be delivered for the subscription. VALUE can true or false.When the VALUE is true, all existing events are read from the subscription event sources.When the VALUE is false, only future (arriving) events are delivered. The default valueis true for an /ree option without a value. If no /ree option is specified, the defaultvalue is false./lf:FILENAME (LogFile)String that specifies the local event log used to store events received from the eventsources./pn:PUBLISHER (PublisherName)String that specifies the publisher name. It must be a publisher which owns or importslog specified by /lf (LogFile) option./dm:MODE (DeliveryMode)String that specifies the delivery mode. MODE can be either pull or push for collectorinitiated subscriptions and only push for source initiated subscriptions. This option isvalid only if /cm (ConfigurationMode) option is set to Custom./dmi:NUMBER (DeliveryMaxItems)A number that specifies the maximum number of items for batched delivery. This option isvalid only if /cm (ConfigurationMode) is set to Custom./dmlt:MS (DeliveryMaxLatencyTime)A number that specified the maximum latency in delivering a batch of events. MS is thenumber of milliseconds. This option is valid only if /cm (ConfigurationMode) is set toCustom./hi:MS (HeartbeatInterval)A number that specifies the heartbeat interval for push subscriptionsm, or the pollinginterval for pull subscriptions. MS is the number of milliseconds. This option is valid only if /cm (ConfigurationMode) is set to Custom./tn:TRANSPORTNAME (TransportName)String that specifies the name of the transport used to connect to remote event source.It can be http or https. |
| 0x30 | /esa:EVENT_SOURCE (EventSourceAddress)指定事件來源的位址。EVENT_SOURCE 是識別當作事件來源之電腦的字串 (使用完整網域名稱、NetBIOS 名稱或 IP 位址)。此選項應與 /ese (EventSourceEnabled)、/aes (AddEventSource)、/res (RemoveEventSource) 或 /un (UserName) 與 /up (UserPassword) 選項搭配使用。/ese[:VALUE] (EventSourceEnabled)啟用或停用事件來源。VALUE 可以是 true 或 false。只有在指定/esa (EventSourceAddress) 選項時，才允許此選項。此選項的預設值為 true。收集器起始訂閱特有的選項:/aes (AddEventSource)新增 /esa (EventSourceAddress) 選項指定的事件來源 (若其還不是訂閱的一部分)。若 /esa (EventSourceAddress) 指定的位址已是訂閱的一部分，則會發生錯誤。只有在指定 /esa (EventSourceAddress) 選項時，才允許此選項。/res (RemoveEventSource)移除 /esa (EventSourceAddress) 選項指定的事件來源 (若其已是訂閱的一部分)。若 /esa (EventSourceAddress) 指定的位址不是訂閱的一部分，則會發生錯誤。只有在指定 /esa (EventSourceAddress) 選項時，才允許此選項。/un:USERNAME (UserName)指定要與 /esa (EventSourceAddress) 選項指定的來源搭配使用的使用者認證。只有在指定 /esa (EventSourceAddress) 選項時，才允許此選項。/up:PASSWORD (UserPassword)為 /esa (EventSourceAddress) 選項所指定來源的使用者認證設定使用者密碼。只有在指定 /un (UserName) 選項時，才允許此選項。/tp:TRANSPORTPORT (TransportPort)連線至遠端事件來源時，傳輸所使用的連接埠號碼。若未指定，則連接埠預設為用於指定傳輸名稱的標準連接埠: 80 (適用 http)、443 (適用 https)/hn:NAME (HostName)指定本機電腦 FQDNS 名稱的字串。遠端事件來源使用此名稱來推回事件，而且僅適用於推送訂閱。它是在包含可能有多個 FQDNS 名稱的多重主目錄伺服器的情況下使用。/ct:TYPE (CredentialsType)此字串指定用於遠端來源存取的認證類型。TYPE 可以是下列其中一個值: \"default\"、\"negotiate\"、\"digest\"、\"basic\" 或 \"localmachine\"。預設值為 \"default\"。/cun:USERNAME (CommonUserName)為本身沒有使用者認證的事件來源設定共用使用者認證。注意: 若同時指定此選項與/c (Config) 選項，則會忽略設定檔中個別事件來源的 UserName/UserPassword 設定。若想針對特定事件來源使用不同的認證，則可在其他 ss (set-subscription) 命令的命令列中，為特定事件來源指定 /un (UserName) 與 /up (UserPassword)，以覆寫此值。/cup:PASSWORD (CommonUserPassword)設定共用使用者認證的使用者密碼。當 PASSWORD 設為 * (星號) 時，會從主控台讀取密碼。只有在指定 /cun (CommonUserName) 選項時，此選項才有效。來源起始訂閱特有的選項:/ica:THUMBPRINTS (AllowedIssuerCA)設定簽發者憑證指紋的清單，而清單格式是以逗號隔開。/as:SUBJECTS (AllowedSubjects)以逗號隔開的字串清單，指定允許起始訂閱之非網域電腦的 DNS 名稱。此名稱可以使用萬用字元指定 (如 \"*.mydomain.com\")。此清單預設是空的。/ds:SUBJECTS (DeniedSubjects)以逗號隔開的字串清單，指定不允許起始訂閱之非網域電腦的 DNS 名稱。此名稱可以使用萬用字元指定 (如 \"*.mydomain.com\")。此清單預設是空的。/adc:SDDL (AllowedSourceDomainComputers)此字串指定是否允許網域電腦起始訂閱 (格式為 SDDL)。預設是允許所有網域電腦起始訂閱。範例:從新的 XML 檔案 WsSelRg2.xml 更新名為 sub1 的訂閱設定。wecutil ss sub1 /c:%Windir%\\system32\\WsSelRg2.xml使用多個參數來更新名為 sub2 的訂閱設定:wecutil ss sub2 /esa:myComputer /ese /un:uname /up:* /cm:Normal更新來源起始訂閱的允許與拒絕主旨清單:wecutil ss sub3 /as:\"*.private.mydomain.com\" /ds:\"*.public.mydomain.net,*.mydomain.tv\" |
/esa:EVENT_SOURCE (EventSourceAddress)Specifies the address of an event source. EVENT_SOURCE is a string that identifies amachine serving as a source of events using fully-qualified domain name, NetBIOS name,or an IP address. This option should be used with /ese (EventSourceEnabled),/aes (AddEventSource), /res (RemoveEventSource), or /un (UserName) and /up (UserPassword)options./ese[:VALUE] (EventSourceEnabled)Enable or disable an event source. VALUE can be true or false. This option is allowedonly if /esa (EventSourceAddress) option is specified. The default value of this optionis true.OPTIONS SPECIFIC TO COLLECTOR INITIATED SUBSCRIPTIONS:/aes (AddEventSource)Adds event source specified by the /esa (EventSourceAddress) option, if it is not alreadya part of the subscription. If the address specified by the /esa (EventSourceAddress) isalready a part of the subscription, an error is raised. This option is allowed only if/esa (EventSourceAddress) option is specified./res (RemoveEventSource)Removes event source specified by the /esa (EventSourceAddress) option, if it is alreadya part of the subscription. If the address specified by the /esa (EventSourceAddress)is not a part of the subscription, an error is raised. This option is allowed only if/esa (EventSourceAddress) option is specified./un:USERNAME (UserName)Specifies user credential to be used with the source specified by the/esa (EventSourceAddress) option. This option is allowed only if /esa (EventSourceAddress)option is specified./up:PASSWORD (UserPassword)Sets the user password for the user credential for the source specified by the/esa (EventSourceAddress) option. This option is allowed only if /un (UserName) optionis specified./tp:TRANSPORTPORT (TransportPort)Port number used by transport when connecting to remote event source. If not specified the port defaults to the standard one used for the given transport name: 80 for http, 443 for https/hn:NAME (HostName)String that specifies the FQDNS name of the local machine. This name is used by remoteevent source to push back events and must be used for push subscription only. It is usedin scenarios involving multi-homed servers that may have multiple FQDNS names./ct:TYPE (CredentialsType)String that specifies the credential type to be used for remote source access. TYPE maybe one of the following values: \"default\", \"negotiate\", \"digest\", \"basic\" or\"localmachine\". The default value is \"default\"./cun:USERNAME (CommonUserName)Sets shared user credential to be used for event sources that do not have their own usercredentials.Note: if this option is specified with the /c (Config) option, UserName/UserPasswordsettings for individual event sources from the configuration file are ignored. If youwant to use different credential for a specific event source, you may override thisvalue by specifying the /un (UserName) and /up (UserPassword) for a specific eventsource on the command line of another ss (set-subscription) command./cup:PASSWORD (CommonUserPassword)Sets the user password for the shared user credential. When PASSWORD is set to* (asterisk), the password is read from the console. This option is only valid when/cun (CommonUserName) option is specified.OPTIONS SPECIFIC TO SOURCE INITIATED SUBSCRIPTIONS:/ica:THUMBPRINTS (AllowedIssuerCA)Sets the list of issuer certificate thumbprints, in a comma separated list./as:SUBJECTS (AllowedSubjects)Comma separated list of strings that specifies the DNS names of non-domain computersallowed to initiate subscriptions. The names may be specified using wildcards, like\"*.mydomain.com\". By default this list is empty./ds:SUBJECTS (DeniedSubjects)Comma separated list of strings that specifies the DNS names of non-domain computersnot allowed to initiate subscriptions. The names may be specified using wildcards, like\"*.mydomain.com\". By default this list is empty./adc:SDDL (AllowedSourceDomainComputers)A string which specifies which domain computers are allowed or not to initiatesubscriptions, in SDDL format. Default is to allow all domain computers.EXAMPLES:Update subscription configuration named sub1 from a new XML file, WsSelRg2.xml.wecutil ss sub1 /c:%Windir%\\system32\\WsSelRg2.xmlUpdate subscription configuration named sub2 with multiple parameters:wecutil ss sub2 /esa:myComputer /ese /un:uname /up:* /cm:NormalUpdate the allowed and denied subject lists for a source initiated subscription:wecutil ss sub3 /as:\"*.private.mydomain.com\" /ds:\"*.public.mydomain.net,*.mydomain.tv\" |
| 0x31 | 設定 Windows Event Collector 服務，確定在重新啟動期間，能夠建立及維持訂閱。此作業包括下列步驟: 1. 若 ForwardedEvents 通道已停用，則予以啟用。 2. 設定 Windows Event Collector 服務以延遲啟動 (僅限 Vista 與更新版本)。 3. 若 Windows Event Collector 服務並未執行，則予以啟動。使用方式:wecutil { qc | quick-config } [/OPTION:VALUE]選項:您可以使用短 (如 /q) 或長 (如 /quiet) 版本的選項名稱。選項與其值不區分大小寫。/q[:VALUE] (Quiet)VALUE 可以是 true 或 false。若為 true，quick-config 不會顯示提示要求您確認。此選項的預設值為 false。範例:wecutil qc |
Configures Windows Event Collector service to make sure subscription can be created andsustained through reboots. This includes the following steps: 1. Enable ForwardedEvents channel if disabled. 2. Set Windows Event Collector service to delay start (Vista and later only). 3. Start Windows Event Collector service if not running.Usage:wecutil { qc | quick-config } [/OPTION:VALUE]Options:You can use either the short (i.e. /q) or long (i.e. /quiet) version of theoption names. Options and their values are case-insensitive./q[:VALUE] (Quiet)VALUE can be true or false. If true, quick-config will not prompt for confirmation.The default value of this option is false.Example:wecutil qc |
| 0x32 | 無法適當地設定 Windows Event Collector 服務。請稍後再試。%0 |
Failed to configure Windows Event Collector service properly. Please try again later.%0 |
| 0x33 | 輸入 %1!s! 的密碼:%0 |
Type the password for %1!s!:%0 |
| 0x34 | 警告: 訂閱的設定模式不是 Custom。這種模式無法自訂傳遞內容。因此，將忽略提供的設定檔中的傳遞節點。 |
Warning: Configuration mode for the subscription is not Custom. Delivery properties are notcustomizable for such mode. As a result, Delivery node from the provided configuration filewill be ignored. |
| 0x35 | 訂閱的設定模式不是「自訂」。無法為此模式設定內容 %1!s!。 |
Configuration mode for the subscription is not Custom. Property %1!s! can't be set for this mode. |
| 0x36 | 服務啟動模式將變更為「延遲啟動」。您要繼續嗎 ( %c- 是或 %c- 否)?%0 |
The service startup mode will be changed to Delay-Start. Would you like to proceed ( %c- yes or %c- no)?%0 |
| 0x37 | Y%0 |
Y%0 |
| 0x38 | N%0 |
N%0 |
| 0x39 | 已順利設定 Windows Event Collector 服務。 |
Windows Event Collector service was configured successfully. |