windows - 如何创建批处理脚本以每 5 分钟查找特定事件 ID (Eventid: 26) 并在 windows server 2003 r2 中执行某些命令？

Question

如何创建批处理脚本以每 5 分钟查找特定事件 ID (Eventid: 26)，如果发现事件 ID 为 26，则在 windows server 2003 r2 中执行某些命令（杀死特定的 windows 服务并重新启动它）？

Answer 1

从schtasks /create /?

==> Creates a scheduled task "EventLog" to run wevtvwr.msc starting
    whenever event 101 is published in the System channel

    SCHTASKS /Create /TN EventLog /TR wevtvwr.msc /SC ONEVENT
             /EC System /MO *[System/EventID=101]

和

==> Creates a scheduled task "logtracker" on remote machine "ABC"
    to run notepad.exe every five minutes starting from the
    specified start time with no end time. The /RP password will be
    prompted for.

    SCHTASKS /Create /S ABC /U domain\user /P password /SC MINUTE
             /MO 5 /TN logtracker
             /TR c:\windows\system32\notepad.exe /ST 18:30
             /RU runasuser /RP