Task Scheduler自定义触发器-当EventID为FOO且EventData.Data为BAR时开始

Question

我希望Windows Task Scheduler在将特殊事件记录到Windows事件日志时启动自定义任务。该事件的事件ID为6702，并且数据参数为MyBackupJob时。这是我当前的自定义触发器，它不起作用：

<QueryList>
  <Query Id="0" Path="VisualSVNServerBackgroundJobs">
    <Select Path="VisualSVNServerBackgroundJobs">
            *[System[(EventID=6702)]] and *[EventData[Data[1]='MyBackupJob']]
    </Select>
  </Query>
</QueryList>

怎么了？

这是日志中事件的示例：

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="VisualSVN Background Job Service" /> 
  <EventID Qualifiers="49152">6702</EventID> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2020-05-11T12:53:34.650971500Z" /> 
  <EventRecordID>4885</EventRecordID> 
  <Channel>VisualSVNServerBackgroundJobs</Channel> 
  <Computer>svn1.example.com</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>{516B8AED-C3CF-4221-BC91-10B18BD3A56F}</Data> 
  <Data>MyBackupJob</Data> 
  <Data>{E3831378-33E1-4C8E-BE8A-CF08DB1CB7F0}</Data> 
  <Data>Failed to backup 1 out of 2 repositories.</Data> 
  <Data>00:00:00</Data> 
  <Data>203</Data> 
  </EventData>
  </Event>

Answer 1

尝试更改

*[System[(EventID=6702)]] and *[EventData[Data[1]='MyBackupJob']]

to

//Event[EventData[Data[2]="MyBackupJob"]][System[EventID=6702]] 

并查看是否有效。