我是一名运维，服务器上运行这一个软件，但时不时会出现内存不能写导致软件停止运行，有需求监控日志，系统--信息类，ID事件为26，看了原创文章
https://blog.csdn.net/chenshanliang/article/details/116453506
里
$query = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance.Logfile = 'Application' and TargetInstance.Type='错误' and TargetInstance.SourceName='MSSQLSERVER'"
#Register WMI event
Register-WMIEvent -Query $query -Action {
$d=$eventArgs.NewEvent.TargetInstance.Message
$Message='Server: '+$d
msg /server:你接收的IP * $Message
}
有启发，但是我想要根据系统日志里的系统--信息类，ID事件为26，为监控对象，请问各位大佬怎么改
