Powershell - 通过事件日志搜索特定模式

Question

我正在尝试研究 IIS 服务崩溃。我尝试研究的事件日志中有一条非常具体的消息：World Wide Web Publishing Service service terminated unexpectedly。

我试图列出此错误消息在系统日志中出现的次数。

我正在尝试使用以下 powershell 命令，但它并没有真正显示我想要查找的内容：

> Id CommandLine                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  -- -----------                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

   1 Get-EventLog System | Where-Object { $_.Message -match "W3SVC" }                                                                                                                                                                                                                                                                                                                                                                                                                                              
   2 Get-EventLog System | Where-Object { $_.Message -match "IIS-IISReset" }                                                                                                                                                                                                                                                                                                                                                                                                                                       
   3 Get-EventLog -LogName System -EntryType Information -After 6/6/2010 -Source "Service Control Manager" | Where-Object {$_.EventID -eq 7034} | fl                                                                                                                                                                                                                                                                                                                                                               
   4                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
   5 Get-EventLog -LogName System -EntryType Information -After 6/6/2010 -Source "Service Control Manager" | Where-Object {$_.EventID -eq 7034} | Where-Object { $_.Message -match "IIS-IISReset" } | fl                                                                                                                                                                                                                                                                                                           
   6 Get-EventLog -LogName System -EntryType Information -After 6/6/2010 -Source "Service Control Manager" | Where-Object { $_.Message -match "World Wide Web Publishing Service service terminated unexpectedly" } | fl                                                                                                                                                                                                                                                                                           
   7 Get-EventLog -LogName System -EntryType Information -After 6/6/2010 -Source "Service Control Manager" | Where-Object { $_.Message -contains "World Wide Web Publishing Service service terminated unexpectedly" } | fl                                                                                                                                                                                                                                                                                        
   8 Get-EventLog System | Where-Object { $_.Message -pattern "unexpectatedly" }                                                                                                                                                                                                                                                                                                                                                                                                                                   
   9 Get-EventLog System | Where-Object { $_.Message -contains "unexpectatedly" }   

你们能否指定一些可以起作用的命令。

谢谢。