<QueryList> <Query Id="0" Path="System"> <Select Path="System">*[System[Provider[@Name='Service Control Manager'] and (Level=2) and (EventID=7011)]]</Select> </Query> </QueryList>
вот этот блок мне понравился: <events> <event value="1" level="win:Informational" template="MyEventTemplate" opcode="win:Info" channel="MyChannel" symbol="PROCESS_INFO_EVENT" message="$(string.Publisher.EventMessage)"/> </events>