use strict;
use warnings;
package Event;
sub new {
my ($class) = @_;
my $self = {};
$self = {
'Event Type' => 'Windows 2003',
};
bless $self, ref($class) || $class;
return $self;
}
package Security;
our @ISA = qw (Event);
@PARENT::ISA = @ISA;
sub new {
my $class = shift;
my($self) = $class->PARENT::new(@_);
$self->{'EventLog'} = 'Security';
return (bless($self, $class)); # return object
}
1;
####
use strict;
use warnings;
package Event08;
sub new {
my ($class) = @_;
my $self = {};
$self = {
'Event Type' => 'Windows 2008',
};
bless $self, ref($class) || $class;
return $self;
}
package Security08;
our @ISA = qw (Event08);
@PARENT::ISA = @ISA;
sub new {
my $class = shift;
my($self) = $class->PARENT::new(@_);
$self->{'EventLog'} = 'Security';
return (bless($self, $class)); # return object
}
1;
####
#!/usr/bin/perl -w
use strict;
use warnings;
use AuditLogReview_Event; # handles 2003 events
use AuditLogReview_Event08; # handles 2008 events
EventWindowsHandler('.evt');
EventWindowsHandler('.evtx');
sub EventWindowsHandler {
my $oEvent;
my $ext = shift;
if ($ext eq '.evt') {
$oEvent = Security->new();
} elsif ( $ext eq '.evtx') {
$oEvent = Security08->new(); # can I call Security from the AuditLogReview_Event08 file?
}
print "Processing $oEvent->{'Event Type'} $oEvent->{'EventLog'} event.\n";
}
####
my $self = Event->new(@_);
my $self = Event08->new(@_);