if( $Event->Read( $Flag, $Num, \%Hash ) ) { if( $Hash{EventType} & $Type ) { ++$iCount; my ( $EventType, $Color, $Time ); if( $Hash{EventType} == EVENTLOG_ERROR_TYPE ){ $EventType = "Error"; $Color = "FF0000" ; # Red }elsif( $Hash{EventType} == EVENTLOG_WARNING_TYPE ){ $EventType = "Warning"; $Color = "FF4500"; # Red-Orange }elsif( $Hash{EventType} == EVENTLOG_INFORMATION_TYPE ){ $EventType = "Information"; $Color = "483D8B" ; # Blue }elsif( $Hash{EventType} == EVENTLOG_AUDIT_SUCCESS ){ $EventType = "Audit Successful"; $Color = "483D8B"; # Red-Orange }elsif( $Hash{EventType} == EVENTLOG_AUDIT_FAILURE ){ $EventType = "Audit Failure"; $Color = "FF0000"; # Red } # Format the time so that we can create a date based variant my $Time = "" . localtime( $Hash{TimeGenerated} ); $Time =~ s/^.*?\s+(.*?)\s+(.*?)\s+(.*?)\s+(.*)/$1 $2 $4 $3/; my ($eventsource,$event,$eventid,$user,$computer,$datetime,$message) = ($Hash{Source},($Hash{Event}) ? $Hash{Event}:"None",$Hash{EventID}, ($Hash{User}) ? $Hash{User}:"N/A",$Hash{Computer}, new Win32::OLE::Variant( VT_DATE, $Time ),$Hash{Message}); print "$Source: $datetime;$EventType;$eventsource;$eventid,$event;$user;$computer;$message\n"; } }