use strict;
use Win32::OLE qw(in);
Win32::OLE->Option("Warn"=>3);
use threads qw[ async ];


sub check_1 {
    my $query = "SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' ";
    my $wbemloc = new Win32::OLE("WbemScripting.SWbemLocator");
    $wbemloc->{Security_}->{Privileges}->AddAsString("SeSecurityPrivilege");
    my $wbemsvc = $wbemloc->ConnectServer(".", "root/cimv2");
    $wbemsvc->{Security_}->{ImpersonationLevel} = 3;
    my $wbemevtsrc = $wbemsvc->ExecNotificationQuery($query);
    while (1) {
	my $wbemobj = $wbemevtsrc->NextEvent();
	my $msg = $wbemobj->{TargetInstance}->{Message};
	$msg =~ s/\t//g;
	my @array = split(/\r\n/,$msg);
	my $tst = join(';',@array);
	$tst =~ s/;;/;/g;
	print $tst."\n";
    }
}

sub check_2 {
    my $query = "SELECT * FROM __InstanceDeletionEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' ";
    my $wbemloc = new Win32::OLE("WbemScripting.SWbemLocator");
    $wbemloc->{Security_}->{Privileges}->AddAsString("SeSecurityPrivilege");
    my $wbemsvc = $wbemloc->ConnectServer(".", "root/cimv2");
    $wbemsvc->{Security_}->{ImpersonationLevel} = 3;
    my $wbemevtsrc = $wbemsvc->ExecNotificationQuery($query);
    while (1) {
	my $wbemobj = $wbemevtsrc->NextEvent();
	my $msg = $wbemobj->{TargetInstance}->{Message};
	$msg =~ s/\t//g;
	my @array = split(/\r\n/,$msg);
	my $tst = join(';',@array);
	$tst =~ s/;;/;/g;
	print $tst."\n";
    }
}

async \&check_1;
check_2;