sub check_1 {
    my $query = "
    	SELECT * FROM __InstanceCreationEvent 
    	WHERE TargetInstance ISA'Win32_NTLogEvent'
    ";
    
    my $wbemloc = new Win32::OLE( "WbemScripting.SWbemLocator" );
    $wbemloc->{ Security_ }{ Privileges }
    	->AddAsString( "SeSecurityPrivilege" );
    
    my $wbemsvc = $wbemloc->ConnectServer( ".", "root/cimv2" );
    $wbemsvc->{ Security_ }{ ImpersonationLevel } = 3;
    
    my $wbemevtsrc = $wbemsvc->ExecNotificationQuery( $query );
    
    while( 1 ) {
		my $wbemobj = $wbemevtsrc->NextEvent();
		my $msg = $wbemobj->{ TargetInstance }{ Message };
		$msg =~ s/\t//g;
		my @array = split( /\r\n/, $msg );
		my $tst = join( ';', @array );
		$tst =~ s/;;/;/g;
		print $tst."\n";
    }
}