my %EventType = (0,'Error',2,'Warning',4,'Information', 8,'Audit success',16,'Audit failure'); $Win32::EventLog::GetMessageText =1; # Automatically call GetMessageText on each msg retrieved .... while ($limit--){ $EventLog->Read((EVENTLOG_SEQUENTIAL_READ|EVENTLOG_BACKWARDS_READ),0,$event); #to get a readable EventId #print "." if $limit % 100 == 0; $event->{'EventID'} = $event->{'EventID'} & 0xffff; $FindEventType and next unless $FindEventType == $event->{'EventID'}; Print_Event(); } .... ############################################# sub Print_Event{ my ($sec,$min,$hour,$mday,$mon,$year,$sday,$yday,$isdst) = localtime($event->{'TimeGenerated '}); $year += 1900; $mon +=1; # Zero-based if ($OptCSV){ print "$year/$mon/$mday $hour:$min,"; print $event->{EventID} . ","; $event->{'Strings'} =~ tr/\0/,/; print $event->{'Strings'} ."\n"; return; } print sprintf(" TimeStamp->%02d\-%02d\-%02d, %02d:%02d ",,$year,$mon,$mday,$hour,$min); #readable EventType $event->{'EventType'} = $EventType{ $event->{'EventType'} }; #split the strings $event->{'Strings'} =~ tr/\0/\n/; # $event->{'Strings'} =~s/\s*\n*$//; # Zap trailing NewLines & white-spaces.. foreach my $key (qw (EventType RecordNumber Category Source EventID) )# { print sprintf( "%s->%s ",$key, $event->{$key} ); } print "\n\[$event->{Strings}\]\n"; #print "MESSAGE:\[$event->{Strings}\]\n"; } #############################################