Try and take a look at MyEventLog for Win32::EventLog, Re: Translating Win32 EventLog Category

I might add this constructor 

sub Win32::EventLog::new {
    package Win32::EventLog;
    die "usage: PACKAGE->new(SOURCENAME[, SERVERNAME])\n" unless @_ > 
+1;
    my ( $class, $source, $server ) = @_;
    my $handle;
    my $error;
    # Create new handle
    if ( $source !~ /\\/ ) {
        my $ret = OpenEventLog( $handle, $server, $source );
        $ret or $error = [ [ int $!, $!], [int $^E, $^E] ];
    }
    else {
        my $ret = OpenBackupEventLog( $handle, $server, $source );
        $ret or $error = [ [ int $!, $!], [int $^E, $^E] ];
    }
    return bless {
        handle   => $handle,
        Source   => $source,
        Computer => $server,
        error    => $error,
    } => $class;
}

[download]

I also might add a check in this constructor for the behaviour you experience that is describe below (opens Application when it can't find what you ask for)

https://metacpan.org/source/JDB/Win32-EventLog-0.077/EventLog.xs 

lpEvtLog->hLog = OpenEventLogA(lpszUNCServerName,lpszSourceName);

[download]
OpenEventLog function (Windows)
 lpSourceName [in]
The name of the log.
If you specify a custom log and it cannot be found, the event logging service opens the Application log; however, there will be no associated message or category string file.

The linked example ( Querying for Event Information (Windows) ) says The source name (provider) must exist as a subkey of Application.

Regarding that comment one answer in How to open system event log? says For Vista or higher use EvtQuery, EvtNext etc to query the XML based event logs. and links to Querying for Events (Windows) using EvtQuery

Other answer links to WindowsNT Event Log Viewer - CodeProject which talks about the win32 registry

I've not deciphered the registry clues , but you might be able to :)

Enjoy :)

In reply to Re: Win32::EventLog searching the wrong logs by Anonymous Monk
in thread Win32::EventLog searching the wrong logs by FloydATC

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.