in reply to Win32::Eventlog Question

That field is a binary encoded security id. To translate that to a username you'll need to call LookupAccountSid, probably via Win32::API.

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
Lingua non convalesco, consenesco et abolesco.
Rule 1 has a caveat! -- Who broke the cabal?

In Section Seekers of Perl Wisdom