Recently I began working on a project that involved monitoring the Windows event log. I found the Win32::Eventlog module, however it displayed the username as the SID of the user involved in the log entry.
After some some fabulous advice from Perl monks, and a bit of searching on Google, I found a way to translate eventlog username SID's to real usernames.
use Win32;
use Win32::Eventlog;
#Here we get an eventlog object.
$eventlog = Win32::EventLog->new($eventLog, $ENV{COMPUTERNAME});
#This reads a specific event log entry that corresponds to the offset
+supplied
$eventlog->Read(EVENTLOG_FORWARDS_READ|EVENTLOG_SEEK_READ,$offset,$has
+hRef);
#This retrieves all the fields in the eventlog entry
Win32::EventLog::GetMessageText($hashRef);
#Here lies the magic line--the SID stored in $hashRef->{User} will be
+translated
#to the real username, which gets put into $username
Win32::LookupAccountSID(undef, $hashRef->{User}, $username, $domain, $
+sidtype);
Hope this saves some people some time. Thanks!