package PerlSvc;
 
 our %Config = (ServiceName => "TestService");
 require Getopt::Long;
 $PerlSvc::Verbose = 0; # Put PerlSvc into quiet mode
 
 
 sub Startup {
     Getopt::Long::GetOptions('interval=s' => \$interval);
 
    #main::Init();
     while(ContinueRun()) { # $
        main::testservice(); #
     }
 }
 
 sub Interactive {
     # this callback is invoked when your service is not running as
     # a service and has been called without any of the --help,
     # --install or --remove options.
     Install();
     Startup();
 }
 
 sub Pause {
     # your service is about to be suspended
 }
 
 sub Continue {
     # your service will resume execution now
 }
 
 
 sub Install {
     Getopt::Long::GetOptions(
       'interval=s' => \$interval,
     );
 
    $Config{ServiceName} = "TestService";
    $Config{DisplayName} = "TestService";
    $Config{Description} = "TestService";
 
 
     # add your additional install messages or functions here
}
 
 sub Remove {
     # add your additional remove messages or functions here

}

sub Help {
     # add your additional help messages or functions here

}
package main;
sub testservice {
################################################   Begin Program     #
+#################################################
use Win32::OLE qw(in);

my $evtQuery = "SELECT * FROM __instancecreationevent WHERE targetinst
+ance ISA 'Win32_NTLogEvent' and (targetInstance.EventIdentifier= '592
+')"; 
my $Events = Win32::OLE->GetObject("WinMgmts:{impersonationLevel=imper
+sonate,(security)}")-> ExecNotificationQuery($evtQuery)       || warn
+ Win32::OLE->LastError;
 while (my $Event = $Events->NextEvent) {
    open (LOG, ">>testservice.log") || die "Could not Open testservice
+.log";
    print LOG ((localtime)." A new Process has been created\n");
    close (LOG);
    return unless PerlSvc::ContinueRun();
}
###############################################   END Program    #####
+###############################################
}
[download]