dataking has asked for the wisdom of the Perl Monks concerning the following question:

OK, I've found myself in a situation where I'm required to re-invent the wheel. Perl is the only avenue I have to do that, at this point. I'm running into an issue where the Win32::EventLog module errors out with the following error:
Can't locate object method "new" via package "Win32::EventLog" at myscript.pl line 300.

The line that errors out (300) is as follows:
my $handle = Win32::EventLog->new("$whichlog", $ENV{ComputerName}) or die "Can't open $whichlog EventLog: $! \n";

The above is called from within a subroutine ($whichlog is supplied as an argument), and *appears* to only fail because no "significant" events are contained in the Application log. I've verified this by copying the example from the CPAN doc entry, which, when run on the Application log, produces no events (even though events DO exist). When run on the System log, only startup/shutdown events are listed. The Security log is equally "empty".

When I run the "print_log" script, which basically consists of the example from the POD on CPAN, it works fine (except that there are no events for the Application and Security logs). I don't get the error.

So, why am I getting this error? Win32::EventLog is obviously installed (I'm using the Windows version of ActivePerl v5.8.8 - Win32::EventLog is part of libwin32 as of 2002). If it's a bug with Win32::EventLog, I'd like to be able to error "gracefully" if there are no events, but it's rather curious that there ARE events in the binary log, but nothing is produced from the text output.

I'm happy to provide more info if I haven't provided enough here. Thanks in advance for your great wisdom. ;-)

Replies are listed 'Best First'.
Re: Win32::EventLog "fails" with no events?
by harryf (Beadle) on Sep 05, 2006 at 08:22 UTC

    You'd get that error if Perl was unable to find the Win32::EventLog class at runtime. E.g. if you create a script containing only the following, you can reproduce the error;

    my $handle = Win32::EventLog->new("Application", $ENV{ComputerName});

    ActivePerl doesn't seem come with Win32::EventLog by default - I just had to install in manually.

    You can check whether it's installed by looking for the file;

    C:\Perl\site\lib\Win32\EventLog.pm

    (Assuming you installed ActivePerl to C:\Perl). The C:\Perl\site directory is where additional libraries, e.g. from CPAN, get installed while C:\Perl\lib is where the default libraries, bundled with Perl, are installed.

    If it's not there, you'd need to install it - from the command line you start the ActiveState package manager then install the Win32::EventLogs;

    C:\> ppm ppm> install Win32::EventLog

    I assume you're not behind a proxy server. If you are you'd first need to setup your proxy environment in DOS, before running the above commands e.g.;

    REM proxy.bat - set's up proxy environment vars @echo off set HTTP_proxy=http://your.company.proxy.com:8080/ set HTTP_proxy_user=user set HTTP_proxy_pass=passwd

    If Win32::EventLog is installed, then you need to check you have the correct use statement at the start of the script;

    use strict; use Win32::EventLog;

    If Perl can't find it in it's library paths, it should raise an error at this point e.g.

    Can't locate Win32/EventLog.pm in @INC (@INC contains: c:/Perl/lib c:/ +Perl/site/lib .) at print_log.pl line 2. BEGIN failed--compilation aborted at print_.pl line 2.

    If you get that, run the following and post it here;

    use Data::Dumper; print Dumper(@INC);

    For a standard ActivePerl install you should see;

    $VAR1 = 'c:/Perl/lib'; $VAR2 = 'c:/Perl/site/lib'; $VAR3 = '.';
Re: Win32::EventLog "fails" with no events?
by gellyfish (Monsignor) on Sep 05, 2006 at 08:15 UTC

    Are you sure you have a use Win32::EventLog; in the program file you are trying to use the module in?

Re: Win32::EventLog "fails" with no events?
by bsdz (Friar) on Sep 05, 2006 at 17:56 UTC
    I also suspect you are missing a "use" statement. If you still cannot get it to work try the more flexible WMI instead: -
    use strict; use Win32::OLE; my $w = Win32::OLE->GetObject("winmgmts:"); die "failed to get obj\n" if !defined $w; my $q = $w->ExecQuery(qq(SELECT * FROM Win32_NTLogEvent where Logfile= +"SYSTEM")); die "failed to create query\n" if !defined $q; my @t = qw(Error Warning Information SecurityAuditSuccess SecurityAudi +tFailure); foreach my $r (sort {$a->RecordNumber > $b->RecordNumber} in $q) { print join(',' , $r->TimeWritten, $t[$r->EventType - 1], @$r{"ComputerName", "SourceName", "EventCode"}, substr($r->Message, 0, -3) )."\n"; }
Re: Win32::EventLog "fails" with no events?
by bfdi533 (Friar) on Sep 07, 2006 at 14:08 UTC

    Another option for you may be to use a different module. I would recommend that you take a look at http://www.cpan.org/modules/by-authors/id/H/HC/HCARVEY/.

    This module bypasses the Windows API and reads the event log directly, which is quite useful where the Windows API cannot read the event log or thinks there is a problem with some event log entries.