RichardH has asked for the wisdom of the Perl Monks concerning the following question:

I'm trying to read the application event log of a windows 2000 machine using win32::eventlog. This process works fine for the system log, but for the application log, it never returns any data. The code is as follows:
use Win32::EventLog; #print "comp name = ", $ENV{ComputerName}, "\n"; $myServer="\\\\<snip>"; print "\n$myServer\n"; $handle=Win32::EventLog->new("Application", $myServer) #$handle=Win32::EventLog->new("Application", $ENV{ComputerName}) or die "Can't open Application EventLog\n"; print "handle = $handle\n"; $handle->GetNumber($recs) or die "Can't get number of EventLog records\n"; $handle->GetOldest($base) or die "Can't get number of oldest EventLog record\n"; while ($x < $recs) { $handle->Read(EVENTLOG_FORWARDS_READ|EVENTLOG_SEEK_READ, $base+$x, $hashRef) or die "Can't read EventLog entry #$x\n"; if ($hashRef->{Source} eq "EventLog") { Win32::EventLog::GetMessageText($hashRef); print "Entry $x: $hashRef->{Message}\n"; } $x++; }

Replies are listed 'Best First'.
Re: Reading win2000 application event logs with perl
by davemabe (Monk) on Jun 12, 2001 at 20:54 UTC
    You're only printing records with a source of "EventLog." There aren't any of those in the Application Log. I changed this:
    if ($hashRef->{Source} eq "EventLog") { Win32::EventLog::GetMessageText($hashRef); print "Entry $x: $hashRef->{Message}\n"; }

    to this:
    #if ($hashRef->{Source} eq "EventLog") { Win32::EventLog::GetMessageText($hashRef); print "Entry $x: $hashRef->{Message}\n"; #}

    and I got some output.
    Dave
      Thanks! This will put me back in the right direction!
        double check your logs, because when I run this program I dont get all of the events that are actually seen in the event viewer.