PERL   73

events pl

Guest on 18th August 2022 01:25:54 AM

  1.  
  2. use Win32::EventLog;
  3.  
  4. if($#ARGV < 2)
  5.         {
  6.         die "usage: perl evt.pl MYSERVER System 10\n";
  7.         }
  8.  
  9. $machine  = $ARGV[0];
  10. $eventlog = $ARGV[1];
  11. $limit    = $ARGV[2];
  12.  
  13. my ($EventLog, $count, $first, $key);
  14.  
  15. $first = $count = 0;
  16. my $event={
  17.         'Source'              =>NULL,
  18.         'Computer'            =>NULL,
  19.         'Length'              =>NULL,
  20.         'Category'            =>NULL,
  21.         'RecordNumber'        =>NULL,
  22.         'TimeGenerated'       =>NULL,
  23.         'Timewritten'         =>NULL,
  24.         'EventID'             =>NULL,
  25.         'EventType'           =>NULL,
  26.         'ClosingRecordNumber' =>NULL,
  27.         'Strings'             =>NULL,
  28.         'Data',               =>NULL,
  29.         };
  30.  
  31. $EventLog = new Win32::EventLog( 'Security' ) || die $!;
  32.  
  33. $EventLog->GetOldest(\$first) || die $!;
  34. $EventLog->GetNumber(\$count) || die $!;
  35.  
  36. $EventLog->Read((EVENTLOG_SEEK_READ |
  37. EVENTLOG_BACKWARDS_READ),$first+$count,$event);
  38.  
  39. for $i ($first+$count-$limit+1..$first+$count)
  40.         {
  41.        
  42. $EventLog->Read((EVENTLOG_SEQUENTIAL_READ|EVENTLOG_BACKWARDS_READ),0,$event);
  43.         ($sec,$min,$hour,$mday,$mon,$year,$sday,$yday,$isdst) =
  44. localtime($event->{'TimeGenerated'});;
  45.         print sprintf("%15s -> %02d\-%02d\-%02d,
  46. %02d:%02d\n",'timestamp',$year,$mon+1,$mday,$hour,$min);
  47.  
  48.         #to get a readable EventId
  49.         $event->{'EventID'} = $event->{'EventID'} & 0xffff;
  50.  
  51.         foreach $key ('RecordNumber','Category','Source','Strings')
  52.                 {
  53.                 print sprintf( "%15s -> %s\n",$key, $event->{$key} );
  54.                 }
  55.  
  56.         print "\n";
  57.         }

Raw Paste


Login or Register to edit or fork this paste. It's free.