Hi Luebkert,

        Thanks a lot for this.

        I could get the info by getting the value of hashref-> {TimeGenerated}.
        I pass this hash reference to localtime function as below:

        ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($hashRef-> {TimeGen
erated});

        From the above, one can get the Date and the Time of the event.

Thanks and Regards,
Ramesh Chandra


-----Original Message-----
From: Bill Luebkert [mailto:dbecoll@[...].com]
Sent: Monday, February 09, 2009 10:21 AM
To: Chandra, Ramesh H.S. IN BLR SISL
Cc: activeperl@[...].com
Subject: Re: How do I read the event header using Win32::EventLog?

Chandra, Ramesh H.S. IN BLR SISL wrote:
> 
> 
>  Hello,
> 
>          How do I read the "event header" from the event logs on a
>  Windows machine.
> 
>          I have the Win32::EventLog module and I am able to read the
>  message. But I would like to get the 'date" and 'time' of the event
>  which occurred.
>          So, how do I get the date and time of an event using
>  Win32::Eventlog module?

You're supposed to insert code to be scrutinized to illicit suggestions on how to fix it.

Starting with the example in the pod section and fixing it for strict:

use strict;
use warnings;
use Win32::EventLog;

my $base = 0;
my $recs = 0;

my $handle = Win32::EventLog-> new("System") or die "Open System Log: $! ($^E)";
$handle-> GetNumber($recs) or die "Get number of records: $! ($^E)"; print "recs=$recs\n";
$handle-> GetOldest($base) or die "Get oldest record: $! ($^E)"; print "base=$base\n";

my $x = 0;
my $hashref;
while ($x < $recs) {

        $handle-> Read(EVENTLOG_FORWARDS_READ | EVENTLOG_SEEK_READ, $base + $x,
          $hashref) or die "Read entry '$x': $! ($^E)";
        if ($hashref-> {Source} eq "EventLog") {
                Win32::EventLog::GetMessageText($hashref);
                print "Entry $x: $hashref-> {Message}\n";
                print Data::Dumper-> Dump([$hashref], [qw($hashref)]);
        }
        ++$x;
}

__END__

This is what a dump of the hashref looks like - all the info should be in there:

$hashref = {
   'Category' =>  0,
   'ClosingRecordNumber' =>  0,
   'Computer' =>  'computername',
   'Data' =>  '',
   'EventID' =>  '-2147477639',
   'EventType' =>  4,
   'Length' =>  0,
   'Message' =>  'Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Uniprocessor
  Free.
',
   'RecordNumber' =>  25753,
   'Source' =>  'EventLog',
   'Strings' =>  '5.01. 2600 Service Pack 3 Uniprocessor Free ',
   'TimeGenerated' =>  1228652519,
   'Timewritten' =>  1228652519,
   'User' =>  ''
};

_______________________________________________
ActivePerl mailing list
ActivePerl@[...].com
To unsubscribe: http://listserv.ActiveState.com/mailman/mysubs