=**************************************
= Name: elr_app.pl
= Description:Query NT EventLogs of remote and local systems, outputting to stdout ('~' delimited, with a '|' to indicate then end of line {cr}{lf}). The output is used by SQLServer to populate tables, or could be used by Excel to create reports.
For personal use I have added the functionality of only grabbing the previous two day's worth of events, and I have added a header line. You can easily remove this functionality.
= By: Garrett Klok
=
= Inputs:Syntax: perl elr_app.pl [Server] [> outputfile]
Ex: perl elr_app.pl \\My_server > file.out
=
= Returns:No 'returns' other than the contents of the event log.
=
= Side Effects:I'm unaware of any side-effects. If any bugs or problems arise, please let me know. I'd like to learn the most I can.
=
=This code is copyrighted and has= limited warranties.Please see http://www.Planet-Source-Code.com/vb/scripts/ShowCode.asp?txtCodeId=217&lngWId=6=for details.=**************************************
#****************************************************
# Authors: Garrett Klok, gklok@ccs.neu.edu
# Paul Silveira, pasilveira@statestreet.com
# <anonymous>
# Purpose: Query NT EventLogs of remote systems outputting
# to stdout which is used by SQLServer to populate
# tables.
# Syntax:perl elr_app.pl [Server] [> outputfile]
#
# Code was used from other authors in the creation.
# Other authors: Harlan Carvey, keydet89@yahoo.com
# David Blank-Edelman, dnb@ccs.neu.edu
#****************************************************
use Win32::EventLog;
#---------------------------------------------
# Translator for EventType
#---------------------------------------------
%type = (1 => "Error",
2 => "Warning",
4 => "Information",
8 => "Audit_success",
16 => "Audit_failure");
#---------------------------------------------
# Opens connections with remote system
#---------------------------------------------
my $server = shift || Win32::NodeName;
\&GetEvents($server,"Application");
#- - - - - - - - - - - - - - - - - - - - - - -
# GetEvents()
# Input: Server name, EventLog
# Output: Log entries, to STDOUT
#- - - - - - - - - - - - - - - - - - - - - - -
sub GetEvents {
my($server,$evtlog) = @_;
my ($log);
#- - - - - - - - - - - - - - - - - - - - - - -
# Open EventLog
#- - - - - - - - - - - - - - - - - - - - - - -
$log = Win32::EventLog->new($evtlog,$server) ||
die "Could not open $evtlog log on $server: $!\n";
#---------------------------------------------
# Time formatting and date manipulation
#---------------------------------------------
use constant TWO_DAY => 60*60*24*2;
$lokal = time();
$two_days = ($lokal - TWO_DAY);
#---------------------------------------------
# EventLog reading
#---------------------------------------------
print "DateandTime~Computer~EventType~Category~EventID~Message|";
#- - - - - - - - - - - - - - - - - - - - - - -
# Enables the retrieve of full text of every
# message on each Read()
#- - - - - - - - - - - - - - - - - - - - - - -
$Win32::EventLog::GetMessageText = 1;
#- - - - - - - - - - - - - - - - - - - - - - -
# Read through EventLog (backwards) one record
# at a time
#- - - - - - - - - - - - - - - - - - - - - - -
while ($log->Read((EVENTLOG_SEQUENTIAL_READ|EVENTLOG_BACKWARDS_READ),
1,$entry)) {
$remote_time = ($entry->{TimeGenerated});
if ($two_days < $remote_time)
{
print (join(" ", ((split(/\s+/, scalar(localtime($entry->{TimeGenerated}))))[1,2,4,3])));
print "~";
print $entry->{Computer};
print "~";
print $type{$entry->{EventType}};
print "~";
print $entry->{Category};
print "~";
my $id = ($entry->{EventID} & 0xffff);
print $id;
print "~";
print $entry->{Message};
print "|";
print "\n";
}
else {};
}
}
|
