Report to Event Viewer correctly using Win32::EventLog

I'm writing a script that will run as a scheduled task on a win2k
server. I would like the script to log to the Event Viewer on the
server but when I use the Win32::EventLog module I get a bunch of
garbage included in the Event that I log. Is there a away to do this
with so I don't get the garbage...

Event Type: Error
Event Source: Weekly Report Script
Event Category: None
Event ID: 100
Date: 09/26/2007
Time: 11:56:56 AM
User: N/A
Computer: LVEPL3LX620
Description:
The description for Event ID ( 100 ) in Source ( Weekly Report
Script ) cannot be found. The local computer may not have the
necessary registry information or message DLL files to display
messages from a remote computer. You may be able to use the /
AUXSOURCE= flag to retrieve this description; see Help and Support for
details. The following information is part of the event: This is a
Test Error......

------
script:
use Win32::EventLog;

my $Type = "ERROR";
my $IDNum = 100;
my $Description = "This is a Test Error.....";

chomp( $Type, $IDNum, $Description );

my %Event = (
Length => NULL,
RecordNumber => NULL,
TimeGenerated => NULL,
EventID => $IDNum,
Category => NULL,
Source => "Weekly Report Script",
Strings => $Description,
);

if ( uc($Type) eq "ERROR" ) {
$Event{'EventType'} = EVENTLOG_ERROR_TYPE;
}
elsif ( uc($Type) eq "WARN" ) {
$Event{'EventType'} = EVENTLOG_WARNING_TYPE;
}
elsif ( uc($Type) eq "INFO" ) {
$Event{'EventType'} = EVENTLOG_INFORMATION_TYPE;
}
elsif ( uc($Type) eq "AUDIT" ) {
$Event{'EventType'} = EVENTLOG_AUDIT_SUCCESS;
}
else {
$Event{'EventType'} = EVENTLOG_AUDIT_FAILURE;
}

my $LogEvent = Win32::EventLog->new("Application")
or die "Can't open Application Event Log to enter $Description\n";
$LogEvent->Report( \%Event ) or die($!);
$LogEvent->Close();

Re: Report to Event Viewer correctly using Win32::EventLog

On Sep 26, 7:58 pm, ebm wrote:
> I'm writing a script that will run as a scheduled task on a win2k
> server. I would like the script to log to the Event Viewer on the
> server but when I use the Win32::EventLog module I get a bunch of
> garbage included in the Event that I log.

Actually if you read this "garbage" you'll realise that it's not in
the event that you log. It is a message that's being generated from
the Event Viewer program.

Windows events are not just plain text, they are an array of strings
that are used to populate a template and that template is looked up by
some mechanism using the event source and the event ID.

> Is there a away to do this with so I don't get the garbage...

Almost certainly but this question as nothing to do with Perl, the
answer would be the same however you log an event in Windows. Really,
therefore, you should try a forum that deals with Windows-related
questions.

However a quick Google search turned up these:

http://www.codeproject.com/dotnet/evtvwr.asp
http://technet2.microsoft.com/windowsserver/en/library/91e69 9f7-3574-475e-9615-bd74d99209b31033.mspx?mfr=true

Re: Report to Event Viewer correctly using Win32::EventLog

On Sep 27, 10:56 am, Brian McCauley wrote:
> On Sep 26, 7:58 pm, ebm wrote:
>
> > I'm writing a script that will run as a scheduled task on a win2k
> > server. I would like the script to log to the Event Viewer on the
> > server but when I use the Win32::EventLog module I get a bunch of
> > garbage included in the Event that I log.
>
> Actually if you read this "garbage" you'll realise that it's not in
> the event that you log. It is a message that's being generated from
> the Event Viewer program.
>
> Windows events are not just plain text, they are an array of strings
> that are used to populate a template and that template is looked up by
> some mechanism using the event source and the event ID.
>
> > Is there a away to do this with so I don't get the garbage...
>
> Almost certainly but this question as nothing to do with Perl, the
> answer would be the same however you log an event in Windows. Really,
> therefore, you should try a forum that deals with Windows-related
> questions.
>
> However a quick Google search turned up these:
>
> http://www.codeproject.com/dotnet/evtvwr.asphttp://technet2. microsoft.com/windowsserver/en/library/91e699f7-3574-...

It had to do with the EventID. I made the EventID NULL and it cleaned
up the way I wanted.

my %Event = (
Length => NULL,
RecordNumber => NULL,
TimeGenerated => NULL,
EventID => NULL,
Category => NULL,
Source => "Weekly Report Script",
Strings => $Description,
);

Anyway this solves my problem.