Managing NT Event Logs with Perl for Win32: Part 1

[Editor's Note: Scripting Solutions is about using scripts to build solutions to specific business problems. This column doesn't teach you how to program with scripting languages, but how to use scripts to provide quick, easy-to-implement tools you can use right away.]

The event logs are Windows NT's central repositories for software- and system-related status information. Events are status messages that drivers, services, or applications generate. Driver- and service-related events generally write to the System Log, and Win32 applications write to the Application and Security logs. NT's event architecture gives software developers a common event reporting mechanism. This mechanism provides a centralized logging facility that lets systems administrators perform important actions such as troubleshooting system and application problems or performing security audits. Unfortunately, based on the proprietary format of log files, administrators are limited when it comes to managing them. Perl for Win32 fixes this problem by giving the administrator a robust set of functions to easily manage NT event logs. This article is the first of a two-part series that demonstrates Perl for Win32's event log capabilities. In Part 1, I examine a simple Perl script that writes to the NT Application Log. In Part 2, I'll look at a script that searches NT event logs for specific events.

Getting to the Event
NT logs events in the Application, Security, and System event logs (appevent.evt, secevent.evt, and sysevent.evt files located in the %SystemRoot%\system32\config directory). The Event Viewer (eventvwr.exe) is the primary user interface into the three log files. Although the Event Viewer lets you view a local or remote machine's event logs, it doesn't let you perform some other useful functions.

For example, have you ever wanted to print an event or filter a group of events and save or print the filtered results? What about searching for an event across multiple systems to determine the magnitude of a Windows Internet Naming Service (WINS), Exchange, or other distributed application problem? You might also like to have a command-language (or batch) function to send a user-defined event to one of the three NT event logs.

The Microsoft Windows NT Server Resource Kit utilities, dumpel.exe and logevent.exe, are not useful for these tasks for a couple of reasons. Dumpel.exe parses the entire target log. It doesn't let you specify how far back in time to search, making the utility very difficult to use if you want to verify the daily occurrence of an event. Logevent.exe doesn't let you specify a unique Event Source or Event ID. You're restricted to "User Event" as the Event Source and "1" as the Event ID. In this article, I'll look at a Perl script that overcomes the deficiencies in the logevent.exe utility and takes advantage of Perl for Win32's EventLog module; in Part 2, I'll fix dumpel.exe. (For basic information about Perl, see "NT Administration Wizardry with Perl for Win32," January 1998.)