eventlog.html

来自「perl教程」· HTML 代码 · 共 340 行 · 第 1/2 页

<dl>
<dt><strong><a name="item_eventlog_error_type"><code>EVENTLOG_ERROR_TYPE</code></a></strong>

<dd>
<p>An Error event is being logged.</p>
</dd>
</li>
<dt><strong><a name="item_eventlog_warning_type"><code>EVENTLOG_WARNING_TYPE</code></a></strong>

<dd>
<p>A Warning event is being logged.</p>
</dd>
</li>
<dt><strong><a name="item_eventlog_information_type"><code>EVENTLOG_INFORMATION_TYPE</code></a></strong>

<dd>
<p>An Information event is being logged.</p>
</dd>
</li>
<dt><strong><a name="item_eventlog_audit_success"><code>EVENTLOG_AUDIT_SUCCESS</code></a></strong>

<dd>
<p>A Success Audit event is being logged (typically in the Security
EventLog).</p>
</dd>
</li>
<dt><strong><a name="item_eventlog_audit_failure"><code>EVENTLOG_AUDIT_FAILURE</code></a></strong>

<dd>
<p>A Failure Audit event is being logged (typically in the Security
EventLog).</p>
</dd>
</li>
</dl>
<p>These constants are exported into the main namespace by default.</p>
<dt><strong><a name="item_category"><code>Category</code></a></strong>

<dd>
<p>The <a href="#item_category"><code>Category</code></a> field can have any value you want. It is specific to
the particular Source.</p>
</dd>
</li>
<dt><strong><a name="item_eventid"><code>EventID</code></a></strong>

<dd>
<p>The <a href="#item_eventid"><code>EventID</code></a> field should contain the ID of the message that this
event pertains too. This assumes that you have an associated message
file (indirectly referenced by the field <a href="#item_source"><code>Source</code></a>).</p>
</dd>
</li>
<dt><strong><a name="item_data"><code>Data</code></a></strong>

<dd>
<p>The <a href="#item_data"><code>Data</code></a> field contains raw data associated with this event.</p>
</dd>
</li>
<dt><strong><a name="item_strings"><code>Strings</code></a></strong>

<dd>
<p>The <a href="#item_strings"><code>Strings</code></a> field contains the single string that itself contains
NUL terminated sub-strings. This are used with the EventID to generate
the message as seen from (for example) the Event Viewer application.</p>
</dd>
</li>
</dl>
</dl>
<p>
</p>
<hr />
<h1><a name="other_win32__eventlog_functions_">Other Win32::EventLog functions.</a></h1>
<p>The following functions are part of the Win32::EventLog package but
are not callable from an EventLog object.</p>
<dl>
<dt><strong><a name="item_getmessagetext">GetMessageText(HASHREF);</a></strong>

<dd>
<p>The <a href="#item_getmessagetext"><code>GetMessageText()</code></a> function assumes that HASHREF was obtained by
a call to <a href="#item_read"><code>$handle-&gt;Read()</code></a>. It returns the formatted string that
represents the fully resolved text of the EventLog message (such as
would be seen in the Windows NT Event Viewer). For convenience, the
key 'Message' in the supplied HASHREF is also set to the return value
of this function.</p>
</dd>
<dd>
<p>If you set the variable $Win32::EventLog::GetMessageText to 1 then
each call to <a href="#item_read"><code>$handle-&gt;Read()</code></a> will call this function automatically.</p>
</dd>
</li>
</dl>
<p>
</p>
<hr />
<h1><a name="example_1">Example 1</a></h1>
<p>The following example illustrates the way in which the EventLog module
can be used. It opens the System EventLog and reads through it from
oldest to newest records. For each record from the <strong>Source</strong> EventLog
it extracts the full text of the Entry and prints the EventLog message
text out.</p>
<pre>
 <span class="keyword">use</span> <span class="variable">Win32::EventLog</span><span class="operator">;</span>
</pre>
<pre>
 <span class="variable">$handle</span><span class="operator">=</span><span class="variable">Win32::EventLog</span><span class="operator">-&gt;</span><span class="variable">new</span><span class="operator">(</span><span class="string">"System"</span><span class="operator">,</span> <span class="variable">$ENV</span><span class="operator">{</span><span class="string">ComputerName</span><span class="operator">}</span><span class="operator">)</span>
        <span class="keyword">or</span> <span class="keyword">die</span> <span class="string">"Can't open Application EventLog\n"</span><span class="operator">;</span>
 <span class="variable">$handle</span><span class="operator">-&gt;</span><span class="variable">GetNumber</span><span class="operator">(</span><span class="variable">$recs</span><span class="operator">)</span>
        <span class="keyword">or</span> <span class="keyword">die</span> <span class="string">"Can't get number of EventLog records\n"</span><span class="operator">;</span>
 <span class="variable">$handle</span><span class="operator">-&gt;</span><span class="variable">GetOldest</span><span class="operator">(</span><span class="variable">$base</span><span class="operator">)</span>
        <span class="keyword">or</span> <span class="keyword">die</span> <span class="string">"Can't get number of oldest EventLog record\n"</span><span class="operator">;</span>
</pre>
<pre>
 <span class="keyword">while</span> <span class="operator">(</span><span class="variable">$x</span> <span class="operator">&lt;</span> <span class="variable">$recs</span><span class="operator">)</span> <span class="operator">{</span>
        <span class="variable">$handle</span><span class="operator">-&gt;</span><span class="variable">Read</span><span class="operator">(</span><span class="variable">EVENTLOG_FORWARDS_READ</span><span class="operator">|</span><span class="variable">EVENTLOG_SEEK_READ</span><span class="operator">,</span>
                                  <span class="variable">$base</span><span class="operator">+</span><span class="variable">$x</span><span class="operator">,</span>
                                  <span class="variable">$hashRef</span><span class="operator">)</span>
                <span class="keyword">or</span> <span class="keyword">die</span> <span class="string">"Can't read EventLog entry #$x\n"</span><span class="operator">;</span>
        <span class="keyword">if</span> <span class="operator">(</span><span class="variable">$hashRef</span><span class="operator">-&gt;</span><span class="operator">{</span><span class="string">Source</span><span class="operator">}</span> <span class="keyword">eq</span> <span class="string">"EventLog"</span><span class="operator">)</span> <span class="operator">{</span>
                <span class="variable">Win32::EventLog::GetMessageText</span><span class="operator">(</span><span class="variable">$hashRef</span><span class="operator">);</span>
                <span class="keyword">print</span> <span class="string">"Entry $x: $hashRef-&gt;{Message}\n"</span><span class="operator">;</span>
        <span class="operator">}</span>
        <span class="variable">$x</span><span class="operator">++;</span>
 <span class="operator">}</span>
</pre>
<p>
</p>
<hr />
<h1><a name="example_2">Example 2</a></h1>
<p>To backup and clear the EventLogs on a remote machine, do the following :-</p>
<pre>
 <span class="keyword">use</span> <span class="variable">Win32::EventLog</span><span class="operator">;</span>
</pre>
<pre>
 <span class="variable">$myServer</span><span class="operator">=</span><span class="string">"\\\\my-server"</span><span class="operator">;</span>     <span class="comment"># your servername here.</span>
 <span class="keyword">my</span><span class="operator">(</span><span class="variable">$date</span><span class="operator">)=</span><span class="keyword">join</span><span class="operator">(</span><span class="string">"-"</span><span class="operator">,</span> <span class="operator">((</span><span class="keyword">split</span><span class="operator">(</span><span class="regex">/\s+/</span><span class="operator">,</span> <span class="keyword">scalar</span><span class="operator">(</span><span class="keyword">localtime</span><span class="operator">)))</span><span class="operator">[</span><span class="number">0</span><span class="operator">,</span><span class="number">1</span><span class="operator">,</span><span class="number">2</span><span class="operator">,</span><span class="number">4</span><span class="operator">]</span><span class="operator">));</span>
 <span class="keyword">my</span><span class="operator">(</span><span class="variable">$dest</span><span class="operator">);</span>
</pre>
<pre>
 <span class="keyword">for</span> <span class="keyword">my</span> <span class="variable">$eventLog</span> <span class="operator">(</span><span class="string">"Application"</span><span class="operator">,</span> <span class="string">"System"</span><span class="operator">,</span> <span class="string">"Security"</span><span class="operator">)</span> <span class="operator">{</span>
        <span class="variable">$handle</span><span class="operator">=</span><span class="variable">Win32::EventLog</span><span class="operator">-&gt;</span><span class="variable">new</span><span class="operator">(</span><span class="variable">$eventLog</span><span class="operator">,</span> <span class="variable">$myServer</span><span class="operator">)</span>
                <span class="keyword">or</span> <span class="keyword">die</span> <span class="string">"Can't open Application EventLog on $myServer\n"</span><span class="operator">;</span>
</pre>
<pre>
        <span class="variable">$dest</span><span class="operator">=</span><span class="string">"C:\\BackupEventLogs\\$eventLog\\$date.evt"</span><span class="operator">;</span>
        <span class="variable">$handle</span><span class="operator">-&gt;</span><span class="variable">Backup</span><span class="operator">(</span><span class="variable">$dest</span><span class="operator">)</span>
                <span class="keyword">or</span> <span class="keyword">warn</span> <span class="string">"Could not backup and clear the $eventLog EventLog on $myServer ($^E)\n"</span><span class="operator">;</span>
</pre>
<pre>
        <span class="variable">$handle</span><span class="operator">-&gt;</span><span class="variable">Close</span><span class="operator">;</span>
         <span class="operator">}</span>
</pre>
<p>Note that only the Clear method is required. Note also that if the
file $dest exists, the function will fail.</p>
<p>
</p>
<hr />
<h1><a name="bugs">BUGS</a></h1>
<p>None currently known.</p>
<p>The test script for 'make test' should be re-written to use the
EventLog object.</p>
<p>
</p>
<hr />
<h1><a name="author">AUTHOR</a></h1>
<p>Original code by Jesse Dougherty for HiP Communications. Additional
fixes and updates attributed to Martin Pauley
&lt;<a href="mailto:[e-mail]">[e-mail]</a>&gt;) and Bret Giddings (<a href="mailto:[e-mail]">[e-mail]</a>)</p>

</body>

</html>