use Win32::EventLog; $SecPerDay = 24 * 60 * 60 ; $Now = time (); $DayAgo=$Now - $SecPerDay; $Flag = EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ ; #@Servers= ("server1","server2"); #$EVENT_TYPE = EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE | EVENTLOG_INFORMATION_TYPE; $EVENT_TYPE = EVENTLOG_ERROR_TYPE ; $Machine=shift @ARGV; while ( $Machine ) { my $Event = new Win32::EventLog( "System", $Machine ) || die "Unable to Connect !!! \n"; print "Processing $Machine ..............\n"; $Num=0; if ( $Event->GetNumber($Num) ) { do { if( $Event->Read( $Flag, $Num, $Hash ) ) { if( $Hash->{EventType} & $EVENT_TYPE ) { Win32::EventLog::GetMessageText($Hash); if ( $Hash->{Message} ) { print "$Hash->{EventType}: $Hash->{Source} on $Hash->{Computer}". " at ".localtime($Hash->{TimeGenerated}) . ".\n"; print "$Hash->{Message}\n"; }; } } else { print Win32::FormatMessage(Win32::GetLastError()); undef %Hash; } $Num = 0; } while( $DayAgo < $Hash->{TimeGenerated} ); } Win32::EventLog::CloseEventLog( $Event ); $Machine=shift @ARGV; }