perlquestion kar_thik82 <p> Sorry for the previous post .I am developing a log parsing agent to monitor windows Event Logs.I need to call the subroutines parallely which will parse Application and System Event Log types in Windows.I am extremely new to perl. I have tried something like this below but the problem is sometimes the subroutines executes incorrectly means i am writing an output to the file It could not able to do that successfully.</p> <code> #Create threads to run the Subroutines parallely my $thr1 = threads->create(\&parseAppEventLog, "Application"); my $thr2 = threads->create(\&parseSysEventLog, "System"); #Join the threads to execute the Subroutines $thr1->join(); $thr2->join(); #<-------Funtion to Parse AppEvent -----># sub parseAppEventLog { my ($first,$count); $first = $count = 0; my $msg; my $event; my $found = 0; my $EventLog; my $eventSource = $_[0]; my $limit = getLinenoApp(); #my @app_config_field2 = read_file($config_file1) or die "Config file for $config_file1 is missing or could not read - $!"; $EventLog = new Win32::EventLog( $eventSource, '' ) || die $!; $EventLog->GetOldest($first) || die $!; $EventLog->GetNumber($count) || die $!; $Win32::EventLog::GetMessageText = 1; $EventLog->Read((EVENTLOG_SEEK_READ | EVENTLOG_BACKWARDS_READ),$first+$count,$event); open (my $out_app,">$outputfile1") or die "cannot create App event output file - $!"; if ($limit == 0) { $msg = "Common-App##Windows ".$eventSource." Event Log - Event log has not increased in size since last run"; print $out_app $msg; #exit (0); } for my $i ($first+$count-$limit+1..$first+$count) { $EventLog->Read((EVENTLOG_SEQUENTIAL_READ|EVENTLOG_BACKWARDS_READ),0,$event); my $source = $event->{'Source'}; my $timewritten = $event->{'Timewritten'}; my $id = $event->{'EventID'} & 0xffff; #to get a readable EventId my $type = $event->{'EventType'}; my $category = $event->{'Category'}; my $strings = $event->{'Strings'}; my $computer = $event->{'Computer'}; my $eventmsg = $event->{'Message'}; #---Application Common ------# if (length($app_num_common) !=0 ) { my $fr_app_num_common = qr/$app_num_common/; if($id =~ /\b$fr_app_num_common\b/) { #$msg = "1.3.6.1.4.1.326##Windows ".$eventSource." Event Log error-EventID:".$id."-".$eventmsg; $msg = "Common-App##Windows error-EventID:".$id."-".$eventmsg; print $out_app $msg ; } } if (length($app_string_common) !=0 ) { #print $eventmsg; if($eventmsg =~ m/$app_string_common/i) { #$msg = "1.3.6.1.4.1.326##Windows ".$eventSource." Event Log error-EventID:".$id."-".$eventmsg; $msg = "Common-App##Windows error-EventID:".$id."-".$eventmsg; print $out_app $msg; } } #----IIS System ----# if (length($app_num_iis) !=0 ) { my $fr_app_num_iis = qr/$sys_num_iis/; if($id =~ /\b$fr_app_num_iis\b/) { $msg = "IIS##Windows IIS Event Log error-EventID:".$id."-".$eventmsg; print $out_app $msg ; } } if (length($app_string_iis) !=0 ) { #print $eventmsg; if($eventmsg =~ m/$app_string_iis/i) { $msg = "IIS##Windows IIS Event Log error-EventID:".$id."-".$eventmsg; print $out_app $msg; } } #-------Powerpath System ------# if (length($app_num_powerpath) !=0 ) { my $fr_app_num_powerpath = qr/$sys_num_powerpath/; if($id =~ /\b$fr_app_num_powerpath\b/) { $msg = "Powerpath##Windows Powerpath Event Log error-EventID:".$id."-".$eventmsg; print $out_app $msg ; } } if (length($app_string_powerpath) !=0 ) { #print $eventmsg; if($eventmsg =~ m/$app_string_powerpath/i) { $msg = "Powerpath##Windows Powerpath Event Log error-EventID:".$id."-".$eventmsg; print $out_app $msg; } } } close($out_app); } #<-------Funtion to Parse SysEvent -----># sub parseSysEventLog { my ($first,$count); $first = $count = 0; my $msg; my $event; my $found = 0; my $EventLog; my $limit_sys = getLinenoSys(); my $eventSource = $_[0]; # print $limit_sys; #my @app_config_field2 = read_file($config_file1) or die "Config file for $config_file1 is missing or could not read - $!"; $EventLog = new Win32::EventLog( $eventSource, '' ) || die $!; $EventLog->GetOldest($first) || die $!; $EventLog->GetNumber($count) || die $!; $Win32::EventLog::GetMessageText = 1; $EventLog->Read((EVENTLOG_SEEK_READ | EVENTLOG_BACKWARDS_READ),$first+$count,$event); open (my $out_sys,">$outputfile2") or die "cannot create sys event output file - $!"; if ($limit_sys == 0) { $msg = "Common-Sys##Windows ".$eventSource." Event Log - Event log has not increased in size since last run"; print $out_sys $msg; #exit (0); } for my $i ($first+$count-$limit_sys+1..$first+$count) { $EventLog->Read((EVENTLOG_SEQUENTIAL_READ|EVENTLOG_BACKWARDS_READ),0,$event); my $source = $event->{'Source'}; my $timewritten = $event->{'Timewritten'}; my $id = $event->{'EventID'} & 0xffff; #to get a readable EventId my $type = $event->{'EventType'}; my $category = $event->{'Category'}; my $strings = $event->{'Strings'}; my $computer = $event->{'Computer'}; my $eventmsg = $event->{'Message'}; #---System Common ------# if (length($sys_num_common) !=0 ) { my $fr_sys_num_common = qr/$sys_num_common/; if($id =~ /\b$fr_sys_num_common\b/) { $msg = "Common-Sys##Windows error-EventID:".$id."-".$eventmsg; print $out_sys $msg ; } } if (length($sys_string_common) !=0 ) { #print $eventmsg; if($eventmsg =~ m/$sys_string_common/i) { $msg = "Common-Sys##Windows error-EventID:".$id."-".$eventmsg; print $out_sys $msg; } } #----IIS System ----# if (length($sys_num_iis) !=0 ) { my $fr_sys_num_iis = qr/$sys_num_iis/; if($id =~ /\b$fr_sys_num_iis\b/) { $msg = "IIS##Windows IIS Event Log error-EventID:".$id."-".$eventmsg; print $out_sys $msg ; } } if (length($sys_string_iis) !=0 ) { #print $eventmsg; if($eventmsg =~ m/$sys_string_iis/i) { $msg = "IIS##Windows IIS Event Log error-EventID:".$id."-".$eventmsg; print $out_sys $msg; } } #-------Powerpath System ------# if (length($sys_num_powerpath) !=0 ) { my $fr_sys_num_powerpath = qr/$sys_num_powerpath/; if($id =~ /\b$fr_sys_num_powerpath\b/) { $msg = "Powerpath##Windows Powerpath Event Log error-EventID:".$id."-".$eventmsg; print $out_sys $msg ; } } if (length($sys_string_powerpath) !=0 ) { #print $eventmsg; if($eventmsg =~ m/$sys_string_powerpath/i) { $msg = "Powerpath##Windows Powerpath Event Log error-EventID:".$id."-".$eventmsg; print $out_sys $msg; } } } close($out_sys); } </code>