Help with searching through the event log

Hiya folks.

Basically i've written a script to check the event log on our print server (every print job is logged for auditing/cost centres purposes). At the moment, it will search the event log from the oldest log to the newest, with any print event is recorded.  I've  tried changing the way the script works, so that now a start date and end date can be specified (if for example they wanted a monthly report) but the problem i've found is that it is still searching from the beginning of the log, which will take an increasingly longer amount of time as the event log grows and if i only want (for example) the last 2 days logs it will take the same amount of time as if i wanted the entire log! So my question is, can i make it so the search starts from a start date?

Below is the section that i know needs changing, luckily i comment most of my code so i remember what it does! I believe i need to change "while ( $x < $recs)" ?

 $handle=Win32::EventLog->new("System", $server)
        or die "Can't open Application EventLog\n";
 $handle->GetNumber($recs) # Get the number of records in the log
        or die "Can't get number of EventLog records\n";
 $handle->GetOldest($base) # Get the number of the oldest record
        or die "Can't get number of oldest EventLog record\n";

 my @printerlogs;
 my %printerdata;
 my %printtotal; # Total number of pages for each printer
 my $grandtotal = 0;  # The total number of pages printed
 my $x;
   
 while ( $x < $recs) {
        $handle->Read(EVENTLOG_FORWARDS_READ|EVENTLOG_SEEK_READ,
                                  $base+$x,
                                  $hashRef)
                or die "Can't read EventLog entry #$x\n";
        my @date = localtime( $hashRef->{TimeGenerated} );
          my $LogDate = sprintf("%04d%02d%02d", ($date[5]+1900, ($date[4])+1, $date[3] ));
            # Logdate is the date of the event, in YYYYMMDD format
            my ($day, $month, $year) = split /[-\/]/, $startdate;
                $convstartdate = sprintf("%04d%02d%02d", $year, $month, $day);
            # Converts the startdate to YYYYMMDD for comparison compatibility
            my ($day, $month, $year) = split /[-\/]/, $enddate;
            $convenddate = sprintf("%04d%02d%02d", $year, $month, $day);
            # Converts the enddate to YYYYMMDD for comparison compatibility
            if (($hashRef->{EventID} == 1073741834) && ($LogDate >= $convstartdate) && ($LogDate <= $convenddate)) {  # 1073741834 = Event ID of a Print job
                     Win32::EventLog::GetMessageText($hashRef);
                      push @printerlogs, $hashRef->{Message};
            }
  $x++;
 } # Reads the event log, and if the Event ID is matched then read the message

Any help would be appreciated.Start Free Trial