- Fix a bug in "close all log files" code.

- Replace custom list functions by RTL ones.
- Fix indentation.

svn path=/trunk/; revision=26626
This commit is contained in:
Dmitry Gorbachev
2007-05-03 07:47:12 +00:00
parent 80b680b6ae
commit 761de0042d
5 changed files with 1256 additions and 1222 deletions
+286 -273
View File
@@ -13,21 +13,20 @@
/* GLOBALS ******************************************************************/
VOID CALLBACK ServiceMain(DWORD argc, LPTSTR *argv);
VOID CALLBACK ServiceMain(DWORD argc, LPTSTR * argv);
SERVICE_TABLE_ENTRY ServiceTable[2] =
{
{L"EventLog", (LPSERVICE_MAIN_FUNCTION)ServiceMain},
{NULL, NULL}
{ L"EventLog", (LPSERVICE_MAIN_FUNCTION) ServiceMain },
{ NULL, NULL }
};
BOOL onLiveCD = FALSE; // On livecd events will go to debug output only
HANDLE MyHeap = NULL;
BOOL onLiveCD = FALSE; // On livecd events will go to debug output only
extern CRITICAL_SECTION LogListCs;
extern PLOGFILE LogListHead;
/* FUNCTIONS ****************************************************************/
VOID CALLBACK ServiceMain(DWORD argc, LPTSTR *argv)
VOID CALLBACK ServiceMain(DWORD argc, LPTSTR * argv)
{
HANDLE hThread;
@@ -38,11 +37,13 @@ VOID CALLBACK ServiceMain(DWORD argc, LPTSTR *argv)
NULL,
0,
NULL);
if(!hThread) DPRINT("Can't create PortThread\n");
else CloseHandle(hThread);
#ifdef RPC_ENABLED
if (!hThread)
DPRINT("Can't create PortThread\n");
else
CloseHandle(hThread);
#ifdef RPC_ENABLED
hThread = CreateThread(NULL,
0,
(LPTHREAD_START_ROUTINE)
@@ -51,306 +52,318 @@ VOID CALLBACK ServiceMain(DWORD argc, LPTSTR *argv)
0,
NULL);
if(!hThread) DPRINT("Can't create RpcThread\n");
else CloseHandle(hThread);
#endif
if (!hThread)
DPRINT("Can't create RpcThread\n");
else
CloseHandle(hThread);
#endif
}
BOOL LoadLogFile(HKEY hKey, WCHAR *LogName)
BOOL LoadLogFile(HKEY hKey, WCHAR * LogName)
{
DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
WCHAR *Buf = NULL, *Expanded = NULL;
LONG Result;
BOOL ret = TRUE;
PLOGFILE pLogf;
DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
WCHAR *Buf = NULL, *Expanded = NULL;
LONG Result;
BOOL ret = TRUE;
PLOGFILE pLogf;
DPRINT("LoadLogFile: %S\n", LogName);
RegQueryInfoKey(hKey, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, &MaxValueLen, NULL, NULL);
Buf = HeapAlloc(MyHeap, 0, MaxValueLen);
if(!Buf)
{
DPRINT1("Can't allocate heap!\n");
return FALSE;
}
ValueLen = MaxValueLen;
Result = RegQueryValueEx(hKey, L"File",
NULL,
&Type,
(LPBYTE)Buf,
&ValueLen);
if(Result != ERROR_SUCCESS)
{
DPRINT1("RegQueryValueEx failed: %d\n", GetLastError());
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
if(Type != REG_EXPAND_SZ && Type != REG_SZ)
{
DPRINT1("%S\\File - value of wrong type %x.\n", LogName, Type);
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
ExpandedLen = ExpandEnvironmentStrings(Buf, NULL, 0);
Expanded = HeapAlloc(MyHeap, 0, ExpandedLen*sizeof(WCHAR));
if(!Expanded)
{
DPRINT1("Can't allocate heap!\n");
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
ExpandEnvironmentStrings(Buf, Expanded, ExpandedLen);
DPRINT("%S -> %S\n", Buf, Expanded);
pLogf = LogfCreate(LogName, Expanded);
DPRINT("LoadLogFile: %S\n", LogName);
if(pLogf == NULL)
{
DPRINT1("Failed to create %S!\n", Expanded);
ret = FALSE;
}
HeapFree(MyHeap, 0, Buf);
HeapFree(MyHeap, 0, Expanded);
return ret;
RegQueryInfoKey(hKey, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, &MaxValueLen, NULL, NULL);
Buf = HeapAlloc(MyHeap, 0, MaxValueLen);
if (!Buf)
{
DPRINT1("Can't allocate heap!\n");
return FALSE;
}
ValueLen = MaxValueLen;
Result = RegQueryValueEx(hKey,
L"File",
NULL,
&Type,
(LPBYTE) Buf,
&ValueLen);
if (Result != ERROR_SUCCESS)
{
DPRINT1("RegQueryValueEx failed: %d\n", GetLastError());
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
if (Type != REG_EXPAND_SZ && Type != REG_SZ)
{
DPRINT1("%S\\File - value of wrong type %x.\n", LogName, Type);
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
ExpandedLen = ExpandEnvironmentStrings(Buf, NULL, 0);
Expanded = HeapAlloc(MyHeap, 0, ExpandedLen * sizeof(WCHAR));
if (!Expanded)
{
DPRINT1("Can't allocate heap!\n");
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
ExpandEnvironmentStrings(Buf, Expanded, ExpandedLen);
DPRINT("%S -> %S\n", Buf, Expanded);
pLogf = LogfCreate(LogName, Expanded);
if (pLogf == NULL)
{
DPRINT1("Failed to create %S!\n", Expanded);
ret = FALSE;
}
HeapFree(MyHeap, 0, Buf);
HeapFree(MyHeap, 0, Expanded);
return ret;
}
BOOL LoadLogFiles(HKEY eventlogKey)
{
LONG result;
DWORD MaxLognameLen, LognameLen;
WCHAR *Buf = NULL;
INT i;
RegQueryInfoKey(eventlogKey, NULL, NULL, NULL, NULL, &MaxLognameLen,
NULL, NULL, NULL, NULL, NULL, NULL);
MaxLognameLen++;
Buf = HeapAlloc(MyHeap, 0, MaxLognameLen*sizeof(WCHAR));
if(!Buf)
{
DPRINT1("Error: can't allocate heap!\n");
return FALSE;
}
i = 0;
LognameLen=MaxLognameLen;
while(RegEnumKeyEx(eventlogKey, i, Buf, &LognameLen, NULL, NULL,
NULL, NULL) == ERROR_SUCCESS)
{
HKEY SubKey;
DPRINT("%S\n", Buf);
result = RegOpenKeyEx(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
if(result != ERROR_SUCCESS)
{
DPRINT1("Failed to open %S key.\n", Buf);
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
if(!LoadLogFile(SubKey, Buf))
DPRINT1("Failed to load %S\n", Buf);
else DPRINT("Loaded %S\n", Buf);
RegCloseKey(SubKey);
LognameLen=MaxLognameLen;
i++;
}
LONG result;
DWORD MaxLognameLen, LognameLen;
WCHAR *Buf = NULL;
INT i;
HeapFree(MyHeap, 0, Buf);
return TRUE;
RegQueryInfoKey(eventlogKey,
NULL, NULL, NULL, NULL,
&MaxLognameLen,
NULL, NULL, NULL, NULL, NULL, NULL);
MaxLognameLen++;
Buf = HeapAlloc(MyHeap, 0, MaxLognameLen * sizeof(WCHAR));
if (!Buf)
{
DPRINT1("Error: can't allocate heap!\n");
return FALSE;
}
i = 0;
LognameLen = MaxLognameLen;
while (RegEnumKeyEx(eventlogKey,
i,
Buf,
&LognameLen,
NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
{
HKEY SubKey;
DPRINT("%S\n", Buf);
result = RegOpenKeyEx(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
if (result != ERROR_SUCCESS)
{
DPRINT1("Failed to open %S key.\n", Buf);
HeapFree(MyHeap, 0, Buf);
return FALSE;
}
if (!LoadLogFile(SubKey, Buf))
DPRINT1("Failed to load %S\n", Buf);
else
DPRINT("Loaded %S\n", Buf);
RegCloseKey(SubKey);
LognameLen = MaxLognameLen;
i++;
}
HeapFree(MyHeap, 0, Buf);
return TRUE;
}
INT main()
{
WCHAR LogPath[MAX_PATH];
PLOGFILE pLogf;
INT RetCode = 0;
LONG result;
HKEY elogKey;
WCHAR LogPath[MAX_PATH];
INT RetCode = 0;
LONG result;
HKEY elogKey;
InitializeCriticalSection(&LogListCs);
MyHeap = HeapCreate(0, 1024*256, 0);
LogfListInitialize();
if(MyHeap==NULL)
{
DPRINT1("FATAL ERROR, can't create heap.\n");
RetCode = 1;
goto bye_bye;
}
GetWindowsDirectory(LogPath, MAX_PATH);
if(GetDriveType(LogPath) == DRIVE_CDROM)
{
DPRINT("LiveCD detected\n");
onLiveCD = TRUE;
}
else
{
result = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
0,
KEY_ALL_ACCESS,
&elogKey);
if(result != ERROR_SUCCESS)
{
DPRINT1("Fatal error: can't open eventlog registry key.\n");
RetCode = 1;
goto bye_bye;
}
LoadLogFiles(elogKey);
}
MyHeap = HeapCreate(0, 1024 * 256, 0);
StartServiceCtrlDispatcher(ServiceTable);
if (!MyHeap)
{
DPRINT1("FATAL ERROR, can't create heap.\n");
RetCode = 1;
goto bye_bye;
}
bye_bye:
// Close all log files.
for(pLogf = LogListHead; pLogf; pLogf = ((PLOGFILE)pLogf)->Next)
LogfClose(pLogf);
GetWindowsDirectory(LogPath, MAX_PATH);
DeleteCriticalSection(&LogListCs);
if (GetDriveType(LogPath) == DRIVE_CDROM)
{
DPRINT("LiveCD detected\n");
onLiveCD = TRUE;
}
else
{
result = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
0,
KEY_ALL_ACCESS,
&elogKey);
if(MyHeap) HeapDestroy(MyHeap);
if (result != ERROR_SUCCESS)
{
DPRINT1("Fatal error: can't open eventlog registry key.\n");
RetCode = 1;
goto bye_bye;
}
return RetCode;
LoadLogFiles(elogKey);
}
StartServiceCtrlDispatcher(ServiceTable);
bye_bye:
LogfCloseAll();
if (MyHeap)
HeapDestroy(MyHeap);
return RetCode;
}
VOID EventTimeToSystemTime(DWORD EventTime,
SYSTEMTIME *pSystemTime)
VOID EventTimeToSystemTime(DWORD EventTime, SYSTEMTIME * pSystemTime)
{
SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
FILETIME ftLocal;
union {
FILETIME ft;
ULONGLONG ll;
} u1970, uUCT;
uUCT.ft.dwHighDateTime = 0;
uUCT.ft.dwLowDateTime = EventTime;
SystemTimeToFileTime(&st1970, &u1970.ft);
uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
FileTimeToSystemTime(&ftLocal, pSystemTime);
SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
FILETIME ftLocal;
union
{
FILETIME ft;
ULONGLONG ll;
} u1970, uUCT;
uUCT.ft.dwHighDateTime = 0;
uUCT.ft.dwLowDateTime = EventTime;
SystemTimeToFileTime(&st1970, &u1970.ft);
uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
FileTimeToSystemTime(&ftLocal, pSystemTime);
}
VOID SystemTimeToEventTime(SYSTEMTIME *pSystemTime,
DWORD *pEventTime)
VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
{
SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
union {
FILETIME ft;
ULONGLONG ll;
} Time, u1970;
SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
union
{
FILETIME ft;
ULONGLONG ll;
} Time, u1970;
SystemTimeToFileTime(pSystemTime, &Time.ft);
SystemTimeToFileTime(&st1970, &u1970.ft);
*pEventTime = (Time.ll - u1970.ll) / 10000000;
SystemTimeToFileTime(pSystemTime, &Time.ft);
SystemTimeToFileTime(&st1970, &u1970.ft);
*pEventTime = (Time.ll - u1970.ll) / 10000000;
}
VOID PRINT_HEADER(PFILE_HEADER header)
{
DPRINT("SizeOfHeader=%d\n",header->SizeOfHeader);
DPRINT("Signature=0x%x\n",header->Signature);
DPRINT("MajorVersion=%d\n",header->MajorVersion);
DPRINT("MinorVersion=%d\n",header->MinorVersion);
DPRINT("FirstRecordOffset=%d\n",header->FirstRecordOffset);
DPRINT("EofOffset=0x%x\n",header->EofOffset);
DPRINT("NextRecord=%d\n",header->NextRecord);
DPRINT("OldestRecord=%d\n",header->OldestRecord);
DPRINT("unknown1=0x%x\n",header->unknown1);
DPRINT("unknown2=0x%x\n",header->unknown2);
DPRINT("SizeOfHeader2=%d\n",header->SizeOfHeader2);
DPRINT("Flags: ");
if(header->Flags & LOGFILE_FLAG1)DPRINT("LOGFILE_FLAG1 ");
if(header->Flags & LOGFILE_FLAG2)DPRINT("| LOGFILE_FLAG2 ");
if(header->Flags & LOGFILE_FLAG3)DPRINT("| LOGFILE_FLAG3 ");
if(header->Flags & LOGFILE_FLAG4)DPRINT("| LOGFILE_FLAG4");
DPRINT("\n");
DPRINT("SizeOfHeader = %d\n", header->SizeOfHeader);
DPRINT("Signature = 0x%x\n", header->Signature);
DPRINT("MajorVersion = %d\n", header->MajorVersion);
DPRINT("MinorVersion = %d\n", header->MinorVersion);
DPRINT("FirstRecordOffset = %d\n", header->FirstRecordOffset);
DPRINT("EofOffset = 0x%x\n", header->EofOffset);
DPRINT("NextRecord = %d\n", header->NextRecord);
DPRINT("OldestRecord = %d\n", header->OldestRecord);
DPRINT("unknown1 = 0x%x\n", header->unknown1);
DPRINT("unknown2 = 0x%x\n", header->unknown2);
DPRINT("SizeOfHeader2 = %d\n", header->SizeOfHeader2);
DPRINT("Flags: ");
if (header->Flags & LOGFILE_FLAG1) DPRINT("LOGFILE_FLAG1 ");
if (header->Flags & LOGFILE_FLAG2) DPRINT("| LOGFILE_FLAG2 ");
if (header->Flags & LOGFILE_FLAG3) DPRINT("| LOGFILE_FLAG3 ");
if (header->Flags & LOGFILE_FLAG4) DPRINT("| LOGFILE_FLAG4");
DPRINT("\n");
}
VOID PRINT_RECORD(PEVENTLOGRECORD pRec)
{
UINT i;
WCHAR *str;
SYSTEMTIME time;
DPRINT("Length=%d\n", pRec->Length );
DPRINT("Reserved=0x%x\n", pRec->Reserved );
DPRINT("RecordNumber=%d\n", pRec->RecordNumber );
EventTimeToSystemTime(pRec->TimeGenerated, &time);
DPRINT("TimeGenerated=%d.%d.%d %d:%d:%d\n",
time.wDay, time.wMonth, time.wYear,
time.wHour, time.wMinute, time.wSecond);
UINT i;
WCHAR *str;
SYSTEMTIME time;
EventTimeToSystemTime(pRec->TimeWritten, &time);
DPRINT("TimeWritten=%d.%d.%d %d:%d:%d\n",
time.wDay, time.wMonth, time.wYear,
time.wHour, time.wMinute, time.wSecond);
DPRINT("Length = %d\n", pRec->Length);
DPRINT("Reserved = 0x%x\n", pRec->Reserved);
DPRINT("RecordNumber = %d\n", pRec->RecordNumber);
DPRINT("EventID=%d\n", pRec->EventID );
EventTimeToSystemTime(pRec->TimeGenerated, &time);
DPRINT("TimeGenerated = %d.%d.%d %d:%d:%d\n",
time.wDay, time.wMonth, time.wYear,
time.wHour, time.wMinute, time.wSecond);
switch(pRec->EventType)
{
case EVENTLOG_ERROR_TYPE:
DPRINT("EventType = EVENTLOG_ERROR_TYPE\n");
break;
case EVENTLOG_WARNING_TYPE:
DPRINT("EventType = EVENTLOG_WARNING_TYPE\n");
break;
case EVENTLOG_INFORMATION_TYPE:
DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n");
break;
case EVENTLOG_AUDIT_SUCCESS:
DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n");
break;
case EVENTLOG_AUDIT_FAILURE:
DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n");
break;
default:
DPRINT("EventType = %x\n");
}
EventTimeToSystemTime(pRec->TimeWritten, &time);
DPRINT("TimeWritten = %d.%d.%d %d:%d:%d\n",
time.wDay, time.wMonth, time.wYear,
time.wHour, time.wMinute, time.wSecond);
DPRINT("NumStrings=%d\n", pRec->NumStrings );
DPRINT("EventCategory=%d\n", pRec->EventCategory);
DPRINT("ReservedFlags=0x%x\n", pRec->ReservedFlags);
DPRINT("ClosingRecordNumber=%d\n", pRec->ClosingRecordNumber);
DPRINT("StringOffset=%d\n", pRec->StringOffset);
DPRINT("UserSidLength=%d\n", pRec->UserSidLength);
DPRINT("UserSidOffset=%d\n", pRec->UserSidOffset);
DPRINT("DataLength=%d\n", pRec->DataLength);
DPRINT("DataOffset=%d\n", pRec->DataOffset);
DPRINT("EventID = %d\n", pRec->EventID);
DPRINT("SourceName: %S\n", (WCHAR *)(((PBYTE)pRec)+sizeof(EVENTLOGRECORD)));
i = (lstrlenW((WCHAR *)(((PBYTE)pRec)+sizeof(EVENTLOGRECORD)))+1)*sizeof(WCHAR);
DPRINT("ComputerName: %S\n", (WCHAR *)(((PBYTE)pRec)+sizeof(EVENTLOGRECORD)+i));
if(pRec->StringOffset < pRec->Length && pRec->NumStrings){
DPRINT("Strings:\n");
str = (WCHAR*)(((PBYTE)pRec)+pRec->StringOffset);
for(i = 0; i < pRec->NumStrings; i++)
{
DPRINT("[%d] %S\n", i, str);
str = str+lstrlenW(str)+1;
}
}
switch (pRec->EventType)
{
case EVENTLOG_ERROR_TYPE:
DPRINT("EventType = EVENTLOG_ERROR_TYPE\n");
break;
case EVENTLOG_WARNING_TYPE:
DPRINT("EventType = EVENTLOG_WARNING_TYPE\n");
break;
case EVENTLOG_INFORMATION_TYPE:
DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n");
break;
case EVENTLOG_AUDIT_SUCCESS:
DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n");
break;
case EVENTLOG_AUDIT_FAILURE:
DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n");
break;
default:
DPRINT("EventType = %x\n");
}
DPRINT("Length2=%d\n", *(PDWORD)(((PBYTE)pRec)+pRec->Length-4));
DPRINT("NumStrings = %d\n", pRec->NumStrings);
DPRINT("EventCategory = %d\n", pRec->EventCategory);
DPRINT("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
DPRINT("ClosingRecordNumber = %d\n", pRec->ClosingRecordNumber);
DPRINT("StringOffset = %d\n", pRec->StringOffset);
DPRINT("UserSidLength = %d\n", pRec->UserSidLength);
DPRINT("UserSidOffset = %d\n", pRec->UserSidOffset);
DPRINT("DataLength = %d\n", pRec->DataLength);
DPRINT("DataOffset = %d\n", pRec->DataOffset);
DPRINT("SourceName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD)));
i = (lstrlenW((WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD))) + 1) *
sizeof(WCHAR);
DPRINT("ComputerName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD) + i));
if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
{
DPRINT("Strings:\n");
str = (WCHAR *) (((PBYTE) pRec) + pRec->StringOffset);
for (i = 0; i < pRec->NumStrings; i++)
{
DPRINT("[%d] %S\n", i, str);
str = str + lstrlenW(str) + 1;
}
}
DPRINT("Length2 = %d\n", *(PDWORD) (((PBYTE) pRec) + pRec->Length - 4));
}
+78 -76
View File
@@ -3,10 +3,9 @@
* LICENSE: GPL - See COPYING in the top level directory
* FILE: services/eventlog/eventlog.h
* PURPOSE: Event logging service
* COPYRIGHT: Copyright 2005 Saveliy Tretiakov
* COPYRIGHT: Copyright 2005 Saveliy Tretiakov
*/
#ifndef __EVENTLOG_H__
#define __EVENTLOG_H__
@@ -23,7 +22,6 @@
#include <pseh/pseh.h>
#include "eventlogrpc_s.h"
typedef struct _IO_ERROR_LPC
{
PORT_MESSAGE Header;
@@ -36,8 +34,7 @@ typedef struct _IO_ERROR_LPC
/*
* Our file format will be compatible with NT's
*/
#define LOGFILE_SIGNATURE 0x654c664c
#define LOGFILE_SIGNATURE 0x654c664c
/*
* FIXME
@@ -48,63 +45,68 @@ typedef struct _IO_ERROR_LPC
#define LOGFILE_FLAG3 4
#define LOGFILE_FLAG4 8
typedef struct {
DWORD SizeOfHeader;
DWORD Signature;
DWORD MajorVersion;
DWORD MinorVersion;
DWORD FirstRecordOffset;
DWORD EofOffset;
DWORD NextRecord;
DWORD OldestRecord;
DWORD unknown1;
DWORD Flags;
DWORD unknown2;
DWORD SizeOfHeader2;
typedef struct
{
DWORD SizeOfHeader;
DWORD Signature;
DWORD MajorVersion;
DWORD MinorVersion;
DWORD FirstRecordOffset;
DWORD EofOffset;
DWORD NextRecord;
DWORD OldestRecord;
DWORD unknown1;
DWORD Flags;
DWORD unknown2;
DWORD SizeOfHeader2;
} FILE_HEADER, *PFILE_HEADER;
typedef struct {
DWORD Size1;
DWORD Ones; // Must be 0x11111111
DWORD Twos; // Must be 0x22222222
DWORD Threes; // Must be 0x33333333
DWORD Fours; // Must be 0x44444444
DWORD StartOffset;
DWORD EndOffset;
DWORD NextRecordNumber;
DWORD OldestRecordNumber;
DWORD Size2;
typedef struct
{
DWORD Size1;
DWORD Ones; // Must be 0x11111111
DWORD Twos; // Must be 0x22222222
DWORD Threes; // Must be 0x33333333
DWORD Fours; // Must be 0x44444444
DWORD StartOffset;
DWORD EndOffset;
DWORD NextRecordNumber;
DWORD OldestRecordNumber;
DWORD Size2;
} EOF_RECORD, *PEOF_RECORD;
typedef struct {
ULONG EventNumber;
ULONG EventOffset;
typedef struct
{
ULONG EventNumber;
ULONG EventOffset;
} EVENT_OFFSET_INFO, *PEVENT_OFFSET_INFO;
typedef struct {
HANDLE hFile;
FILE_HEADER Header;
WCHAR *LogName;
WCHAR *FileName;
typedef struct
{
HANDLE hFile;
FILE_HEADER Header;
WCHAR *LogName;
WCHAR *FileName;
CRITICAL_SECTION cs;
PEVENT_OFFSET_INFO OffsetInfo;
ULONG OffsetInfoSize;
ULONG OffsetInfoNext;
PVOID Next;
PVOID Prev;
PEVENT_OFFSET_INFO OffsetInfo;
ULONG OffsetInfoSize;
ULONG OffsetInfoNext;
LIST_ENTRY ListEntry;
} LOGFILE, *PLOGFILE;
/* file.c */
PLOGFILE LogfListHead();
VOID LogfListInitialize(VOID);
INT LogfListItemCount();
PLOGFILE LogfListHead(VOID);
INT LogfListItemCount(VOID);
PLOGFILE LogfListItemByIndex(INT Index);
PLOGFILE LogfListItemByName(WCHAR *Name);
PLOGFILE LogfListItemByName(WCHAR * Name);
INT LogfListItemIndexByName(WCHAR *Name);
INT LogfListItemIndexByName(WCHAR * Name);
VOID LogfListAddItem(PLOGFILE Item);
@@ -115,18 +117,20 @@ BOOL LogfReadEvent(PLOGFILE LogFile,
DWORD RecordNumber,
DWORD BufSize,
PBYTE Buffer,
DWORD *BytesRead,
DWORD *BytesNeeded);
DWORD * BytesRead,
DWORD * BytesNeeded);
BOOL LogfWriteData(PLOGFILE LogFile,
DWORD BufSize,
PBYTE Buffer);
DWORD BufSize,
PBYTE Buffer);
PLOGFILE LogfCreate(WCHAR *LogName,
WCHAR *FileName);
PLOGFILE LogfCreate(WCHAR * LogName,
WCHAR * FileName);
VOID LogfClose(PLOGFILE LogFile);
VOID LogfCloseAll(VOID);
BOOL LogfInitializeNew(PLOGFILE LogFile);
BOOL LogfInitializeExisting(PLOGFILE LogFile);
@@ -134,25 +138,25 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile);
DWORD LogfGetOldestRecord(PLOGFILE LogFile);
ULONG LogfOffsetByNumber(PLOGFILE LogFile,
DWORD RecordNumber);
DWORD RecordNumber);
BOOL LogfAddOffsetInformation(PLOGFILE LogFile,
ULONG ulNumber,
ULONG ulOffset);
BOOL LogfAddOffsetInformation(PLOGFILE LogFile,
ULONG ulNumber,
ULONG ulOffset);
PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
DWORD dwRecordNumber,
WORD wType,
WORD wCategory,
DWORD dwEventId,
LPCWSTR SourceName,
LPCWSTR ComputerName,
DWORD dwSidLength,
PSID lpUserSid,
WORD wNumStrings,
WCHAR *lpStrings,
DWORD dwDataSize,
LPVOID lpRawData);
DWORD dwRecordNumber,
WORD wType,
WORD wCategory,
DWORD dwEventId,
LPCWSTR SourceName,
LPCWSTR ComputerName,
DWORD dwSidLength,
PSID lpUserSid,
WORD wNumStrings,
WCHAR * lpStrings,
DWORD dwDataSize,
LPVOID lpRawData);
void __inline LogfFreeRecord(LPVOID Rec);
@@ -161,11 +165,11 @@ VOID PRINT_HEADER(PFILE_HEADER header);
VOID PRINT_RECORD(PEVENTLOGRECORD pRec);
VOID EventTimeToSystemTime(DWORD EventTime,
SYSTEMTIME *SystemTime);
VOID EventTimeToSystemTime(DWORD EventTime,
SYSTEMTIME * SystemTime);
VOID SystemTimeToEventTime(SYSTEMTIME *pSystemTime,
DWORD *pEventTime);
VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime,
DWORD * pEventTime);
/* logport.c */
NTSTATUS STDCALL PortThreadRoutine(PVOID Param);
@@ -177,6 +181,4 @@ NTSTATUS ProcessPortMessage(VOID);
/* rpc.c */
DWORD STDCALL RpcThreadRoutine(LPVOID lpParameter);
#endif /* __EVENTLOG_H__ */
#endif /* __EVENTLOG_H__ */
File diff suppressed because it is too large Load Diff
+72 -87
View File
@@ -23,20 +23,18 @@ extern BOOL onLiveCD;
NTSTATUS STDCALL PortThreadRoutine(PVOID Param)
{
NTSTATUS Status = STATUS_SUCCESS;
Status = InitLogPort();
if(!NT_SUCCESS(Status))
if (!NT_SUCCESS(Status))
return Status;
while(NT_SUCCESS(Status))
{
while (NT_SUCCESS(Status))
Status = ProcessPortMessage();
}
if(ConnectPortHandle != NULL)
if (ConnectPortHandle != NULL)
NtClose(ConnectPortHandle);
if(MessagePortHandle != NULL)
if (MessagePortHandle != NULL)
NtClose(MessagePortHandle);
return Status;
@@ -48,47 +46,36 @@ NTSTATUS InitLogPort(VOID)
UNICODE_STRING PortName;
PORT_MESSAGE Request;
NTSTATUS Status;
ConnectPortHandle = NULL;
MessagePortHandle = NULL;
RtlInitUnicodeString(&PortName, L"\\ErrorLogPort");
InitializeObjectAttributes(
&ObjectAttributes,
&PortName,
0,
NULL,
NULL);
InitializeObjectAttributes(&ObjectAttributes, &PortName, 0, NULL, NULL);
Status = NtCreatePort(
&ConnectPortHandle,
&ObjectAttributes,
0,
0x100,
0x2000);
if(!NT_SUCCESS(Status))
Status = NtCreatePort(&ConnectPortHandle,
&ObjectAttributes,
0,
0x100,
0x2000);
if (!NT_SUCCESS(Status))
{
DPRINT1("NtCreatePort() failed (Status %lx)\n", Status);
goto ByeBye;
}
Status = NtListenPort(ConnectPortHandle, &Request);
if(!NT_SUCCESS(Status))
if (!NT_SUCCESS(Status))
{
DPRINT1("NtListenPort() failed (Status %lx)\n", Status);
goto ByeBye;
}
Status = NtAcceptConnectPort(
&MessagePortHandle,
ConnectPortHandle,
NULL,
TRUE,
NULL,
NULL);
Status = NtAcceptConnectPort(&MessagePortHandle, ConnectPortHandle,
NULL, TRUE, NULL, NULL);
if (!NT_SUCCESS(Status))
{
DPRINT1("NtAcceptConnectPort() failed (Status %lx)\n", Status);
@@ -102,42 +89,40 @@ NTSTATUS InitLogPort(VOID)
goto ByeBye;
}
ByeBye:
ByeBye:
if (!NT_SUCCESS(Status))
{
if(ConnectPortHandle != NULL)
if (ConnectPortHandle != NULL)
NtClose(ConnectPortHandle);
if(MessagePortHandle != NULL)
if (MessagePortHandle != NULL)
NtClose(MessagePortHandle);
}
return Status;
}
NTSTATUS ProcessPortMessage(VOID)
{
IO_ERROR_LPC Request;
PIO_ERROR_LOG_MESSAGE Message;
PEVENTLOGRECORD pRec;
PEVENTLOGRECORD pRec;
ULONG ulRecNum;
DWORD dwRecSize;
NTSTATUS Status;
PLOGFILE SystemLog = NULL;
PLOGFILE SystemLog = NULL;
DPRINT("ProcessPortMessage() called\n");
SystemLog = LogfListItemByName(L"System");
while(TRUE)
SystemLog = LogfListItemByName(L"System");
while (TRUE)
{
Status = NtReplyWaitReceivePort(
MessagePortHandle,
0,
NULL,
&Request.Header);
if(!NT_SUCCESS(Status))
Status = NtReplyWaitReceivePort(MessagePortHandle,
0,
NULL,
&Request.Header);
if (!NT_SUCCESS(Status))
{
DPRINT1("NtReplyWaitReceivePort() failed (Status %lx)\n", Status);
break;
@@ -145,58 +130,58 @@ NTSTATUS ProcessPortMessage(VOID)
DPRINT("Received message\n");
if(Request.Header.u2.s2.Type == LPC_PORT_CLOSED)
if (Request.Header.u2.s2.Type == LPC_PORT_CLOSED)
{
DPRINT("Port closed\n");
return STATUS_SUCCESS;
}
if(Request.Header.u2.s2.Type == LPC_REQUEST)
if (Request.Header.u2.s2.Type == LPC_REQUEST)
{
DPRINT("Received request\n");
}
else if (Request.Header.u2.s2.Type == LPC_DATAGRAM)
{
DPRINT("Received datagram\n");
Message = (PIO_ERROR_LOG_MESSAGE)&Request.Message;
ulRecNum = SystemLog ? SystemLog->Header.NextRecord : 0;
Message = (PIO_ERROR_LOG_MESSAGE) & Request.Message;
ulRecNum = SystemLog ? SystemLog->Header.NextRecord : 0;
pRec = (PEVENTLOGRECORD)LogfAllocAndBuildNewRecord(&dwRecSize,
ulRecNum,
Message->Type,
Message->EntryData.EventCategory,
Message->EntryData.ErrorCode,
(WCHAR*)(((PBYTE)Message)+Message->DriverNameOffset),
L"MyComputer", /* FIXME */
0,
NULL,
Message->EntryData.NumberOfStrings,
(WCHAR*)(((PBYTE)Message)+Message->EntryData.StringOffset),
Message->EntryData.DumpDataSize,
(LPVOID)(((PBYTE)Message)
+sizeof(IO_ERROR_LOG_PACKET)-sizeof(ULONG)));
pRec = (PEVENTLOGRECORD) LogfAllocAndBuildNewRecord(&dwRecSize,
ulRecNum, Message->Type, Message->EntryData.EventCategory,
Message->EntryData.ErrorCode,
(WCHAR *) (((PBYTE) Message) + Message->DriverNameOffset),
L"MyComputer", /* FIXME */
0,
NULL,
Message->EntryData.NumberOfStrings,
(WCHAR *) (((PBYTE) Message) + Message->EntryData.StringOffset),
Message->EntryData.DumpDataSize,
(LPVOID) (((PBYTE) Message) + sizeof(IO_ERROR_LOG_PACKET) -
sizeof(ULONG)));
if(pRec == NULL)
{
DPRINT("LogfAllocAndBuildNewRecord failed!\n");
return STATUS_NO_MEMORY;
}
DPRINT("dwRecSize = %d\n", dwRecSize);
DPRINT("\n --- EVENTLOG RECORD ---\n");
PRINT_RECORD(pRec);
DPRINT("\n");
if(!onLiveCD && SystemLog)
{
if(!LogfWriteData(SystemLog, dwRecSize, (PBYTE)pRec))
DPRINT("LogfWriteData failed!\n");
else DPRINT("Data written to Log!\n");
}
if (pRec == NULL)
{
DPRINT("LogfAllocAndBuildNewRecord failed!\n");
return STATUS_NO_MEMORY;
}
LogfFreeRecord(pRec);
DPRINT("dwRecSize = %d\n", dwRecSize);
DPRINT("\n --- EVENTLOG RECORD ---\n");
PRINT_RECORD(pRec);
DPRINT("\n");
if (!onLiveCD && SystemLog)
{
if (!LogfWriteData(SystemLog, dwRecSize, (PBYTE) pRec))
DPRINT("LogfWriteData failed!\n");
else
DPRINT("Data written to Log!\n");
}
LogfFreeRecord(pRec);
}
}
return Status;
}
+155 -161
View File
@@ -5,38 +5,40 @@
* PURPOSE: Event logging service
* COPYRIGHT: Copyright 2005 Saveliy Tretiakov
*/
/* INCLUDES *****************************************************************/
#include "eventlog.h"
#ifdef RPC_ENABLED
/* FUNCTIONS ****************************************************************/
DWORD STDCALL RpcThreadRoutine(LPVOID lpParameter)
{
RPC_STATUS Status;
Status = RpcServerUseProtseqEpW(L"ncacn_np",
20,
L"\\pipe\\EventLog",
NULL);
if(Status != RPC_S_OK)
Status = RpcServerUseProtseqEpW(L"ncacn_np", 20, L"\\pipe\\EventLog", NULL);
if (Status != RPC_S_OK)
{
DPRINT("RpcServerUseProtseqEpW() failed (Status %lx)\n", Status);
return 0;
}
#ifdef _MSC_VER
Status = RpcServerRegisterIf(eventlog_v0_0_s_ifspec, NULL, NULL);
#else
Status = RpcServerRegisterIf(eventlog_ServerIfHandle, NULL, NULL);
#endif
if(Status != RPC_S_OK)
if (Status != RPC_S_OK)
{
DPRINT("RpcServerRegisterIf() failed (Status %lx)\n", Status);
return 0;
}
Status = RpcServerListen(1, RPC_C_LISTEN_MAX_CALLS_DEFAULT, FALSE);
if(Status != RPC_S_OK)
if (Status != RPC_S_OK)
{
DPRINT("RpcServerListen() failed (Status %lx)\n", Status);
}
@@ -45,35 +47,35 @@ DWORD STDCALL RpcThreadRoutine(LPVOID lpParameter)
}
/* Function 0 */
NTSTATUS ElfrClearELFW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ PUNICODE_STRING BackupName)
{
DPRINT("UNIMPLEMENTED");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 1 */
NTSTATUS ElfrBackupELFW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ PUNICODE_STRING BackupName)
NTSTATUS ElfrClearELFW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ PUNICODE_STRING BackupName)
{
DPRINT("UNIMPLEMENTED");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 1 */
NTSTATUS ElfrBackupELFW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ PUNICODE_STRING BackupName)
{
DPRINT("UNIMPLEMENTED");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 2 */
NTSTATUS ElfrCloseEL(
NTSTATUS ElfrCloseEL(
/* [out][in] */ PLOGHANDLE Handle)
{
DPRINT("UNIMPLEMENTED");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 3 */
NTSTATUS ElfrDeregisterEventSource(
NTSTATUS ElfrDeregisterEventSource(
/* [out][in] */ PLOGHANDLE Handle)
{
DPRINT("UNIMPLEMENTED");
@@ -82,9 +84,9 @@ NTSTATUS ElfrDeregisterEventSource(
/* Function 4 */
NTSTATUS ElfrNumberOfRecords(
/* [in] */ LOGHANDLE Handle,
/* [out] */ long __RPC_FAR *NumberOfRecords)
NTSTATUS ElfrNumberOfRecords(
/* [in] */ LOGHANDLE Handle,
/* [out] */ long __RPC_FAR * NumberOfRecords)
{
DPRINT("UNIMPLEMENTED");
return STATUS_NOT_IMPLEMENTED;
@@ -92,9 +94,9 @@ NTSTATUS ElfrNumberOfRecords(
/* Function 5 */
NTSTATUS ElfrOldestRecord(
/* [in] */ LOGHANDLE LogHandle,
/* [out] */ long __RPC_FAR *OldestRecNumber)
NTSTATUS ElfrOldestRecord(
/* [in] */ LOGHANDLE LogHandle,
/* [out] */ long __RPC_FAR * OldestRecNumber)
{
DPRINT("EventLogGetOldestRec UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -102,7 +104,7 @@ NTSTATUS ElfrOldestRecord(
/* Function 6 */
NTSTATUS ElfrChangeNotify( void)
NTSTATUS ElfrChangeNotify(void)
{
DPRINT("EventLogChangeNotify UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -110,39 +112,39 @@ NTSTATUS ElfrChangeNotify( void)
/* Function 7 */
NTSTATUS ElfrOpenELW(
/* [unique][in] */ LPWSTR ServerName,
/* [in] */ PUNICODE_STRING FileName,
/* [in] */ PUNICODE_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
NTSTATUS ElfrOpenELW(
/* [unique][in] */ LPWSTR ServerName,
/* [in] */ PUNICODE_STRING FileName,
/* [in] */ PUNICODE_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
/* [out] */ PLOGHANDLE Handle)
{
DPRINT("EventLogOpenW UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 8 */
NTSTATUS ElfrRegisterEventSourceW(
/* [unique][in] */ LPWSTR ServerName,
/* [in] */ PUNICODE_STRING LogName,
/* [in] */ PUNICODE_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
NTSTATUS ElfrRegisterEventSourceW(
/* [unique][in] */ LPWSTR ServerName,
/* [in] */ PUNICODE_STRING LogName,
/* [in] */ PUNICODE_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
/* [out] */ PLOGHANDLE Handle)
{
DPRINT("EventLogRegSrcW UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 9 */
NTSTATUS ElfrOpenBELW(
/* [unique][in] */ LPWSTR ServerName,
/* [in] */ PUNICODE_STRING BackupName,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
NTSTATUS ElfrOpenBELW(
/* [unique][in] */ LPWSTR ServerName,
/* [in] */ PUNICODE_STRING BackupName,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
/* [out] */ PLOGHANDLE Handle)
{
DPRINT("EventLogOpenBackupW UNIMPLEMENTED\n");
@@ -151,14 +153,14 @@ NTSTATUS ElfrOpenBELW(
/* Function 10 */
NTSTATUS ElfrReadELW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Flags,
/* [in] */ long Offset,
/* [in] */ long BufSize,
/* [size_is][out] */ unsigned char __RPC_FAR *Buffer,
/* [out] */ long __RPC_FAR *BytesRead,
/* [out] */ long __RPC_FAR *BytesNeeded)
NTSTATUS ElfrReadELW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Flags,
/* [in] */ long Offset,
/* [in] */ long BufSize,
/* [size_is][out] */unsigned char __RPC_FAR * Buffer,
/* [out] */ long __RPC_FAR * BytesRead,
/* [out] */ long __RPC_FAR * BytesNeeded)
{
DPRINT("EventLogReadW UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -166,31 +168,31 @@ NTSTATUS ElfrReadELW(
/* Function 11 */
NTSTATUS ElfrReportEventW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Time,
/* [in] */ short Type,
/* [in] */ short Category,
/* [in] */ long ID,
/* [in] */ short NumStrings,
/* [in] */ long DataSize,
/* [in] */ PUNICODE_STRING ComputerName,
/* [unique][in] */ unsigned char __RPC_FAR *SID,
/* [unique][size_is][in] */ PUNICODE_STRING __RPC_FAR Strings[ ],
/* [unique][size_is][in] */ unsigned char __RPC_FAR *Data,
/* [in] */ short Flags,
/* [unique][out][in] */ long __RPC_FAR *unknown1,
/* [unique][out][in] */ long __RPC_FAR *unknown2)
NTSTATUS ElfrReportEventW(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Time,
/* [in] */ short Type,
/* [in] */ short Category,
/* [in] */ long ID,
/* [in] */ short NumStrings,
/* [in] */ long DataSize,
/* [in] */ PUNICODE_STRING ComputerName,
/* [unique][in] */ unsigned char __RPC_FAR * SID,
/* [unique][size_is][in] */ PUNICODE_STRING __RPC_FAR Strings[],
/* [unique][size_is][in] */ unsigned char __RPC_FAR * Data,
/* [in] */ short Flags,
/* [unique][out][in] */ long __RPC_FAR * unknown1,
/* [unique][out][in] */ long __RPC_FAR * unknown2)
{
DPRINT("EventLogReportEventW UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 12 */
NTSTATUS ElfrClearELFA(
/* [in] */ LOGHANDLE Handle,
/* [unique][in] */ PANSI_STRING BackupName)
NTSTATUS ElfrClearELFA(
/* [in] */ LOGHANDLE Handle,
/* [unique][in] */ PANSI_STRING BackupName)
{
DPRINT("EventLogClearA UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -198,9 +200,9 @@ NTSTATUS ElfrClearELFA(
/* Function 13 */
NTSTATUS ElfrBackupELFA(
/* [in] */ LOGHANDLE Handle,
/* [in] */ PANSI_STRING BackupName)
NTSTATUS ElfrBackupELFA(
/* [in] */ LOGHANDLE Handle,
/* [in] */ PANSI_STRING BackupName)
{
DPRINT("EventLogBackupA UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -208,51 +210,46 @@ NTSTATUS ElfrBackupELFA(
/* Function 14 */
NTSTATUS ElfrOpenELA(
/* [unique][in] */ LPSTR ServerName,
/* [in] */ PANSI_STRING LogName,
/* [in] */ PANSI_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
NTSTATUS ElfrOpenELA(
/* [unique][in] */ LPSTR ServerName,
/* [in] */ PANSI_STRING LogName,
/* [in] */ PANSI_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
/* [out] */ PLOGHANDLE Handle)
{
UNICODE_STRING logname = {0}, servername={0}, StrNull = {0};
NTSTATUS status;
UNICODE_STRING logname = { 0 }, servername = { 0 }, StrNull = { 0 };
NTSTATUS status;
if(LogName && !RtlCreateUnicodeStringFromAsciiz(&logname, LogName))
{
return STATUS_NO_MEMORY;
}
if (LogName && !RtlCreateUnicodeStringFromAsciiz(&logname, LogName))
{
return STATUS_NO_MEMORY;
}
if(ServerName &&
!RtlCreateUnicodeStringFromAsciiz(&servername, ServerName))
{
if (ServerName &&
!RtlCreateUnicodeStringFromAsciiz(&servername, ServerName))
{
RtlFreeUnicodeString(&logname);
return STATUS_NO_MEMORY;
}
return STATUS_NO_MEMORY;
}
status = EventLogOpenW(
servername.Buffer,
logname.Buffer,
StrNull,
MajorVer,
MinorVer,
Handle);
status = EventLogOpenW(servername.Buffer, logname.Buffer,
StrNull, MajorVer, MinorVer, Handle);
RtlFreeUnicodeString(&servername);
RtlFreeUnicodeString(&logname);
RtlFreeUnicodeString(&servername);
RtlFreeUnicodeString(&logname);
return status;
}
/* Function 15 */
NTSTATUS ElfrRegisterEventSourceA(
/* [unique][in] */ LPSTR ServerName,
/* [in] */ PANSI_STRING LogName,
/* [in] */ PANSI_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
NTSTATUS ElfrRegisterEventSourceA(
/* [unique][in] */ LPSTR ServerName,
/* [in] */ PANSI_STRING LogName,
/* [in] */ PANSI_STRING NullStr,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
/* [out] */ PLOGHANDLE Handle)
{
DPRINT("EventLogRegSrcA UNIMPLEMENTED\n");
@@ -261,11 +258,11 @@ NTSTATUS ElfrRegisterEventSourceA(
/* Function 16 */
NTSTATUS ElfrOpenBELA(
/* [unique][in] */ LPSTR ServerName,
/* [in] */ PANSI_STRING BakckupName,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
NTSTATUS ElfrOpenBELA(
/* [unique][in] */ LPSTR ServerName,
/* [in] */ PANSI_STRING BakckupName,
/* [in] */ long MajorVer,
/* [in] */ long MinorVer,
/* [out] */ PLOGHANDLE Handle)
{
DPRINT("EventLogOpenBackupA UNIMPLEMENTED\n");
@@ -274,14 +271,14 @@ NTSTATUS ElfrOpenBELA(
/* Function 17 */
NTSTATUS ElfrReadELA(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Flags,
/* [in] */ long Offset,
/* [in] */ long BufSize,
/* [size_is][out] */ unsigned char __RPC_FAR *Buffer,
/* [out] */ long __RPC_FAR *BytesRead,
/* [out] */ long __RPC_FAR *BytesNeeded)
NTSTATUS ElfrReadELA(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Flags,
/* [in] */ long Offset,
/* [in] */ long BufSize,
/* [size_is][out] */unsigned char __RPC_FAR * Buffer,
/* [out] */ long __RPC_FAR * BytesRead,
/* [out] */ long __RPC_FAR * BytesNeeded)
{
DPRINT("EventLogReadA UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -289,21 +286,21 @@ NTSTATUS ElfrReadELA(
/* Function 18 */
NTSTATUS ElfrReportEventA(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Time,
/* [in] */ short Type,
/* [in] */ short Category,
/* [in] */ long ID,
/* [in] */ short NumStrings,
/* [in] */ long DataSize,
/* [in] */ PANSI_STRING ComputerName,
/* [unique][in] */ unsigned char __RPC_FAR *SID,
/* [unique][size_is][in] */ PANSI_STRING __RPC_FAR Strings[ ],
/* [unique][size_is][in] */ unsigned char __RPC_FAR *Data,
/* [in] */ short Flags,
/* [unique][out][in] */ long __RPC_FAR *unknown1,
/* [unique][out][in] */ long __RPC_FAR *unknown2)
NTSTATUS ElfrReportEventA(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long Time,
/* [in] */ short Type,
/* [in] */ short Category,
/* [in] */ long ID,
/* [in] */ short NumStrings,
/* [in] */ long DataSize,
/* [in] */ PANSI_STRING ComputerName,
/* [unique][in] */ unsigned char __RPC_FAR * SID,
/* [unique][size_is][in] */ PANSI_STRING __RPC_FAR Strings[],
/* [unique][size_is][in] */ unsigned char __RPC_FAR * Data,
/* [in] */ short Flags,
/* [unique][out][in] */ long __RPC_FAR * unknown1,
/* [unique][out][in] */ long __RPC_FAR * unknown2)
{
DPRINT("EventLogReportEventA UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -311,15 +308,15 @@ NTSTATUS ElfrReportEventA(
/* Function 19 */
NTSTATUS ElfrRegisterClusterSvc( void)
NTSTATUS ElfrRegisterClusterSvc(void)
{
DPRINT("EventLogRegisterClusterSvc UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
}
/* Function 20 */
NTSTATUS ElfrDeregisterClusterSvc( void)
NTSTATUS ElfrDeregisterClusterSvc(void)
{
DPRINT("EventLogDeregisterClusterSvc UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -327,7 +324,7 @@ NTSTATUS ElfrDeregisterClusterSvc( void)
/* Function 21 */
NTSTATUS ElfrWriteClusterEvents( void)
NTSTATUS ElfrWriteClusterEvents(void)
{
DPRINT("EventLogWriteClusterEvents UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -335,12 +332,12 @@ NTSTATUS ElfrWriteClusterEvents( void)
/* Function 22 */
NTSTATUS ElfrGetLogInformation(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long InfoLevel,
/* [size_is][out] */ unsigned char __RPC_FAR *Buffer,
/* [in] */ long BufSize,
/* [out] */ long __RPC_FAR *BytesNeeded)
NTSTATUS ElfrGetLogInformation(
/* [in] */ LOGHANDLE Handle,
/* [in] */ long InfoLevel,
/* [size_is][out] */unsigned char __RPC_FAR * Buffer,
/* [in] */ long BufSize,
/* [out] */ long __RPC_FAR * BytesNeeded)
{
DPRINT("EventLogGetInfo UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
@@ -348,26 +345,23 @@ NTSTATUS ElfrGetLogInformation(
/* Function 23 */
NTSTATUS ElfrFlushEL(
/* [in] */ LOGHANDLE Handle)
NTSTATUS ElfrFlushEL(
/* [in] */ LOGHANDLE Handle)
{
DbgPrint("EventLogFlush UNIMPLEMENTED\n");
return STATUS_NOT_IMPLEMENTED;
}
#else
void func(handle_t h){}
#endif // RPC_ENABLED
void func(handle_t h) { }
#endif // RPC_ENABLED
void __RPC_FAR * __RPC_USER midl_user_allocate(size_t len)
void __RPC_FAR *__RPC_USER midl_user_allocate(size_t len)
{
return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, len);
}
void __RPC_USER midl_user_free(void __RPC_FAR * ptr)
{
HeapFree(GetProcessHeap(), 0, ptr);
}