LogfAddOffsetInformation LogfAllocAndBuildNewRecord LogfBackupFile LogfClearFile LogfClose LogfCloseAll LogfCreate LogfDeleteOffsetInformation LogfGetCurrentRecord LogfGetOldestRecord LogFileListCs LogFileListHead LogfInitializeExisting LogfInitializeNew LogfListAddItem LogfListHead LogfListInitialize LogfListItemByIndex LogfListItemByName LogfListItemCount LogfListItemIndexByName LogfListRemoveItem LogfOffsetByNumber LogfReadEvent LogfReportEvent LogfWriteData ReadAnsiLogEntry

static NTSTATUS LogfInitializeExisting ( PLOGFILE  LogFile ) [static] Definition at line 85 of file file.c. Referenced by LogfCreate(). { DWORD dwRead; DWORD dwRecordsNumber = 0; DWORD dwRecSize, dwRecSign, dwFilePointer; PDWORD pdwRecSize2; PEVENTLOGRECORD RecBuf; BOOL OvewrWrittenRecords = FALSE; DPRINT("Initializing LogFile %S\n",LogFile->LogName); if (SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN) == INVALID_SET_FILE_POINTER) { DPRINT1("SetFilePointer failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } if (!ReadFile(LogFile->hFile, &LogFile->Header, sizeof(EVENTLOGHEADER), &dwRead, NULL)) { DPRINT1("ReadFile failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } if (dwRead != sizeof(EVENTLOGHEADER)) { DPRINT("EventLog: Invalid file %S.\n", LogFile->FileName); return STATUS_EVENTLOG_FILE_CORRUPT; } if (LogFile->Header.HeaderSize != sizeof(EVENTLOGHEADER) || LogFile->Header.EndHeaderSize != sizeof(EVENTLOGHEADER)) { DPRINT("EventLog: Invalid header size in %S.\n", LogFile->FileName); return STATUS_EVENTLOG_FILE_CORRUPT; } if (LogFile->Header.Signature != LOGFILE_SIGNATURE) { DPRINT("EventLog: Invalid signature %x in %S.\n", LogFile->Header.Signature, LogFile->FileName); return STATUS_EVENTLOG_FILE_CORRUPT; } if (LogFile->Header.EndOffset > GetFileSize(LogFile->hFile, NULL) + 1) { DPRINT("EventLog: Invalid eof offset %x in %S.\n", LogFile->Header.EndOffset, LogFile->FileName); return STATUS_EVENTLOG_FILE_CORRUPT; } /* Set the read location to the oldest record */ dwFilePointer = SetFilePointer(LogFile->hFile, LogFile->Header.StartOffset, NULL, FILE_BEGIN); if (dwFilePointer == INVALID_SET_FILE_POINTER) { DPRINT1("SetFilePointer failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } for (;;) { dwFilePointer = SetFilePointer(LogFile->hFile, 0, NULL, FILE_CURRENT); if (dwFilePointer == INVALID_SET_FILE_POINTER) { DPRINT1("SetFilePointer failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } /* If the EVENTLOGEOF info has been reached and the oldest record was not immediately after the Header */ if ((dwFilePointer == LogFile->Header.EndOffset) && (LogFile->Header.StartOffset != sizeof(EVENTLOGHEADER))) { OvewrWrittenRecords = TRUE; /* The file has records that overwrote old ones so read them */ dwFilePointer = SetFilePointer(LogFile->hFile, sizeof(EVENTLOGHEADER), NULL, FILE_BEGIN); } if (!ReadFile(LogFile->hFile, &dwRecSize, sizeof(dwRecSize), &dwRead, NULL)) { DPRINT1("ReadFile failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } if (dwRead != sizeof(dwRecSize)) break; if (!ReadFile(LogFile->hFile, &dwRecSign, sizeof(dwRecSign), &dwRead, NULL)) { DPRINT1("ReadFile() failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } if (dwRead != sizeof(dwRecSize)) break; if (dwRecSign != LOGFILE_SIGNATURE || dwRecSize + dwFilePointer > GetFileSize(LogFile->hFile, NULL) + 1 || dwRecSize < sizeof(EVENTLOGRECORD)) { break; } if (SetFilePointer(LogFile->hFile, -((LONG) sizeof(DWORD) * 2), NULL, FILE_CURRENT) == INVALID_SET_FILE_POINTER) { DPRINT1("SetFilePointer() failed! %d", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } RecBuf = (PEVENTLOGRECORD) HeapAlloc(MyHeap, 0, dwRecSize); if (RecBuf == NULL) { DPRINT1("Can't allocate heap!\n"); return STATUS_NO_MEMORY; } if (!ReadFile(LogFile->hFile, RecBuf, dwRecSize, &dwRead, NULL)) { DPRINT1("ReadFile() failed! %d\n", GetLastError()); HeapFree(MyHeap, 0, RecBuf); return STATUS_EVENTLOG_FILE_CORRUPT; } if (dwRead != dwRecSize) { HeapFree(MyHeap, 0, RecBuf); break; } /* if OvewrWrittenRecords is TRUE and this record has already been read */ if ((OvewrWrittenRecords == TRUE) && (RecBuf->RecordNumber == LogFile->Header.OldestRecordNumber)) { HeapFree(MyHeap, 0, RecBuf); break; } pdwRecSize2 = (PDWORD) (((PBYTE) RecBuf) + dwRecSize - 4); if (*pdwRecSize2 != dwRecSize) { DPRINT1("Invalid RecordSizeEnd of record %d (%x) in %S\n", dwRecordsNumber, *pdwRecSize2, LogFile->LogName); HeapFree(MyHeap, 0, RecBuf); break; } dwRecordsNumber++; if (!LogfAddOffsetInformation(LogFile, RecBuf->RecordNumber, dwFilePointer)) { DPRINT1("LogfAddOffsetInformation() failed!\n"); HeapFree(MyHeap, 0, RecBuf); return STATUS_EVENTLOG_FILE_CORRUPT; } HeapFree(MyHeap, 0, RecBuf); } LogFile->Header.CurrentRecordNumber = dwRecordsNumber + LogFile->Header.OldestRecordNumber; if (LogFile->Header.CurrentRecordNumber == 0) LogFile->Header.CurrentRecordNumber = 1; /* FIXME: Read MaxSize from registry for this LogFile. But for now limit EventLog size to just under 5K. */ LogFile->Header.MaxSize = 5000; if (SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN) == INVALID_SET_FILE_POINTER) { DPRINT1("SetFilePointer() failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } if (!WriteFile(LogFile->hFile, &LogFile->Header, sizeof(EVENTLOGHEADER), &dwRead, NULL)) { DPRINT1("WriteFile failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } if (!FlushFileBuffers(LogFile->hFile)) { DPRINT1("FlushFileBuffers failed! %d\n", GetLastError()); return STATUS_EVENTLOG_FILE_CORRUPT; } return STATUS_SUCCESS; }