eventlog.c File Reference

#include "eventlog.h"
#include <stdio.h>
#include <netevent.h>
#include <debug.h>

Include dependency graph for eventlog.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
static VOID CALLBACK	ServiceMain (DWORD, LPWSTR *)
static VOID	UpdateServiceStatus (DWORD dwState)
static DWORD WINAPI	ServiceControlHandler (DWORD dwControl, DWORD dwEventType, LPVOID lpEventData, LPVOID lpContext)
static DWORD	ServiceInit (VOID)
static VOID	ReportProductInfoEvent (VOID)
static PLOGFILE	LoadLogFile (HKEY hKey, PWSTR LogName)
static BOOL	LoadLogFiles (HKEY eventlogKey)
int	wmain (int argc, WCHAR *argv[])
VOID	PRINT_RECORD (PEVENTLOGRECORD pRec)

Variables
static WCHAR	ServiceName [] = L"EventLog"
static SERVICE_TABLE_ENTRYW	ServiceTable [2]
SERVICE_STATUS	ServiceStatus
SERVICE_STATUS_HANDLE	ServiceStatusHandle
BOOL	onLiveCD = FALSE
PEVENTSOURCE	EventLogSource = NULL

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 17 of file eventlog.c.

Function Documentation

LoadLogFile()

static PLOGFILE LoadLogFile ( HKEY  hKey, PWSTR  LogName  )

static

Definition at line 281 of file eventlog.c.

{
    DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
    PWSTR Buf = NULL, Expanded = NULL;
    LONG Result;
    PLOGFILE pLogf = NULL;
    UNICODE_STRING FileName;
    ULONG ulMaxSize, ulRetention;
    NTSTATUS Status;
 
    DPRINT("LoadLogFile: `%S'\n", LogName);
 
    Result = RegQueryInfoKeyW(hKey, NULL, NULL, NULL, NULL, NULL, NULL,
                              NULL, NULL, &MaxValueLen, NULL, NULL);
    if (Result != ERROR_SUCCESS)
    {
        DPRINT1("RegQueryInfoKeyW failed: %lu\n", Result);
        return NULL;
    }
 
    MaxValueLen = ROUND_DOWN(MaxValueLen, sizeof(WCHAR));
    Buf = HeapAlloc(GetProcessHeap(), 0, MaxValueLen);
    if (!Buf)
    {
        DPRINT1("Cannot allocate heap!\n");
        return NULL;
    }
 
    ValueLen = MaxValueLen;
    Result = RegQueryValueExW(hKey,
                              L"File",
                              NULL,
                              &Type,
                              (LPBYTE)Buf,
                              &ValueLen);
    /*
     * If we failed, because the registry value was inexistent
     * or the value type was incorrect, create a new "File" value
     * that holds the default event log path.
     */
    if ((Result != ERROR_SUCCESS) || (Type != REG_EXPAND_SZ && Type != REG_SZ))
    {
        MaxValueLen = (wcslen(L"%SystemRoot%\\System32\\Config\\") +
                       wcslen(LogName) + wcslen(L".evt") + 1) * sizeof(WCHAR);
 
        Expanded = HeapReAlloc(GetProcessHeap(), 0, Buf, MaxValueLen);
        if (!Expanded)
        {
            DPRINT1("Cannot reallocate heap!\n");
            HeapFree(GetProcessHeap(), 0, Buf);
            return NULL;
        }
        Buf = Expanded;
 
        StringCbCopyW(Buf, MaxValueLen, L"%SystemRoot%\\System32\\Config\\");
        StringCbCatW(Buf, MaxValueLen, LogName);
        StringCbCatW(Buf, MaxValueLen, L".evt");
 
        ValueLen = MaxValueLen;
        Result = RegSetValueExW(hKey,
                                L"File",
                                0,
                                REG_EXPAND_SZ,
                                (LPBYTE)Buf,
                                ValueLen);
        if (Result != ERROR_SUCCESS)
        {
            DPRINT1("RegSetValueExW failed: %lu\n", Result);
            HeapFree(GetProcessHeap(), 0, Buf);
            return NULL;
        }
    }
 
    ExpandedLen = ExpandEnvironmentStringsW(Buf, NULL, 0);
    Expanded = HeapAlloc(GetProcessHeap(), 0, ExpandedLen * sizeof(WCHAR));
    if (!Expanded)
    {
        DPRINT1("Cannot allocate heap!\n");
        HeapFree(GetProcessHeap(), 0, Buf);
        return NULL;
    }
 
    ExpandEnvironmentStringsW(Buf, Expanded, ExpandedLen);
 
    if (!RtlDosPathNameToNtPathName_U(Expanded, &FileName, NULL, NULL))
    {
        DPRINT1("Cannot convert path!\n");
        HeapFree(GetProcessHeap(), 0, Expanded);
        HeapFree(GetProcessHeap(), 0, Buf);
        return NULL;
    }
 
    DPRINT("%S -> %S\n", Buf, Expanded);
 
    ValueLen = sizeof(ulMaxSize);
    Result = RegQueryValueExW(hKey,
                              L"MaxSize",
                              NULL,
                              &Type,
                              (LPBYTE)&ulMaxSize,
                              &ValueLen);
    if ((Result != ERROR_SUCCESS) || (Type != REG_DWORD))
    {
        ulMaxSize = 512 * 1024; /* 512 kBytes */
 
        Result = RegSetValueExW(hKey,
                                L"MaxSize",
                                0,
                                REG_DWORD,
                                (LPBYTE)&ulMaxSize,
                                sizeof(ulMaxSize));
    }
 
    ValueLen = sizeof(ulRetention);
    Result = RegQueryValueExW(hKey,
                              L"Retention",
                              NULL,
                              &Type,
                              (LPBYTE)&ulRetention,
                              &ValueLen);
    if ((Result != ERROR_SUCCESS) || (Type != REG_DWORD))
    {
        /* On Windows 2003 it is 604800 (secs) == 7 days */
        ulRetention = 0;
 
        Result = RegSetValueExW(hKey,
                                L"Retention",
                                0,
                                REG_DWORD,
                                (LPBYTE)&ulRetention,
                                sizeof(ulRetention));
    }
 
    // TODO: Add, or use, default values for "AutoBackupLogFiles" (REG_DWORD)
    // and "CustomSD" (REG_SZ).
 
    Status = LogfCreate(&pLogf, LogName, &FileName, ulMaxSize, ulRetention, TRUE, FALSE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to create %S! (Status %08lx)\n", Expanded, Status);
    }
 
    HeapFree(GetProcessHeap(), 0, Expanded);
    HeapFree(GetProcessHeap(), 0, Buf);
    RtlFreeHeap(RtlGetProcessHeap(), 0, FileName.Buffer);
    return pLogf;
}

Referenced by LoadLogFiles().

LoadLogFiles()

static BOOL LoadLogFiles ( HKEY  eventlogKey )

static

Definition at line 430 of file eventlog.c.

{
    LONG Result;
    DWORD MaxLognameLen, LognameLen;
    DWORD dwIndex;
    PWSTR Buf = NULL;
    PLOGFILE pLogFile;
 
    Result = RegQueryInfoKeyW(eventlogKey, NULL, NULL, NULL, NULL, &MaxLognameLen,
                              NULL, NULL, NULL, NULL, NULL, NULL);
    if (Result != ERROR_SUCCESS)
    {
        DPRINT1("RegQueryInfoKeyW failed: %lu\n", Result);
        return FALSE;
    }
 
    MaxLognameLen++;
 
    Buf = HeapAlloc(GetProcessHeap(), 0, MaxLognameLen * sizeof(WCHAR));
    if (!Buf)
    {
        DPRINT1("Error: cannot allocate heap!\n");
        return FALSE;
    }
 
    LognameLen = MaxLognameLen;
    dwIndex = 0;
    while (RegEnumKeyExW(eventlogKey,
                         dwIndex,
                         Buf,
                         &LognameLen,
                         NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
    {
        HKEY SubKey;
 
        DPRINT("%S\n", Buf);
 
        Result = RegOpenKeyExW(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
        if (Result != ERROR_SUCCESS)
        {
            DPRINT1("Failed to open %S key.\n", Buf);
            HeapFree(GetProcessHeap(), 0, Buf);
            return FALSE;
        }
 
        pLogFile = LoadLogFile(SubKey, Buf);
        if (pLogFile != NULL)
        {
            DPRINT("Loaded %S\n", Buf);
            LoadEventSources(SubKey, pLogFile);
        }
        else
        {
            DPRINT1("Failed to load %S\n", Buf);
        }
 
        RegCloseKey(SubKey);
 
        LognameLen = MaxLognameLen;
        dwIndex++;
    }
 
    HeapFree(GetProcessHeap(), 0, Buf);
    return TRUE;
}

Referenced by wmain().

PRINT_RECORD()

VOID PRINT_RECORD

(

PEVENTLOGRECORD

pRec

)

Definition at line 545 of file eventlog.c.

{
    UINT i;
    PWSTR str;
    LARGE_INTEGER SystemTime;
    TIME_FIELDS Time;
 
    DPRINT1("PRINT_RECORD(0x%p)\n", pRec);
 
    DbgPrint("Length = %lu\n", pRec->Length);
    DbgPrint("Reserved = 0x%x\n", pRec->Reserved);
    DbgPrint("RecordNumber = %lu\n", pRec->RecordNumber);
 
    RtlSecondsSince1970ToTime(pRec->TimeGenerated, &SystemTime);
    RtlTimeToTimeFields(&SystemTime, &Time);
    DbgPrint("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n",
             Time.Day, Time.Month, Time.Year,
             Time.Hour, Time.Minute, Time.Second);
 
    RtlSecondsSince1970ToTime(pRec->TimeWritten, &SystemTime);
    RtlTimeToTimeFields(&SystemTime, &Time);
    DbgPrint("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n",
             Time.Day, Time.Month, Time.Year,
             Time.Hour, Time.Minute, Time.Second);
 
    DbgPrint("EventID = %lu\n", pRec->EventID);
 
    switch (pRec->EventType)
    {
        case EVENTLOG_ERROR_TYPE:
            DbgPrint("EventType = EVENTLOG_ERROR_TYPE\n");
            break;
        case EVENTLOG_WARNING_TYPE:
            DbgPrint("EventType = EVENTLOG_WARNING_TYPE\n");
            break;
        case EVENTLOG_INFORMATION_TYPE:
            DbgPrint("EventType = EVENTLOG_INFORMATION_TYPE\n");
            break;
        case EVENTLOG_AUDIT_SUCCESS:
            DbgPrint("EventType = EVENTLOG_AUDIT_SUCCESS\n");
            break;
        case EVENTLOG_AUDIT_FAILURE:
            DbgPrint("EventType = EVENTLOG_AUDIT_FAILURE\n");
            break;
        default:
            DbgPrint("EventType = %hu\n", pRec->EventType);
    }
 
    DbgPrint("NumStrings = %hu\n", pRec->NumStrings);
    DbgPrint("EventCategory = %hu\n", pRec->EventCategory);
    DbgPrint("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
    DbgPrint("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber);
    DbgPrint("StringOffset = %lu\n", pRec->StringOffset);
    DbgPrint("UserSidLength = %lu\n", pRec->UserSidLength);
    DbgPrint("UserSidOffset = %lu\n", pRec->UserSidOffset);
    DbgPrint("DataLength = %lu\n", pRec->DataLength);
    DbgPrint("DataOffset = %lu\n", pRec->DataOffset);
 
    i = sizeof(EVENTLOGRECORD);
    DbgPrint("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + i));
 
    i += (wcslen((PWSTR)((ULONG_PTR)pRec + i)) + 1) * sizeof(WCHAR);
    DbgPrint("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + i));
 
    if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
    {
        DbgPrint("Strings:\n");
        str = (PWSTR)((ULONG_PTR)pRec + pRec->StringOffset);
        for (i = 0; i < pRec->NumStrings; i++)
        {
            DbgPrint("[%u] %S\n", i, str);
            str += wcslen(str) + 1;
        }
    }
 
    DbgPrint("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4));
}

Referenced by ProcessPortMessage().

ReportProductInfoEvent()

static VOID ReportProductInfoEvent ( VOID  )

static

Definition at line 155 of file eventlog.c.

{
    OSVERSIONINFOW versionInfo;
    WCHAR szBuffer[512];
    PWSTR str;
    size_t cchRemain;
    HKEY hKey;
    DWORD dwValueLength;
    DWORD dwType;
    LONG lResult = ERROR_SUCCESS;
 
    ZeroMemory(&versionInfo, sizeof(versionInfo));
    versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
 
    /* Get version information */
    if (!GetVersionExW(&versionInfo))
        return;
 
    ZeroMemory(szBuffer, sizeof(szBuffer));
    str = szBuffer;
    cchRemain = ARRAYSIZE(szBuffer);
 
    /* Write the version number into the buffer */
    StringCchPrintfExW(str, cchRemain,
                       &str, &cchRemain, 0,
                       L"%lu.%lu",
                       versionInfo.dwMajorVersion,
                       versionInfo.dwMinorVersion);
    str++;
    cchRemain++;
 
    /* Write the build number into the buffer */
    StringCchPrintfExW(str, cchRemain,
                       &str, &cchRemain, 0,
                       L"%lu",
                       versionInfo.dwBuildNumber);
    str++;
    cchRemain++;
 
    /* Write the service pack info into the buffer */
    StringCchCopyExW(str, cchRemain,
                     versionInfo.szCSDVersion,
                     &str, &cchRemain, 0);
    str++;
    cchRemain++;
 
    /* Read 'CurrentType' from the registry and write it into the buffer */
    lResult = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
                            L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                            0,
                            KEY_QUERY_VALUE,
                            &hKey);
    if (lResult == ERROR_SUCCESS)
    {
        dwValueLength = cchRemain;
        lResult = RegQueryValueExW(hKey,
                                   L"CurrentType",
                                   NULL,
                                   &dwType,
                                   (LPBYTE)str,
                                   &dwValueLength);
 
        RegCloseKey(hKey);
    }
 
    /* Log the product information */
    LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
                    0,
                    EVENT_EventLogProductInfo,
                    4,
                    szBuffer,
                    0,
                    NULL);
}

Referenced by ServiceMain().

ServiceControlHandler()

static DWORD WINAPI ServiceControlHandler ( DWORD  dwControl, DWORD  dwEventType, LPVOID  lpEventData, LPVOID  lpContext  )

static

Definition at line 62 of file eventlog.c.

{
    DPRINT("ServiceControlHandler() called\n");
 
    switch (dwControl)
    {
        case SERVICE_CONTROL_STOP:
            DPRINT("  SERVICE_CONTROL_STOP received\n");
 
            LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
                            0,
                            EVENT_EventlogStopped, 0, NULL, 0, NULL);
 
            /* Stop listening to incoming RPC messages */
            RpcMgmtStopServerListening(NULL);
            UpdateServiceStatus(SERVICE_STOPPED);
            return ERROR_SUCCESS;
 
        case SERVICE_CONTROL_PAUSE:
            DPRINT("  SERVICE_CONTROL_PAUSE received\n");
            UpdateServiceStatus(SERVICE_PAUSED);
            return ERROR_SUCCESS;
 
        case SERVICE_CONTROL_CONTINUE:
            DPRINT("  SERVICE_CONTROL_CONTINUE received\n");
            UpdateServiceStatus(SERVICE_RUNNING);
            return ERROR_SUCCESS;
 
        case SERVICE_CONTROL_INTERROGATE:
            DPRINT("  SERVICE_CONTROL_INTERROGATE received\n");
            SetServiceStatus(ServiceStatusHandle,
                             &ServiceStatus);
            return ERROR_SUCCESS;
 
        case SERVICE_CONTROL_SHUTDOWN:
            DPRINT("  SERVICE_CONTROL_SHUTDOWN received\n");
 
            LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
                            0,
                            EVENT_EventlogStopped, 0, NULL, 0, NULL);
 
            UpdateServiceStatus(SERVICE_STOPPED);
            return ERROR_SUCCESS;
 
        default:
            DPRINT1("  Control %lu received\n", dwControl);
            return ERROR_CALL_NOT_IMPLEMENTED;
    }
}

Referenced by ServiceMain().

ServiceInit()

static DWORD ServiceInit ( VOID  )

static

Definition at line 117 of file eventlog.c.

{
    HANDLE hThread;
 
    hThread = CreateThread(NULL,
                           0,
                           (LPTHREAD_START_ROUTINE)PortThreadRoutine,
                           NULL,
                           0,
                           NULL);
    if (!hThread)
    {
        DPRINT("Cannot create PortThread\n");
        return GetLastError();
    }
    else
        CloseHandle(hThread);
 
    hThread = CreateThread(NULL,
                           0,
                           RpcThreadRoutine,
                           NULL,
                           0,
                           NULL);
 
    if (!hThread)
    {
        DPRINT("Cannot create RpcThread\n");
        return GetLastError();
    }
    else
        CloseHandle(hThread);
 
    return ERROR_SUCCESS;
}

Referenced by ServiceMain().

ServiceMain()

static VOID CALLBACK ServiceMain ( DWORD  argc, LPWSTR *  argv  )

static

Definition at line 232 of file eventlog.c.

{
    DWORD dwError;
 
    UNREFERENCED_PARAMETER(argc);
    UNREFERENCED_PARAMETER(argv);
 
    DPRINT("ServiceMain() called\n");
 
    ServiceStatusHandle = RegisterServiceCtrlHandlerExW(ServiceName,
                                                        ServiceControlHandler,
                                                        NULL);
    if (!ServiceStatusHandle)
    {
        dwError = GetLastError();
        DPRINT1("RegisterServiceCtrlHandlerW() failed! (Error %lu)\n", dwError);
        return;
    }
 
    UpdateServiceStatus(SERVICE_START_PENDING);
 
    dwError = ServiceInit();
    if (dwError != ERROR_SUCCESS)
    {
        DPRINT("Service stopped (dwError: %lu\n", dwError);
        UpdateServiceStatus(SERVICE_START_PENDING);
    }
    else
    {
        DPRINT("Service started\n");
        UpdateServiceStatus(SERVICE_RUNNING);
 
        ReportProductInfoEvent();
 
        LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
                        0,
                        EVENT_EventlogStarted,
                        0,
                        NULL,
                        0,
                        NULL);
    }
 
    DPRINT("ServiceMain() done\n");
}

UpdateServiceStatus()

static VOID UpdateServiceStatus ( DWORD  dwState )

static

Definition at line 40 of file eventlog.c.

{
    ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
    ServiceStatus.dwCurrentState = dwState;
    ServiceStatus.dwControlsAccepted = 0;
    ServiceStatus.dwWin32ExitCode = 0;
    ServiceStatus.dwServiceSpecificExitCode = 0;
    ServiceStatus.dwCheckPoint = 0;
 
    if (dwState == SERVICE_START_PENDING ||
        dwState == SERVICE_STOP_PENDING ||
        dwState == SERVICE_PAUSE_PENDING ||
        dwState == SERVICE_CONTINUE_PENDING)
        ServiceStatus.dwWaitHint = 10000;
    else
        ServiceStatus.dwWaitHint = 0;
 
    SetServiceStatus(ServiceStatusHandle,
                     &ServiceStatus);
}

Referenced by ServiceControlHandler(), and ServiceMain().

wmain()

int wmain	(	int	argc,
		WCHAR *	argv[]
	)

Definition at line 497 of file eventlog.c.

{
    INT RetCode = 0;
    LONG Result;
    HKEY elogKey;
    WCHAR LogPath[MAX_PATH];
 
    LogfListInitialize();
    InitEventSourceList();
 
    GetSystemWindowsDirectoryW(LogPath, ARRAYSIZE(LogPath));
 
    if (GetDriveTypeW(LogPath) == DRIVE_CDROM)
    {
        DPRINT("LiveCD detected\n");
        onLiveCD = TRUE;
    }
    else
    {
        Result = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
                               L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
                               0,
                               KEY_ALL_ACCESS,
                               &elogKey);
        if (Result != ERROR_SUCCESS)
        {
            DPRINT1("Fatal error: cannot open eventlog registry key.\n");
            RetCode = 1;
            goto bye_bye;
        }
 
        LoadLogFiles(elogKey);
    }
 
    EventLogSource = GetEventSourceByName(L"EventLog");
    if (!EventLogSource)
    {
        DPRINT1("The 'EventLog' source is unavailable. The EventLog service will not be able to log its own events.\n");
    }
 
    StartServiceCtrlDispatcher(ServiceTable);
 
bye_bye:
    LogfCloseAll();
 
    return RetCode;
}

Variable Documentation

EventLogSource

PEVENTSOURCE EventLogSource = NULL

Definition at line 35 of file eventlog.c.

Referenced by CheckLogOrSourceExistence(), InstallEventSource(), LogfReportEvent(), and wmain().

onLiveCD

BOOL onLiveCD = FALSE

Definition at line 33 of file eventlog.c.

Referenced by ProcessPortMessage(), and wmain().

ServiceName

WCHAR ServiceName[] = L"EventLog"

static

Definition at line 23 of file eventlog.c.

Referenced by ServiceMain().

ServiceStatus

SERVICE_STATUS ServiceStatus

Definition at line 30 of file eventlog.c.

Referenced by ServiceControlHandler(), and UpdateServiceStatus().

ServiceStatusHandle

SERVICE_STATUS_HANDLE ServiceStatusHandle

Definition at line 31 of file eventlog.c.

Referenced by ServiceControlHandler(), ServiceMain(), and UpdateServiceStatus().

ServiceTable

SERVICE_TABLE_ENTRYW ServiceTable[2]

static

Initial value:

=
{
    { ServiceName, ServiceMain },
    { NULL, NULL }
}

Definition at line 24 of file eventlog.c.

Referenced by _tmain(), KiSystemService(), and wmain().