eventlogrpc.idl

Go to the documentation of this file.

/*
 * Event Log RPC interface definition
 */

#include <ms-dtyp.idl>

cpp_quote("#if !defined(__EVENTLOG_H__) && !defined(__ADVAPI32_H)")
typedef long NTSTATUS;
cpp_quote("#endif")

#define MAX_STRINGS      0x00000100
#define MAX_SINGLE_EVENT 0x0003FFFF // On Vista+ this is reduced to 0x0000F000
#define MAX_BATCH_BUFF   0x0007FFFF

typedef [range(0, MAX_BATCH_BUFF)] unsigned long RULONG;
typedef struct _RPC_STRING {
    USHORT Length;
    USHORT MaximumLength;
    [size_is(MaximumLength), length_is(Length)] LPSTR Buffer;
} RPC_STRING, *PRPC_STRING;

typedef [context_handle] PVOID IELF_HANDLE;
typedef IELF_HANDLE *PIELF_HANDLE;
typedef [handle, unique] LPWSTR EVENTLOG_HANDLE_W;
typedef [handle, unique] LPSTR EVENTLOG_HANDLE_A;

typedef struct _RPC_CLIENT_ID {
    ULONG UniqueProcess;
    ULONG UniqueThread;
} RPC_CLIENT_ID, *PRPC_CLIENT_ID;

[
    uuid(82273FDC-E32A-18C3-3F78-827929DC23EA),
    version(0.0),
    pointer_default(unique),
    endpoint("ncacn_np:[\\pipe\\EventLog]")
#ifndef __midl
    ,explicit_handle
#endif
]

interface eventlog
{
    /* Function 0 */
    NTSTATUS
    __stdcall
    ElfrClearELFW(
        [in] IELF_HANDLE LogHandle,
        [in, unique] PRPC_UNICODE_STRING BackupFileName);

    /* Function 1 */
     NTSTATUS
    __stdcall
    ElfrBackupELFW(
        [in] IELF_HANDLE LogHandle,
        [in, unique] PRPC_UNICODE_STRING BackupFileName);

    /* Function 2 */
    NTSTATUS
    __stdcall
    ElfrCloseEL(
        [in, out] PIELF_HANDLE LogHandle);

    /* Function 3 */
    NTSTATUS
    __stdcall
    ElfrDeregisterEventSource(
        [in, out] PIELF_HANDLE LogHandle);

    /* Function 4 */
    NTSTATUS
    __stdcall
    ElfrNumberOfRecords(
        [in] IELF_HANDLE LogHandle,
        [out] PULONG NumberOfRecords);

    /* Function 5 */
    NTSTATUS
    __stdcall
    ElfrOldestRecord(
        [in] IELF_HANDLE LogHandle,
        [out] PULONG OldestRecordNumber);

    /* Function 6 */
    NTSTATUS
    __stdcall
    ElfrChangeNotify(
        [in] IELF_HANDLE LogHandle,
        [in] RPC_CLIENT_ID ClientId,
        [in] ULONG Event);

    /* Function 7 */
    NTSTATUS
    __stdcall
    ElfrOpenELW(
        [in, unique] EVENTLOG_HANDLE_W UNCServerName, /* FIXME */
        [in] PRPC_UNICODE_STRING ModuleName,
        [in] PRPC_UNICODE_STRING RegModuleName,
        [in] ULONG MajorVersion,
        [in] ULONG MinorVersion,
        [out] PIELF_HANDLE LogHandle);

    /* Function 8 */
    NTSTATUS
    __stdcall
    ElfrRegisterEventSourceW(
        [in, unique] EVENTLOG_HANDLE_W UNCServerName, /* FIXME */
        [in] PRPC_UNICODE_STRING ModuleName,
        [in] PRPC_UNICODE_STRING RegModuleName,
        [in] ULONG MajorVersion,
        [in] ULONG MinorVersion,
        [out] PIELF_HANDLE LogHandle);

    /* Function 9 */
    NTSTATUS
    __stdcall
    ElfrOpenBELW(
        [in, unique] EVENTLOG_HANDLE_W UNCServerName, /* FIXME */
        [in] PRPC_UNICODE_STRING BackupFileName,
        [in] ULONG MajorVersion,
        [in] ULONG MinorVersion,
        [out] PIELF_HANDLE LogHandle);

    /* Function 10 */
    NTSTATUS
    __stdcall
    ElfrReadELW(
        [in] IELF_HANDLE LogHandle,
        [in] ULONG ReadFlags,
        [in] ULONG RecordOffset,
        [in] RULONG NumberOfBytesToRead,
        [out, size_is(NumberOfBytesToRead)] PBYTE Buffer,
        [out] PULONG NumberOfBytesRead,
        [out] PULONG MinNumberOfBytesNeeded);

    /* Function 11 */
    NTSTATUS
    __stdcall
    ElfrReportEventW(
        [in] IELF_HANDLE LogHandle,
        [in] ULONG Time,
        [in] USHORT EventType,
        [in] USHORT EventCategory,
        [in] ULONG EventID,
        [in, range(0, MAX_STRINGS)] USHORT NumStrings,
        [in, range(0, MAX_SINGLE_EVENT)] ULONG DataSize,
        [in] PRPC_UNICODE_STRING ComputerName,
        [in, unique] PRPC_SID UserSID,
        [in, size_is(NumStrings), unique] PRPC_UNICODE_STRING Strings[*],
        [in, size_is(DataSize), unique] PBYTE Data,
        [in] USHORT Flags,
        [in, out, unique] PULONG RecordNumber,
        [in, out, unique] PULONG TimeWritten);

    /* Function 12 */
    NTSTATUS
    __stdcall
    ElfrClearELFA(
        [in] IELF_HANDLE LogHandle,
        [in, unique] PRPC_STRING BackupFileName);

    /* Function 13 */
    NTSTATUS
    __stdcall
    ElfrBackupELFA(
        [in] IELF_HANDLE LogHandle,
        [in, unique] PRPC_STRING BackupFileName);

    /* Function 14 */
    NTSTATUS
    __stdcall
    ElfrOpenELA(
        [in, unique] EVENTLOG_HANDLE_A UNCServerName, /* FIXME */
        [in] PRPC_STRING ModuleName,
        [in] PRPC_STRING RegModuleName,
        [in] ULONG MajorVersion,
        [in] ULONG MinorVersion,
        [out] PIELF_HANDLE LogHandle);

    /* Function 15 */
    NTSTATUS
    __stdcall
    ElfrRegisterEventSourceA(
        [in, unique] EVENTLOG_HANDLE_A UNCServerName, /* FIXME */
        [in] PRPC_STRING ModuleName,
        [in] PRPC_STRING RegModuleName,
        [in] ULONG MajorVersion,
        [in] ULONG MinorVersion,
        [out] PIELF_HANDLE LogHandle);

    /* Function 16 */
    NTSTATUS
    __stdcall
    ElfrOpenBELA(
        [in, unique] EVENTLOG_HANDLE_A UNCServerName, /* FIXME */
        [in] PRPC_STRING BackupFileName,
        [in] ULONG MajorVersion,
        [in] ULONG MinorVersion,
        [out] PIELF_HANDLE LogHandle);

    /* Function 17 */
    NTSTATUS
    __stdcall
    ElfrReadELA(
        [in] IELF_HANDLE LogHandle,
        [in] ULONG ReadFlags,
        [in] ULONG RecordOffset,
        [in] RULONG NumberOfBytesToRead,
        [out, size_is(NumberOfBytesToRead)] PBYTE Buffer,
        [out] PULONG NumberOfBytesRead,
        [out] PULONG MinNumberOfBytesNeeded);

    /* Function 18 */
    NTSTATUS
    __stdcall
    ElfrReportEventA(
        [in] IELF_HANDLE LogHandle,
        [in] ULONG Time,
        [in] USHORT EventType,
        [in] USHORT EventCategory,
        [in] ULONG EventID,
        [in, range(0, MAX_STRINGS)] USHORT NumStrings,
        [in, range(0, MAX_SINGLE_EVENT)] ULONG DataSize,
        [in] PRPC_STRING ComputerName,
        [in, unique] PRPC_SID UserSID,
        [in, size_is(NumStrings), unique] PRPC_STRING Strings[*],
        [in, size_is(DataSize), unique] PBYTE Data,
        [in] USHORT Flags,
        [in, out, unique] PULONG RecordNumber,
        [in, out, unique] PULONG TimeWritten);

    /* Function 19 */
    NTSTATUS
    __stdcall
    ElfrRegisterClusterSvc(
        [in] handle_t BindingHandle);

    /* Function 20 */
    NTSTATUS
    __stdcall
    ElfrDeregisterClusterSvc(
        [in] handle_t BindingHandle);

    /* Function 21 */
    NTSTATUS
    __stdcall
    ElfrWriteClusterEvents(
        [in] handle_t BindingHandle);

    /* Function 22 */
    NTSTATUS
    __stdcall
    ElfrGetLogInformation(
        [in] IELF_HANDLE LogHandle,
        [in] ULONG InfoLevel,
        [out, size_is(cbBufSize)] PBYTE Buffer,
        [in, range(0, 1024)] ULONG cbBufSize,
        [out] PULONG pcbBytesNeeded);

    /* Function 23 */
    NTSTATUS
    __stdcall
    ElfrFlushEL(
        [in] IELF_HANDLE LogHandle);

    /* Function 24 */
    NTSTATUS
    __stdcall
    ElfrReportEventAndSourceW(
        [in] IELF_HANDLE LogHandle,
        [in] ULONG Time,
        [in] USHORT EventType,
        [in] USHORT EventCategory,
        [in] ULONG EventID,
        [in] PRPC_UNICODE_STRING SourceName,
        [in, range(0, MAX_STRINGS)] USHORT NumStrings,
        [in, range(0, MAX_SINGLE_EVENT)] ULONG DataSize,
        [in] PRPC_UNICODE_STRING ComputerName,
        [in, unique] PRPC_SID UserSID,
        [in, size_is(NumStrings), unique] PRPC_UNICODE_STRING Strings[*],
        [in, size_is(DataSize), unique] PBYTE Data,
        [in] USHORT Flags,
        [in, out, unique] PULONG RecordNumber,
        [in, out, unique] PULONG TimeWritten);
}