1273{
1279 ULONG FreeSpace = 0;
1282
1284
1285 if (LogFile->ReadOnly)
1287
1288
1289
1292
1293 Record->RecordNumber = LogFile->Header.CurrentRecordNumber;
1294
1295
1296 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
1297 FreeSpace = LogFile->Header.MaxSize - LogFile->Header.EndOffset + LogFile->Header.StartOffset -
sizeof(
EVENTLOGHEADER);
1298 else
1299 FreeSpace = LogFile->Header.StartOffset - LogFile->Header.EndOffset;
1300
1302
1303
1304 if (LogFile->Header.OldestRecordNumber == 0)
1305 LogFile->Header.OldestRecordNumber = 1;
1306
1307
1309
1310
1311
1312
1313
1314 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
1315 UpperBound = LogFile->Header.MaxSize;
1316 else
1317 UpperBound = LogFile->Header.StartOffset;
1318
1319
1321 {
1322 EVTLTRACE(
"The event log file has reached maximum size (0x%x), wrapping...\n"
1323 "UpperBound = 0x%x, WriteOffset = 0x%x, BufSize = 0x%x\n",
1325
1326 }
1327
1328 if ( (LogFile->Header.StartOffset < LogFile->Header.EndOffset) &&
1329 (LogFile->Header.MaxSize -
WriteOffset <
sizeof(RecBuf)) )
1330 {
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1343 UpperBound = LogFile->Header.StartOffset;
1344
1345 FreeSpace = LogFile->Header.StartOffset -
WriteOffset;
1346
1348 }
1349
1350
1351
1352
1353
1354
1355
1356
1357
1359 {
1360 ULONG OrgOldestRecordNumber, OldestRecordNumber;
1361
1362
1363
1364 OldestRecordNumber = OrgOldestRecordNumber = LogFile->Header.OldestRecordNumber;
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375 while (FreeSpace <
BufSize +
sizeof(EofRec))
1376 {
1377
1379 if (RecOffset == 0)
1380 {
1381 EVTLTRACE1(
"Record number %d cannot be found, or log file is full and cannot wrap!\n", OldestRecordNumber);
1384 }
1385
1387
1389 Status = LogFile->FileRead(LogFile,
1391 &RecBuf,
1392 sizeof(RecBuf),
1395 {
1397
1399 }
1400
1402 {
1403 EVTLTRACE1(
"The event log file is corrupted!\n");
1405 }
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419 if (LogFile->Header.Retention != 0 &&
1423 {
1424 EVTLTRACE1(
"The event log file is full and cannot wrap because of the retention policy.\n");
1427 }
1428
1429
1430
1431
1432
1433
1434
1435 OldestRecordNumber++;
1436 RecOffset += RecBuf.
Length;
1437 FreeSpace += RecBuf.
Length;
1438
1439
1440
1441
1442
1443
1444 if (LogFile->Header.MaxSize - RecOffset <
sizeof(
EVENTLOGRECORD))
1445 {
1446
1447 FreeSpace += LogFile->Header.MaxSize - RecOffset;
1448 }
1449 }
1450
1451 EVTLTRACE(
"Record will fit. FreeSpace %d, BufSize %d\n", FreeSpace,
BufSize);
1452
1453
1455
1456
1457
1458
1459
1460
1461
1462
1464 LogFile->Header.OldestRecordNumber = OldestRecordNumber;
1466 if (LogFile->Header.StartOffset == 0)
1467 {
1468
1469
1470
1471
1475 }
1476
1477 EVTLTRACE(
"MaxSize = 0x%x, StartOffset = 0x%x, WriteOffset = 0x%x, EndOffset = 0x%x, BufSize = 0x%x\n"
1478 "OldestRecordNumber = %d\n",
1479 LogFile->Header.MaxSize, LogFile->Header.StartOffset,
WriteOffset, LogFile->Header.EndOffset,
BufSize,
1480 OldestRecordNumber);
1481 }
1482
1483
1484
1485
1486
1487
1488
1489 if (LogFile->CurrentSize < LogFile->Header.MaxSize)
1490 {
1491 EVTLTRACE1(
"Expanding the log file from %lu to %lu\n",
1492 LogFile->CurrentSize, LogFile->Header.MaxSize);
1493
1494 LogFile->CurrentSize = LogFile->Header.MaxSize;
1495 LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
1496 }
1497
1498
1499 LogFile->Header.Flags &= ~ELF_LOGFILE_LOGFULL_WRITTEN;
1500
1501
1502
1503 if (WriteOffset < LogFile->
Header.EndOffset)
1504 {
1505
1506 WrittenLength =
ROUND_DOWN(LogFile->Header.MaxSize - LogFile->Header.EndOffset,
sizeof(
ULONG));
1508
1510 Status = LogFile->FileWrite(LogFile,
1512 &RecBuf,
1513 WrittenLength,
1514 &WrittenLength);
1516 {
1518
1519 }
1520 }
1521
1522
1527 &WrittenLength,
1529 &NextOffset);
1531 {
1534 }
1535
1537
1541 {
1543 }
1544
1545 LogFile->Header.CurrentRecordNumber++;
1546 if (LogFile->Header.CurrentRecordNumber == 0)
1547 LogFile->Header.CurrentRecordNumber = 1;
1548
1549
1550
1551
1552
1553
1554 LogFile->Header.EndOffset =
FileOffset.QuadPart;
1555
1558 EofRec.
EndRecord = LogFile->Header.EndOffset;
1561
1562
1564 &EofRec,
1565 sizeof(EofRec),
1566 &WrittenLength,
1568 &NextOffset);
1570 {
1573 }
1575
1576
1579 {
1582 }
1583
1585}
#define ROUND_DOWN(n, align)
static BOOL ElfpAddOffsetInformation(IN PEVTLOGFILE LogFile, IN ULONG ulNumber, IN ULONG ulOffset)
static BOOL ElfpDeleteOffsetInformation(IN PEVTLOGFILE LogFile, IN ULONG ulNumberMin, IN ULONG ulNumberMax)
static NTSTATUS WriteLogBuffer(IN PEVTLOGFILE LogFile, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL, IN PLARGE_INTEGER ByteOffset, OUT PLARGE_INTEGER NextOffset OPTIONAL)
#define ELF_LOGFILE_LOGFULL_WRITTEN
#define ELF_LOGFILE_HEADER_WRAP
#define RtlFillMemoryUlong(dst, len, val)
#define STATUS_LOG_FILE_FULL
#define STATUS_EVENTLOG_FILE_CORRUPT
#define STATUS_ACCESS_DENIED
_Must_inspect_result_ _In_ WDFUSBPIPE _In_ WDFREQUEST _In_opt_ WDFMEMORY _In_opt_ PWDFMEMORY_OFFSET WriteOffset