1279 ULONG FreeSpace = 0;
1285 if (LogFile->ReadOnly)
1293 Record->RecordNumber = LogFile->Header.CurrentRecordNumber;
1296 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
1297 FreeSpace = LogFile->Header.MaxSize - LogFile->Header.EndOffset + LogFile->Header.StartOffset -
sizeof(
EVENTLOGHEADER);
1299 FreeSpace = LogFile->Header.StartOffset - LogFile->Header.EndOffset;
1304 if (LogFile->Header.OldestRecordNumber == 0)
1305 LogFile->Header.OldestRecordNumber = 1;
1314 if (LogFile->Header.StartOffset <= LogFile->Header.EndOffset)
1315 UpperBound = LogFile->Header.MaxSize;
1317 UpperBound = LogFile->Header.StartOffset;
1322 EVTLTRACE(
"The event log file has reached maximum size (0x%x), wrapping...\n" 1323 "UpperBound = 0x%x, WriteOffset = 0x%x, BufSize = 0x%x\n",
1328 if ( (LogFile->Header.StartOffset < LogFile->Header.EndOffset) &&
1329 (LogFile->Header.MaxSize -
WriteOffset <
sizeof(RecBuf)) )
1343 UpperBound = LogFile->Header.StartOffset;
1345 FreeSpace = LogFile->Header.StartOffset -
WriteOffset;
1360 ULONG OrgOldestRecordNumber, OldestRecordNumber;
1364 OldestRecordNumber = OrgOldestRecordNumber = LogFile->Header.OldestRecordNumber;
1375 while (FreeSpace <
BufSize +
sizeof(EofRec))
1381 EVTLTRACE1(
"Record number %d cannot be found, or log file is full and cannot wrap!\n", OldestRecordNumber);
1389 Status = LogFile->FileRead(LogFile,
1403 EVTLTRACE1(
"The event log file is corrupted!\n");
1419 if (LogFile->Header.Retention != 0 &&
1424 EVTLTRACE1(
"The event log file is full and cannot wrap because of the retention policy.\n");
1435 OldestRecordNumber++;
1436 RecOffset += RecBuf.
Length;
1437 FreeSpace += RecBuf.
Length;
1444 if (LogFile->Header.MaxSize - RecOffset <
sizeof(
EVENTLOGRECORD))
1447 FreeSpace += LogFile->Header.MaxSize - RecOffset;
1451 EVTLTRACE(
"Record will fit. FreeSpace %d, BufSize %d\n", FreeSpace,
BufSize);
1464 LogFile->Header.OldestRecordNumber = OldestRecordNumber;
1466 if (LogFile->Header.StartOffset == 0)
1477 EVTLTRACE(
"MaxSize = 0x%x, StartOffset = 0x%x, WriteOffset = 0x%x, EndOffset = 0x%x, BufSize = 0x%x\n" 1478 "OldestRecordNumber = %d\n",
1479 LogFile->Header.MaxSize, LogFile->Header.StartOffset,
WriteOffset, LogFile->Header.EndOffset,
BufSize,
1480 OldestRecordNumber);
1489 if (LogFile->CurrentSize < LogFile->Header.MaxSize)
1491 EVTLTRACE1(
"Expanding the log file from %lu to %lu\n",
1492 LogFile->CurrentSize, LogFile->Header.MaxSize);
1494 LogFile->CurrentSize = LogFile->Header.MaxSize;
1495 LogFile->FileSetSize(LogFile, LogFile->CurrentSize, 0);
1506 WrittenLength =
ROUND_DOWN(LogFile->Header.MaxSize - LogFile->Header.EndOffset,
sizeof(
ULONG));
1510 Status = LogFile->FileWrite(LogFile,
1545 LogFile->Header.CurrentRecordNumber++;
1546 if (LogFile->Header.CurrentRecordNumber == 0)
1547 LogFile->Header.CurrentRecordNumber = 1;
1554 LogFile->Header.EndOffset =
FileOffset.QuadPart;
1558 EofRec.
EndRecord = LogFile->Header.EndOffset;
FSRTL_ADVANCED_FCB_HEADER Header
#define STATUS_INVALID_PARAMETER
_Must_inspect_result_ _In_ WDFUSBPIPE _In_ WDFREQUEST _In_opt_ WDFMEMORY _In_opt_ PWDFMEMORY_OFFSET WriteOffset
#define STATUS_LOG_FILE_FULL
#define STATUS_EVENTLOG_FILE_CORRUPT
#define ELF_LOGFILE_HEADER_WRAP
static BOOL ElfpAddOffsetInformation(IN PEVTLOGFILE LogFile, IN ULONG ulNumber, IN ULONG ulOffset)
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
static const EVENTLOGEOF EOFRecord
struct _EVENTLOGHEADER EVENTLOGHEADER
#define ELF_LOGFILE_LOGFULL_WRITTEN
#define RtlFillMemoryUlong(dst, len, val)
#define LOGFILE_SIGNATURE
#define NT_SUCCESS(StatCode)
#define STATUS_ACCESS_DENIED
#define ELF_LOGFILE_HEADER_DIRTY
ULONG CurrentRecordNumber
#define ROUND_DOWN(n, align)
_In_ PFCB _In_ LONGLONG FileOffset
static NTSTATUS WriteLogBuffer(IN PEVTLOGFILE LogFile, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL, IN PLARGE_INTEGER ByteOffset, OUT PLARGE_INTEGER NextOffset OPTIONAL)
NTSTATUS NTAPI ElfFlushFile(IN PEVTLOGFILE LogFile)
#define RtlZeroMemory(Destination, Length)
#define RtlCopyMemory(Destination, Source, Length)
static ULONG ElfpOffsetByNumber(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber)
static BOOL ElfpDeleteOffsetInformation(IN PEVTLOGFILE LogFile, IN ULONG ulNumberMin, IN ULONG ulNumberMax)