ReactOS 0.4.15-dev-8102-g108db8f
evtlib.h
Go to the documentation of this file.
1/*
2 * PROJECT: ReactOS EventLog File Library
3 * LICENSE: GPL - See COPYING in the top level directory
4 * FILE: sdk/lib/evtlib/evtlib.h
5 * PURPOSE: Provides functionality for reading and writing
6 * EventLog files in the NT <= 5.2 (.evt) format.
7 * PROGRAMMERS: Copyright 2005 Saveliy Tretiakov
8 * Michael Martin
9 * Hermes Belusca-Maito
10 */
11
12#ifndef __EVTLIB_H__
13#define __EVTLIB_H__
14
15#pragma once
16
17#ifdef __cplusplus
18extern "C" {
19#endif
20
21/* PSDK/NDK Headers */
22// #define WIN32_NO_STATUS
23// #include <windef.h>
24// #include <winbase.h>
25// #include <winnt.h>
26
27#define NTOS_MODE_USER
28#include <ndk/rtlfuncs.h>
29
30#ifndef ROUND_DOWN
31#define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))
32#endif
33
34#ifndef ROUND_UP
35#define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
36#endif
37
38/*
39 * Our file format will be compatible with NT's
40 */
41#define MAJORVER 1
42#define MINORVER 1
43#define LOGFILE_SIGNATURE 0x654c664c // "LfLe"
44
45/*
46 * Flags used in the logfile header
47 */
48#define ELF_LOGFILE_HEADER_DIRTY 1
49#define ELF_LOGFILE_HEADER_WRAP 2
50#define ELF_LOGFILE_LOGFULL_WRITTEN 4
51#define ELF_LOGFILE_ARCHIVE_SET 8
52
53/*
54 * On-disk event log structures (log file header, event record and EOF record).
55 * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF
56 * structures are absent from winnt.h .
57 */
58
59#include <pshpack4.h> // pshpack1
60
61// ELF_LOGFILE_HEADER
62typedef struct _EVENTLOGHEADER
63{
77
78
79/* Those flags and structure are defined in winnt.h */
80#ifndef _WINNT_
81
82/* EventType flags */
83#define EVENTLOG_SUCCESS 0
84#define EVENTLOG_ERROR_TYPE 1
85#define EVENTLOG_WARNING_TYPE 2
86#define EVENTLOG_INFORMATION_TYPE 4
87#define EVENTLOG_AUDIT_SUCCESS 8
88#define EVENTLOG_AUDIT_FAILURE 16
89
90typedef struct _EVENTLOGRECORD
91{
92 ULONG Length; /* Length of full record, including the data portion */
99 USHORT NumStrings; /* Number of strings in the 'Strings' array */
106 ULONG DataLength; /* Length of the data portion */
107 ULONG DataOffset; /* Offset from beginning of record */
108/*
109 * Length-varying data:
110 *
111 * WCHAR SourceName[];
112 * WCHAR ComputerName[];
113 * SID UserSid; // Must be aligned on a DWORD boundary
114 * WCHAR Strings[];
115 * BYTE Data[];
116 * CHAR Pad[]; // Padding for DWORD boundary
117 * ULONG Length; // Same as the first 'Length' member at the beginning
118 */
120
121#endif // _WINNT_
122
123
124// ELF_EOF_RECORD
125typedef struct _EVENTLOGEOF
126{
138
139#define EVENTLOGEOF_SIZE_FIXED (5 * sizeof(ULONG))
141
142#include <poppack.h>
143
144
145typedef struct _EVENT_OFFSET_INFO
146{
150
151#define TAG_ELF ' flE'
152#define TAG_ELF_BUF 'BflE'
153
154struct _EVTLOGFILE;
155
156typedef PVOID
158 IN SIZE_T Size,
159 IN ULONG Flags,
160 IN ULONG Tag
161);
162
163typedef VOID
165 IN PVOID Ptr,
166 IN ULONG Flags,
167 IN ULONG Tag
168);
169
170typedef NTSTATUS
172 IN struct _EVTLOGFILE* LogFile,
177);
178
179typedef NTSTATUS
181 IN struct _EVTLOGFILE* LogFile,
185 OUT PSIZE_T WrittenLength OPTIONAL
186);
187
188typedef NTSTATUS
190 IN struct _EVTLOGFILE* LogFile,
192 IN ULONG OldFileSize
193);
194
195typedef NTSTATUS
197 IN struct _EVTLOGFILE* LogFile,
200);
201
202typedef struct _EVTLOGFILE
203{
210
212 ULONG CurrentSize; /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */
219
220
222NTAPI
224 IN OUT PEVTLOGFILE LogFile,
227 IN ULONG MaxSize,
228 IN ULONG Retention,
229 IN BOOLEAN CreateNew,
233 IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize,
234 IN PELF_FILE_WRITE_ROUTINE FileWrite,
235 IN PELF_FILE_READ_ROUTINE FileRead,
236 IN PELF_FILE_FLUSH_ROUTINE FileFlush); // What about Seek ??
237
239NTAPI
241 IN PEVTLOGFILE LogFile);
242
243// NTSTATUS
244// ElfClearFile(PEVTLOGFILE LogFile);
245
247NTAPI
249 IN PEVTLOGFILE LogFile,
250 IN PEVTLOGFILE BackupLogFile);
251
253NTAPI
255 IN PEVTLOGFILE LogFile);
256
257VOID
258NTAPI
259ElfCloseFile( // ElfFree
260 IN PEVTLOGFILE LogFile);
261
263NTAPI
265 IN PEVTLOGFILE LogFile,
266 IN ULONG RecordNumber,
268 IN SIZE_T BufSize, // Length
270 OUT PSIZE_T BytesNeeded OPTIONAL);
271
273NTAPI
275 IN PEVTLOGFILE LogFile,
278
279ULONG
280NTAPI
282 IN PEVTLOGFILE LogFile);
283
284ULONG
285NTAPI
287 IN PEVTLOGFILE LogFile);
288
289ULONG
290NTAPI
292 IN PEVTLOGFILE LogFile);
293
294#if DBG
295VOID PRINT_HEADER(PEVENTLOGHEADER Header);
296#endif
297
298#ifdef __cplusplus
299}
300#endif
301#endif /* __EVTLIB_H__ */
ULONG ReadLength
#define BufSize
Definition: FsRtlTunnel.c:28
unsigned char BOOLEAN
#define VOID
Definition: acefi.h:82
LONG NTSTATUS
Definition: precomp.h:26
_In_ PFCB _In_ LONGLONG FileOffset
Definition: cdprocs.h:160
Definition: bufpool.h:45
Definition: Header.h:9
#define NTSTATUS
Definition: precomp.h:21
NTSTATUS(NTAPI * PELF_FILE_FLUSH_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN ULONG Length)
Definition: evtlib.h:196
PVOID(NTAPI * PELF_ALLOCATE_ROUTINE)(IN SIZE_T Size, IN ULONG Flags, IN ULONG Tag)
Definition: evtlib.h:157
NTSTATUS NTAPI ElfReCreateFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:966
VOID(NTAPI * PELF_FREE_ROUTINE)(IN PVOID Ptr, IN ULONG Flags, IN ULONG Tag)
Definition: evtlib.h:164
struct _EVENT_OFFSET_INFO * PEVENT_OFFSET_INFO
VOID NTAPI ElfCloseFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1179
struct _EVENTLOGHEADER * PEVENTLOGHEADER
struct _EVENTLOGEOF EVENTLOGEOF
NTSTATUS(NTAPI * PELF_FILE_SET_SIZE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN ULONG FileSize, IN ULONG OldFileSize)
Definition: evtlib.h:189
NTSTATUS NTAPI ElfWriteRecord(IN PEVTLOGFILE LogFile, IN PEVENTLOGRECORD Record, IN SIZE_T BufSize)
Definition: evtlib.c:1269
ULONG NTAPI ElfGetOldestRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1589
NTSTATUS NTAPI ElfFlushFile(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1134
NTSTATUS NTAPI ElfCreateFile(IN OUT PEVTLOGFILE LogFile, IN PUNICODE_STRING FileName OPTIONAL, IN ULONG FileSize, IN ULONG MaxSize, IN ULONG Retention, IN BOOLEAN CreateNew, IN BOOLEAN ReadOnly, IN PELF_ALLOCATE_ROUTINE Allocate, IN PELF_FREE_ROUTINE Free, IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize, IN PELF_FILE_WRITE_ROUTINE FileWrite, IN PELF_FILE_READ_ROUTINE FileRead, IN PELF_FILE_FLUSH_ROUTINE FileFlush)
Definition: evtlib.c:876
struct _EVTLOGFILE EVTLOGFILE
NTSTATUS NTAPI ElfBackupFile(IN PEVTLOGFILE LogFile, IN PEVTLOGFILE BackupLogFile)
Definition: evtlib.c:979
ULONG NTAPI ElfGetCurrentRecord(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1598
ULONG NTAPI ElfGetFlags(IN PEVTLOGFILE LogFile)
Definition: evtlib.c:1607
NTSTATUS NTAPI ElfReadRecord(IN PEVTLOGFILE LogFile, IN ULONG RecordNumber, OUT PEVENTLOGRECORD Record, IN SIZE_T BufSize, OUT PSIZE_T BytesRead OPTIONAL, OUT PSIZE_T BytesNeeded OPTIONAL)
Definition: evtlib.c:1197
struct _EVENTLOGHEADER EVENTLOGHEADER
struct _EVENTLOGEOF * PEVENTLOGEOF
NTSTATUS(NTAPI * PELF_FILE_READ_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, OUT PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T ReadLength OPTIONAL)
Definition: evtlib.h:171
struct _EVENTLOGRECORD EVENTLOGRECORD
#define EVENTLOGEOF_SIZE_FIXED
Definition: evtlib.h:139
struct _EVENTLOGRECORD * PEVENTLOGRECORD
struct _EVTLOGFILE * PEVTLOGFILE
struct _EVENT_OFFSET_INFO EVENT_OFFSET_INFO
NTSTATUS(NTAPI * PELF_FILE_WRITE_ROUTINE)(IN struct _EVTLOGFILE *LogFile, IN PLARGE_INTEGER FileOffset, IN PVOID Buffer, IN SIZE_T Length, OUT PSIZE_T WrittenLength OPTIONAL)
Definition: evtlib.h:180
_Must_inspect_result_ _Out_ PLARGE_INTEGER FileSize
Definition: fsrtlfuncs.h:108
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
#define C_ASSERT(e)
Definition: intsafe.h:73
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
unsigned short USHORT
Definition: pedump.c:61
@ ReadOnly
Definition: arc.h:80
PULONG MinorVersion OPTIONAL
Definition: CrossNt.h:68
ULONG EndRecord
Definition: evtlib.h:133
ULONG CurrentRecordNumber
Definition: evtlib.h:134
ULONG BeginRecord
Definition: evtlib.h:132
ULONG Threes
Definition: evtlib.h:130
ULONG Ones
Definition: evtlib.h:128
ULONG RecordSizeBeginning
Definition: evtlib.h:127
ULONG Twos
Definition: evtlib.h:129
ULONG RecordSizeEnd
Definition: evtlib.h:136
ULONG OldestRecordNumber
Definition: evtlib.h:135
ULONG Fours
Definition: evtlib.h:131
ULONG MajorVersion
Definition: evtlib.h:66
ULONG CurrentRecordNumber
Definition: evtlib.h:70
ULONG MinorVersion
Definition: evtlib.h:67
ULONG Signature
Definition: evtlib.h:65
ULONG HeaderSize
Definition: evtlib.h:64
ULONG EndOffset
Definition: evtlib.h:69
ULONG Retention
Definition: evtlib.h:74
ULONG StartOffset
Definition: evtlib.h:68
ULONG Flags
Definition: evtlib.h:73
ULONG OldestRecordNumber
Definition: evtlib.h:71
ULONG EndHeaderSize
Definition: evtlib.h:75
ULONG MaxSize
Definition: evtlib.h:72
USHORT ReservedFlags
Definition: evtlib.h:101
ULONG DataOffset
Definition: evtlib.h:107
ULONG Length
Definition: evtlib.h:92
USHORT NumStrings
Definition: evtlib.h:99
ULONG TimeWritten
Definition: evtlib.h:96
ULONG Reserved
Definition: evtlib.h:93
ULONG RecordNumber
Definition: evtlib.h:94
ULONG ClosingRecordNumber
Definition: evtlib.h:102
ULONG UserSidOffset
Definition: evtlib.h:105
ULONG UserSidLength
Definition: evtlib.h:104
ULONG EventID
Definition: evtlib.h:97
ULONG TimeGenerated
Definition: evtlib.h:95
ULONG DataLength
Definition: evtlib.h:106
USHORT EventType
Definition: evtlib.h:98
ULONG StringOffset
Definition: evtlib.h:103
USHORT EventCategory
Definition: evtlib.h:100
ULONG EventOffset
Definition: evtlib.h:148
ULONG EventNumber
Definition: evtlib.h:147
PELF_ALLOCATE_ROUTINE Allocate
Definition: evtlib.h:204
ULONG OffsetInfoSize
Definition: evtlib.h:215
PELF_FILE_FLUSH_ROUTINE FileFlush
Definition: evtlib.h:209
ULONG CurrentSize
Definition: evtlib.h:212
UNICODE_STRING FileName
Definition: evtlib.h:213
ULONG OffsetInfoNext
Definition: evtlib.h:216
EVENTLOGHEADER Header
Definition: evtlib.h:211
PELF_FILE_WRITE_ROUTINE FileWrite
Definition: evtlib.h:207
PEVENT_OFFSET_INFO OffsetInfo
Definition: evtlib.h:214
BOOLEAN ReadOnly
Definition: evtlib.h:217
PELF_FILE_READ_ROUTINE FileRead
Definition: evtlib.h:208
PELF_FREE_ROUTINE Free
Definition: evtlib.h:205
PELF_FILE_SET_SIZE_ROUTINE FileSetSize
Definition: evtlib.h:206
ULONG_PTR * PSIZE_T
Definition: typedefs.h:80
#define OPTIONAL
Definition: typedefs.h:41
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:255
#define NTAPI
Definition: typedefs.h:36
void * PVOID
Definition: typedefs.h:50
ULONG_PTR SIZE_T
Definition: typedefs.h:80
#define IN
Definition: typedefs.h:39
uint32_t ULONG
Definition: typedefs.h:59
#define OUT
Definition: typedefs.h:40
_Must_inspect_result_ _In_ WDFDEVICE _In_ BOOLEAN _In_opt_ PVOID Tag
Definition: wdfdevice.h:4065
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4533
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PLONGLONG _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesRead
Definition: wdfiotarget.h:870
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_In_opt_ PALLOCATE_FUNCTION Allocate
Definition: exfuncs.h:814
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION Free
Definition: exfuncs.h:815
_In_ struct _KBUGCHECK_REASON_CALLBACK_RECORD * Record
Definition: ketypes.h:268