357 lines
9.4 KiB
Plaintext
357 lines
9.4 KiB
Plaintext
/*++
|
|
|
|
Copyright (c) 1990 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
ELF.IDL
|
|
|
|
Abstract:
|
|
|
|
Contains the Elfr APIs which are used to remote the Elf APIs to
|
|
the local or remote server via RPC.
|
|
Also contains the RPC specific data structures for these API.
|
|
|
|
Author:
|
|
|
|
Rajen Shah (rajens) 02-Apr-1991
|
|
|
|
Revision History:
|
|
|
|
02-Apr-1991 RajenS
|
|
created
|
|
|
|
--*/
|
|
|
|
//
|
|
// Interface Attributes
|
|
//
|
|
|
|
[
|
|
uuid(82273FDC-E32A-18C3-3F78-827929DC23EA),
|
|
version(0.0),
|
|
#ifdef __midl
|
|
ms_union,
|
|
#endif // __midl
|
|
pointer_default(unique)
|
|
]
|
|
|
|
//
|
|
// Interface Keyword
|
|
//
|
|
|
|
interface eventlog
|
|
|
|
//
|
|
// Interface Body
|
|
//
|
|
|
|
{
|
|
|
|
import "imports.idl"; // import all the include files
|
|
#include "event.h"
|
|
|
|
//
|
|
// ELF Generic Handle used to bind from client to server.
|
|
//
|
|
|
|
typedef [handle,unique] LPWSTR EVENTLOG_HANDLE_W;
|
|
typedef [handle,unique] LPSTR EVENTLOG_HANDLE_A;
|
|
|
|
//
|
|
// ELF RPC Context Handle (Internal definition of ELF_HANDLE)
|
|
//
|
|
|
|
typedef [context_handle] struct _IELF_HANDLE {
|
|
LIST_ENTRY Next;
|
|
ULONG Signature; // BUGBUG - For debug only
|
|
ULONG Flags; // e.g. "invalid"
|
|
ULONG GrantedAccess;
|
|
ATOM Atom;
|
|
ULONG SeekRecordPos;
|
|
ULONG SeekBytePos;
|
|
ULONG MajorVersion; // To identify caller
|
|
ULONG MinorVersion;
|
|
DWORD dwNotifyRequests;
|
|
ULONG NameLength;
|
|
[size_is(NameLength)] WCHAR Name[]; // Keep this as last field
|
|
} *IELF_HANDLE;
|
|
typedef IELF_HANDLE *PIELF_HANDLE;
|
|
|
|
|
|
//
|
|
// UNICODE Function Prototypes
|
|
//
|
|
//
|
|
// Only OpenEL and CloseEL need to take PIELF_HANDLE
|
|
// parameters since they are the only ones to modify the handle.
|
|
// The others will take IELF_HANDLE parameters instead.
|
|
//
|
|
|
|
// NOTE:
|
|
// The names of the functions are short so that when RPC
|
|
// prepends the interface name to the names, they are still
|
|
// unique.
|
|
//
|
|
|
|
NTSTATUS
|
|
ElfrClearELFW (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in,unique] PRPC_UNICODE_STRING BackupFileName
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrBackupELFW (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] PRPC_UNICODE_STRING BackupFileName
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrCloseEL (
|
|
[in,out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrDeregisterEventSource (
|
|
[in,out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrNumberOfRecords(
|
|
[in] IELF_HANDLE LogHandle,
|
|
[out] PULONG NumberOfRecords
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrOldestRecord(
|
|
[in] IELF_HANDLE LogHandle,
|
|
[out] PULONG OldestRecordNumber
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrChangeNotify(
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] RPC_CLIENT_ID ClientId,
|
|
[in] ULONG Event
|
|
);
|
|
|
|
//
|
|
// The ModuleName is the one passed in by the caller of the API. This is
|
|
// the one that is written to the log file.
|
|
//
|
|
// RegModuleName is generated by the client stub, and is the name that is
|
|
// used to determine the default log file name from the registry. For
|
|
// NT Product1, this will be "Application". NOTE: It is necessary to do this
|
|
// now so that we can support viewing logs from a Product 2 system in the
|
|
// future if we change our logging mechanism.
|
|
//
|
|
|
|
NTSTATUS
|
|
ElfrOpenELW (
|
|
[in] EVENTLOG_HANDLE_W UNCServerName,
|
|
[in] PRPC_UNICODE_STRING ModuleName, // Passed in API call
|
|
[in] PRPC_UNICODE_STRING RegModuleName, // Used for registry
|
|
[in] ULONG MajorVersion,
|
|
[in] ULONG MinorVersion,
|
|
[out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrRegisterEventSourceW (
|
|
[in] EVENTLOG_HANDLE_W UNCServerName,
|
|
[in] PRPC_UNICODE_STRING ModuleName, // Passed in API call
|
|
[in] PRPC_UNICODE_STRING RegModuleName, // Used for registry info
|
|
[in] ULONG MajorVersion,
|
|
[in] ULONG MinorVersion,
|
|
[out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrOpenBELW (
|
|
[in] EVENTLOG_HANDLE_W UNCServerName,
|
|
[in] PRPC_UNICODE_STRING BackupFileName, // Passed in API call
|
|
[in] ULONG MajorVersion,
|
|
[in] ULONG MinorVersion,
|
|
[out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
|
|
//
|
|
// BUGBUG - Fix this interface once RPC supports the ability to return
|
|
// zero bytes. Then, Buffer will have a length_is(*NumberOfBytesRead)
|
|
// added to it. For now, always transfer NumberOfBytesToRead bytes!
|
|
//
|
|
// The LogHandle is an [in,out] since the server side stores information
|
|
// in it that pertains to the current seek position.
|
|
//
|
|
|
|
NTSTATUS
|
|
ElfrReadELW (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] ULONG ReadFlags,
|
|
[in] ULONG RecordOffset,
|
|
[in] ULONG NumberOfBytesToRead,
|
|
[out,size_is(NumberOfBytesToRead)] PBYTE Buffer,
|
|
[out] PULONG NumberOfBytesRead,
|
|
[out] PULONG MinNumberOfBytesNeeded
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrReportEventW (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] ULONG Time,
|
|
[in] USHORT EventType,
|
|
[in] USHORT EventCategory,
|
|
[in] ULONG EventID,
|
|
[in] USHORT NumStrings,
|
|
[in] ULONG DataSize,
|
|
[in] PRPC_UNICODE_STRING ComputerName,
|
|
[in, unique] PRPC_SID UserSID,
|
|
[in, size_is(NumStrings), unique] PRPC_UNICODE_STRING Strings[*],
|
|
[in, size_is(DataSize), unique] PBYTE Data,
|
|
[in] USHORT Flags,
|
|
[in,out,unique] PULONG RecordNumber,
|
|
[in,out,unique] PULONG TimeWritten
|
|
);
|
|
|
|
//
|
|
// ANSI Function Prototypes
|
|
//
|
|
//
|
|
// Only OpenEL needs to take PIELF_HANDLE
|
|
// parameters since they are the only ones to modify the handle.
|
|
// The others will take IELF_HANDLE parameters instead.
|
|
//
|
|
// NOTE that there is only one api for CloseEL since there are no
|
|
// strings involved.
|
|
//
|
|
|
|
NTSTATUS
|
|
ElfrClearELFA (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in,unique] PRPC_STRING BackupFileName
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrBackupELFA (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] PRPC_STRING BackupFileName
|
|
);
|
|
|
|
//
|
|
// The ModuleName is the one passed in by the caller of the API. This is
|
|
// the one that is written to the log file.
|
|
//
|
|
// RegModuleName is generated by the client stub, and is the name that is
|
|
// used to determine the default log file name from the registry. For
|
|
// NT Product1, this will be "Application". NOTE: It is necessary to do this
|
|
// now so that we can support viewing logs from a Product 2 system in the
|
|
// future if we change our logging mechanism.
|
|
//
|
|
|
|
NTSTATUS
|
|
ElfrOpenELA (
|
|
[in] EVENTLOG_HANDLE_A UNCServerName,
|
|
[in] PRPC_STRING ModuleName, // Passed in API call
|
|
[in] PRPC_STRING RegModuleName, // Used for registry info
|
|
[in] ULONG MajorVersion,
|
|
[in] ULONG MinorVersion,
|
|
[out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrRegisterEventSourceA (
|
|
[in] EVENTLOG_HANDLE_A UNCServerName,
|
|
[in] PRPC_STRING ModuleName, // Passed in API call
|
|
[in] PRPC_STRING RegModuleName, // Used for registry info
|
|
[in] ULONG MajorVersion,
|
|
[in] ULONG MinorVersion,
|
|
[out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrOpenBELA (
|
|
[in] EVENTLOG_HANDLE_A UNCServerName,
|
|
[in] PRPC_STRING FileName, // Passed in API call
|
|
[in] ULONG MajorVersion,
|
|
[in] ULONG MinorVersion,
|
|
[out] PIELF_HANDLE LogHandle
|
|
);
|
|
|
|
//
|
|
// BUGBUG - Fix this interface once RPC supports the ability to return
|
|
// zero bytes. Then, Buffer will have a length_is(*NumberOfBytesRead)
|
|
// added to it. For now, always transfer NumberOfBytesToRead bytes!
|
|
//
|
|
// The LogHandle is an [in,out] since the server side stores information
|
|
// in it that pertains to the current seek position.
|
|
//
|
|
|
|
NTSTATUS
|
|
ElfrReadELA (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] ULONG ReadFlags,
|
|
[in] ULONG RecordOffset,
|
|
[in] ULONG NumberOfBytesToRead,
|
|
[out,size_is(NumberOfBytesToRead)] PBYTE Buffer,
|
|
[out] PULONG NumberOfBytesRead,
|
|
[out] PULONG MinNumberOfBytesNeeded
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrReportEventA (
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] ULONG Time,
|
|
[in] USHORT EventType,
|
|
[in] USHORT EventCategory,
|
|
[in] ULONG EventID,
|
|
[in] USHORT NumStrings,
|
|
[in] ULONG DataSize,
|
|
[in] PRPC_STRING ComputerName,
|
|
[in, unique] PRPC_SID UserSID,
|
|
[in, size_is(NumStrings), unique] PRPC_STRING Strings[*],
|
|
[in, size_is(DataSize), unique] PBYTE Data,
|
|
[in] USHORT Flags,
|
|
[in,out,unique] PULONG RecordNumber,
|
|
[in,out,unique] PULONG TimeWritten
|
|
);
|
|
|
|
|
|
NTSTATUS
|
|
ElfrRegisterClusterSvc(
|
|
[in] EVENTLOG_HANDLE_W UNCServerName,
|
|
[out] PULONG pulSize,
|
|
[out, size_is(,*pulSize)] BYTE **ppPackedEventInfo );
|
|
|
|
NTSTATUS
|
|
ElfrDeregisterClusterSvc(
|
|
[in] EVENTLOG_HANDLE_W UNCServerName
|
|
);
|
|
|
|
NTSTATUS
|
|
ElfrWriteClusterEvents(
|
|
[in] EVENTLOG_HANDLE_W UNCServerName,
|
|
[in] ULONG ulSize,
|
|
[in,size_is(ulSize)] BYTE *pBuffer
|
|
);
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
// Functions below this point are not in Windows NT version 4.0 or earlier
|
|
//
|
|
// (Note that new functions must always be added at the end, otherwise
|
|
// function calls are mismatched when client and server talk different
|
|
// versions of the interface)
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
|
|
NTSTATUS
|
|
ElfrGetLogInformation(
|
|
[in] IELF_HANDLE LogHandle,
|
|
[in] ULONG InfoLevel,
|
|
[out, size_is(cbBufSize)] PBYTE lpBuffer,
|
|
[in] ULONG cbBufSize,
|
|
[out] PULONG pcbBytesNeeded
|
|
);
|
|
|
|
}
|