projects / reactos.git / blob
? search:


011c0ec5da642b90bf9e21975662920051d513ce
[reactos.git] / base / applications / mscutils / eventvwr / eventvwr.c
1 /*
2 * ReactOS Win32 Applications
3 * Copyright (C) 2007 ReactOS Team
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
18 */
19 /*
20 * COPYRIGHT : See COPYING in the top level directory
21 * PROJECT : Event Log Viewer
22 * FILE : eventvwr.c
23 * PROGRAMMER: Marc Piulachs (marc.piulachs at codexchange [dot] net)
24 */
25
26 #include "eventvwr.h"
27 #include <windows.h>
28 #include <commctrl.h>
29 #include <stdio.h>
30 #include <time.h>
31
32 #if _MSC_VER
33 #pragma warning(disable: 4996) /* 'strdup' was declared deprecated */
34 #define _CRT_SECURE_NO_DEPRECATE /* all deprecated unsafe string functions */
35 #endif
36
37 static const LPWSTR EVENT_SOURCE_APPLICATION = L"Application";
38 static const LPWSTR EVENT_SOURCE_SECURITY = L"Security";
39 static const LPWSTR EVENT_SOURCE_SYSTEM = L"System";
40 static const WCHAR szWindowClass[] = L"EVENTVWR"; /* the main window class name*/
41
42 //MessageFile message buffer size
43 #define EVENT_MESSAGE_EVENTTEXT_BUFFER 1024*10
44 #define EVENT_MESSAGE_FILE_BUFFER 1024*10
45 #define EVENT_DLL_SEPARATOR L";"
46 #define EVENT_MESSAGE_FILE L"EventMessageFile"
47 #define EVENT_CATEGORY_MESSAGE_FILE L"CategoryMessageFile"
48 #define EVENT_PARAMETER_MESSAGE_FILE L"ParameterMessageFile"
49
50 #define MAX_LOADSTRING 255
51
52 /* Globals */
53 HINSTANCE hInst; /* current instance */
54 WCHAR szTitle[MAX_LOADSTRING]; /* The title bar text */
55 HWND hwndMainWindow; /* Main window */
56 HWND hwndListView; /* ListView control */
57 HWND hwndStatus; /* Status bar */
58 PEVENTLOGRECORD *g_RecordPtrs = NULL;
59 DWORD g_TotalRecords = 0;
60
61 LPWSTR lpSourceLogName = NULL;
62 LPWSTR lpComputerName = NULL;
63
64 /* Forward declarations of functions included in this code module: */
65 ATOM MyRegisterClass(HINSTANCE hInstance);
66 BOOL InitInstance(HINSTANCE, int);
67 LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
68 INT_PTR CALLBACK About(HWND, UINT, WPARAM, LPARAM);
69 INT_PTR CALLBACK EventDetails(HWND, UINT, WPARAM, LPARAM);
70 static INT_PTR CALLBACK StatusMessageWindowProc (HWND, UINT, WPARAM, LPARAM);
71
72
73 int APIENTRY
74 wWinMain(HINSTANCE hInstance,
75 HINSTANCE hPrevInstance,
76 LPWSTR lpCmdLine,
77 int nCmdShow)
78 {
79 MSG msg;
80 HACCEL hAccelTable;
81 INITCOMMONCONTROLSEX iccx;
82
83 UNREFERENCED_PARAMETER(hPrevInstance);
84 UNREFERENCED_PARAMETER(lpCmdLine);
85
86 /* Whenever any of the common controls are used in your app,
87 * you must call InitCommonControlsEx() to register the classes
88 * for those controls. */
89 iccx.dwSize = sizeof(INITCOMMONCONTROLSEX);
90 iccx.dwICC = ICC_LISTVIEW_CLASSES;
91 InitCommonControlsEx(&iccx);
92
93 /* Initialize global strings */
94 LoadStringW(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
95 MyRegisterClass(hInstance);
96
97 /* Perform application initialization: */
98 if (!InitInstance(hInstance, nCmdShow))
99 {
100 return FALSE;
101 }
102
103 hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_EVENTVWR));
104
105 /* Main message loop: */
106 while (GetMessageW(&msg, NULL, 0, 0))
107 {
108 if (!TranslateAcceleratorW(msg.hwnd, hAccelTable, &msg))
109 {
110 TranslateMessage(&msg);
111 DispatchMessage(&msg);
112 }
113 }
114
115 return (int)msg.wParam;
116 }
117
118 static void FreeRecords(void)
119 {
120 DWORD iIndex;
121
122 if (!g_RecordPtrs)
123 return;
124
125 for (iIndex = 0; iIndex < g_TotalRecords; iIndex++)
126 HeapFree(GetProcessHeap(), 0, (PEVENTLOGRECORD) g_RecordPtrs[iIndex]);
127 HeapFree(GetProcessHeap(), 0, (PEVENTLOGRECORD) g_RecordPtrs);
128 g_RecordPtrs = NULL;
129 }
130
131 VOID
132 EventTimeToSystemTime(DWORD EventTime,
133 SYSTEMTIME *pSystemTime)
134 {
135 SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
136 FILETIME ftLocal;
137 union
138 {
139 FILETIME ft;
140 ULONGLONG ll;
141 } u1970, uUCT;
142
143 uUCT.ft.dwHighDateTime = 0;
144 uUCT.ft.dwLowDateTime = EventTime;
145 SystemTimeToFileTime(&st1970, &u1970.ft);
146 uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
147 FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
148 FileTimeToSystemTime(&ftLocal, pSystemTime);
149 }
150
151
152 void
153 TrimNulls(LPWSTR s)
154 {
155 WCHAR *c;
156
157 if (s != NULL)
158 {
159 c = s + wcslen(s) - 1;
160 while (c >= s && iswspace(*c))
161 --c;
162 *++c = L'\0';
163 }
164 }
165
166
167 BOOL
168 GetEventMessageFileDLL(IN LPCWSTR lpLogName,
169 IN LPCWSTR SourceName,
170 IN LPCWSTR EntryName,
171 OUT LPWSTR ExpandedName)
172 {
173 DWORD dwSize;
174 BYTE szModuleName[MAX_PATH];
175 WCHAR szKeyName[MAX_PATH];
176 HKEY hAppKey = NULL;
177 HKEY hSourceKey = NULL;
178 BOOL bReturn = FALSE;
179
180 wcscpy(szKeyName, L"SYSTEM\\CurrentControlSet\\Services\\EventLog\\");
181 wcscat(szKeyName, lpLogName);
182
183 if (RegOpenKeyExW(HKEY_LOCAL_MACHINE,
184 szKeyName,
185 0,
186 KEY_READ,
187 &hAppKey) == ERROR_SUCCESS)
188 {
189 if (RegOpenKeyExW(hAppKey,
190 SourceName,
191 0,
192 KEY_READ,
193 &hSourceKey) == ERROR_SUCCESS)
194 {
195 dwSize = MAX_PATH;
196 if (RegQueryValueExW(hSourceKey,
197 EntryName,
198 NULL,
199 NULL,
200 (LPBYTE)szModuleName,
201 &dwSize) == ERROR_SUCCESS)
202 {
203 /* Returns a string containing the requested substituted environment variable. */
204 ExpandEnvironmentStringsW((LPCWSTR)szModuleName, ExpandedName, MAX_PATH);
205
206 /* Succesfull */
207 bReturn = TRUE;
208 }
209 }
210 }
211 else
212 {
213 MessageBoxW(NULL,
214 L"Registry access failed!",
215 L"Event Log",
216 MB_OK | MB_ICONINFORMATION);
217 }
218
219 if (hSourceKey != NULL)
220 RegCloseKey(hSourceKey);
221
222 if (hAppKey != NULL)
223 RegCloseKey(hAppKey);
224
225 return bReturn;
226 }
227
228
229 BOOL
230 GetEventCategory(IN LPCWSTR KeyName,
231 IN LPCWSTR SourceName,
232 IN EVENTLOGRECORD *pevlr,
233 OUT LPWSTR CategoryName)
234 {
235 HANDLE hLibrary = NULL;
236 WCHAR szMessageDLL[MAX_PATH];
237 LPVOID lpMsgBuf = NULL;
238
239 if (GetEventMessageFileDLL (KeyName, SourceName, EVENT_CATEGORY_MESSAGE_FILE , szMessageDLL))
240 {
241 hLibrary = LoadLibraryExW(szMessageDLL,
242 NULL,
243 DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
244 if (hLibrary != NULL)
245 {
246 /* Retrieve the message string. */
247 if (FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_ARGUMENT_ARRAY,
248 hLibrary,
249 pevlr->EventCategory,
250 MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
251 (LPWSTR)&lpMsgBuf,
252 EVENT_MESSAGE_FILE_BUFFER,
253 NULL) != 0)
254 {
255 if (lpMsgBuf)
256 {
257 /* Trim the string */
258 TrimNulls((LPWSTR)lpMsgBuf);
259
260 /* Copy the category name */
261 wcscpy(CategoryName, (LPCWSTR)lpMsgBuf);
262 }
263 else
264 {
265 wcscpy(CategoryName, (LPCWSTR)lpMsgBuf);
266 }
267 }
268 else
269 {
270 wcscpy(CategoryName, L"None");
271 }
272
273 if (hLibrary != NULL)
274 FreeLibrary(hLibrary);
275
276 /* Free the buffer allocated by FormatMessage */
277 if (lpMsgBuf)
278 LocalFree(lpMsgBuf);
279
280 return TRUE;
281 }
282 }
283
284 wcscpy(CategoryName, L"None");
285
286 return FALSE;
287 }
288
289
290 BOOL
291 GetEventMessage(IN LPCWSTR KeyName,
292 IN LPCWSTR SourceName,
293 IN EVENTLOGRECORD *pevlr,
294 OUT LPWSTR EventText)
295 {
296 DWORD i;
297 HANDLE hLibrary = NULL;
298 WCHAR SourceModuleName[1000];
299 WCHAR ParameterModuleName[1000];
300 LPWSTR lpMsgBuf = NULL;
301 WCHAR szStringIDNotFound[MAX_LOADSTRING];
302 LPWSTR szDll;
303 LPWSTR szMessage;
304 LPWSTR *szArguments;
305 BOOL bDone = FALSE;
306
307 /* TODO : GetEventMessageFileDLL can return a comma separated list of DLLs */
308 if (GetEventMessageFileDLL (KeyName, SourceName, EVENT_MESSAGE_FILE, SourceModuleName))
309 {
310 /* Get the event message */
311 szMessage = (LPWSTR)((LPBYTE)pevlr + pevlr->StringOffset);
312
313 /* Allocate space for parameters */
314 szArguments = (LPWSTR*)malloc(sizeof(LPVOID) * pevlr->NumStrings);
315 if (!szArguments)
316 {
317 return FALSE;
318 }
319
320 for (i = 0; i < pevlr->NumStrings ; i++)
321 {
322 if (wcsstr(szMessage , L"%%"))
323 {
324 if (GetEventMessageFileDLL(KeyName, SourceName, EVENT_PARAMETER_MESSAGE_FILE, ParameterModuleName))
325 {
326 /* Not yet support for reading messages from parameter message DLL */
327 }
328
329 szArguments[i] = szMessage;
330 szMessage += wcslen(szMessage) + 1;
331 }
332 else
333 {
334 szArguments[i] = szMessage;
335 szMessage += wcslen(szMessage) + 1;
336 }
337 }
338
339 szDll = wcstok(SourceModuleName, EVENT_DLL_SEPARATOR);
340 while ((szDll != NULL) && (!bDone))
341 {
342 hLibrary = LoadLibraryExW(szDll,
343 NULL,
344 DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE);
345 if (hLibrary == NULL)
346 {
347 /* The DLL could not be loaded try the next one (if any) */
348 szDll = wcstok(NULL, EVENT_DLL_SEPARATOR);
349 }
350 else
351 {
352 /* Retrieve the message string. */
353 if (FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM |
354 FORMAT_MESSAGE_ALLOCATE_BUFFER |
355 FORMAT_MESSAGE_FROM_HMODULE |
356 FORMAT_MESSAGE_ARGUMENT_ARRAY,
357 hLibrary,
358 pevlr->EventID,
359 MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
360 (LPWSTR)&lpMsgBuf,
361 0,
362 (va_list*)szArguments) == 0)
363 {
364 /* We haven't found the string , get next DLL (if any) */
365 szDll = wcstok(NULL, EVENT_DLL_SEPARATOR);
366 }
367 else
368 {
369 if (lpMsgBuf)
370 {
371 /* The ID was found and the message was formated */
372 bDone = TRUE;
373
374 /* Trim the string */
375 TrimNulls((LPWSTR)lpMsgBuf);
376
377 /* Copy the event text */
378 wcscpy(EventText ,lpMsgBuf);
379 }
380 }
381
382 FreeLibrary(hLibrary);
383 }
384 }
385
386 if (!bDone)
387 {
388 LoadStringW(hInst, IDC_EVENTSTRINGIDNOTFOUND, szStringIDNotFound, MAX_LOADSTRING);
389 swprintf(EventText, szStringIDNotFound, (DWORD)(pevlr->EventID & 0xFFFF), SourceName);
390 }
391
392 free(szArguments);
393
394 /* No more dlls to try, return result */
395 return bDone;
396 }
397
398 LoadStringW(hInst, IDC_EVENTSTRINGIDNOTFOUND, szStringIDNotFound, MAX_LOADSTRING);
399 swprintf(EventText, szStringIDNotFound, (DWORD)(pevlr->EventID & 0xFFFF), SourceName);
400
401 return FALSE;
402 }
403
404
405 VOID
406 GetEventType(IN WORD dwEventType,
407 OUT LPWSTR eventTypeText)
408 {
409 switch (dwEventType)
410 {
411 case EVENTLOG_ERROR_TYPE:
412 LoadStringW(hInst, IDC_EVENTLOG_ERROR_TYPE, eventTypeText, MAX_LOADSTRING);
413 break;
414 case EVENTLOG_WARNING_TYPE:
415 LoadStringW(hInst, IDC_EVENTLOG_WARNING_TYPE, eventTypeText, MAX_LOADSTRING);
416 break;
417 case EVENTLOG_INFORMATION_TYPE:
418 LoadStringW(hInst, IDC_EVENTLOG_INFORMATION_TYPE, eventTypeText, MAX_LOADSTRING);
419 break;
420 case EVENTLOG_AUDIT_SUCCESS:
421 LoadStringW(hInst, IDC_EVENTLOG_AUDIT_SUCCESS, eventTypeText, MAX_LOADSTRING);
422 break;
423 case EVENTLOG_AUDIT_FAILURE:
424 LoadStringW(hInst, IDC_EVENTLOG_AUDIT_FAILURE, eventTypeText, MAX_LOADSTRING);
425 break;
426 case EVENTLOG_SUCCESS:
427 LoadStringW(hInst, IDC_EVENTLOG_SUCCESS, eventTypeText, MAX_LOADSTRING);
428 break;
429 default:
430 LoadStringW(hInst, IDC_EVENTLOG_UNKNOWN_TYPE, eventTypeText, MAX_LOADSTRING);
431 break;
432 }
433 }
434
435 BOOL
436 GetEventUserName(EVENTLOGRECORD *pelr,
437 OUT LPWSTR pszUser)
438 {
439 PSID lpSid;
440 WCHAR szName[1024];
441 WCHAR szDomain[1024];
442 SID_NAME_USE peUse;
443 DWORD cbName = 1024;
444 DWORD cbDomain = 1024;
445
446 /* Point to the SID. */
447 lpSid = (PSID)((LPBYTE)pelr + pelr->UserSidOffset);
448
449 /* User SID */
450 if (pelr->UserSidLength > 0)
451 {
452 if (LookupAccountSidW(NULL,
453 lpSid,
454 szName,
455 &cbName,
456 szDomain,
457 &cbDomain,
458 &peUse))
459 {
460 wcscpy(pszUser, szName);
461 return TRUE;
462 }
463 }
464
465 return FALSE;
466 }
467
468
469 static DWORD WINAPI
470 ShowStatusMessageThread(IN LPVOID lpParameter)
471 {
472 HWND *phWnd = (HWND *)lpParameter;
473 HWND hWnd;
474 MSG Msg;
475
476 hWnd = CreateDialogParam(hInst,
477 MAKEINTRESOURCE(IDD_PROGRESSBOX),
478 GetDesktopWindow(),
479 StatusMessageWindowProc,
480 (LPARAM)NULL);
481 if (!hWnd)
482 return 0;
483
484 *phWnd = hWnd;
485
486 ShowWindow(hWnd, SW_SHOW);
487
488 /* Message loop for the Status window */
489 while (GetMessage(&Msg, NULL, 0, 0))
490 {
491 TranslateMessage(&Msg);
492 DispatchMessage(&Msg);
493 }
494
495 return 0;
496 }
497
498
499 BOOL
500 QueryEventMessages(LPWSTR lpMachineName,
501 LPWSTR lpLogName)
502 {
503 HWND hwndDlg;
504 HANDLE hEventLog;
505 EVENTLOGRECORD *pevlr;
506 DWORD dwRead, dwNeeded, dwThisRecord, dwTotalRecords = 0, dwCurrentRecord = 1, dwRecordsToRead = 0, dwFlags;
507 LPWSTR lpSourceName;
508 LPWSTR lpComputerName;
509 LPWSTR lpData;
510 BOOL bResult = TRUE; /* Read succeeded. */
511
512 WCHAR szWindowTitle[MAX_PATH];
513 WCHAR szStatusText[MAX_PATH];
514 WCHAR szLocalDate[MAX_PATH];
515 WCHAR szLocalTime[MAX_PATH];
516 WCHAR szEventID[MAX_PATH];
517 WCHAR szEventTypeText[MAX_PATH];
518 WCHAR szCategoryID[MAX_PATH];
519 WCHAR szUsername[MAX_PATH];
520 WCHAR szEventText[EVENT_MESSAGE_FILE_BUFFER];
521 WCHAR szCategory[MAX_PATH];
522
523 SYSTEMTIME time;
524 LVITEMW lviEventItem;
525
526 dwFlags = EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ;
527
528 lpSourceLogName = lpLogName;
529 lpComputerName = lpMachineName;
530
531 /* Open the event log. */
532 hEventLog = OpenEventLogW(lpMachineName,
533 lpLogName);
534 if (hEventLog == NULL)
535 {
536 MessageBoxW(NULL,
537 L"Could not open the event log.",
538 L"Event Log",
539 MB_OK | MB_ICONINFORMATION);
540 return FALSE;
541 }
542
543 /* Disable listview redraw */
544 SendMessage(hwndListView, WM_SETREDRAW, FALSE, 0);
545
546 /* Clear the list view */
547 (void)ListView_DeleteAllItems (hwndListView);
548 FreeRecords();
549
550 GetOldestEventLogRecord(hEventLog, &dwThisRecord);
551
552 /* Get the total number of event log records. */
553 GetNumberOfEventLogRecords (hEventLog , &dwTotalRecords);
554 g_TotalRecords = dwTotalRecords;
555
556 g_RecordPtrs = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwTotalRecords * sizeof(PEVENTLOGRECORD));
557
558 /* If we have at least 1000 records show the waiting dialog */
559 if (dwTotalRecords > 1000)
560 {
561 CreateThread(NULL,
562 0,
563 ShowStatusMessageThread,
564 (LPVOID)&hwndDlg,
565 0,
566 NULL);
567 }
568
569 while (dwCurrentRecord < dwTotalRecords)
570 {
571 pevlr = (EVENTLOGRECORD*) HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD) * dwTotalRecords);
572 g_RecordPtrs[dwCurrentRecord] = pevlr;
573
574 bResult = ReadEventLog(hEventLog, // Event log handle
575 dwFlags, // Sequential read
576 0, // Ignored for sequential read
577 pevlr, // Pointer to buffer
578 sizeof(EVENTLOGRECORD), // Size of buffer
579 &dwRead, // Number of bytes read
580 &dwNeeded); // Bytes in the next record
581 if((!bResult) && (GetLastError () == ERROR_INSUFFICIENT_BUFFER))
582 {
583 HeapFree(GetProcessHeap(), 0, pevlr);
584 pevlr = (EVENTLOGRECORD*) HeapAlloc(GetProcessHeap(), 0, dwNeeded);
585 g_RecordPtrs[dwCurrentRecord] = pevlr;
586
587 ReadEventLogW(hEventLog, // event log handle
588 dwFlags, // read flags
589 0, // offset; default is 0
590 pevlr, // pointer to buffer
591 dwNeeded, // size of buffer
592 &dwRead, // number of bytes read
593 &dwNeeded); // bytes in next record
594 }
595
596 while (dwRead > 0)
597 {
598 wcscpy(szUsername , L"N/A");
599 wcscpy(szEventText , L"N/A");
600 wcscpy(szCategory , L"None");
601
602 // Get the event source name.
603 lpSourceName = (LPWSTR)((LPBYTE)pevlr + sizeof(EVENTLOGRECORD));
604
605 // Get the computer name
606 lpComputerName = (LPWSTR)((LPBYTE)pevlr + sizeof(EVENTLOGRECORD) + (wcslen(lpSourceName) + 1) * sizeof(WCHAR));
607
608 // This ist the data section of the current event
609 lpData = (LPWSTR)((LPBYTE)pevlr + pevlr->DataOffset);
610
611 // Compute the event type
612 EventTimeToSystemTime(pevlr->TimeWritten, &time);
613
614 // Get the username that generated the event
615 GetEventUserName(pevlr, szUsername);
616
617 GetDateFormatW(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &time, NULL, szLocalDate, MAX_PATH);
618 GetTimeFormatW(LOCALE_USER_DEFAULT, TIME_NOSECONDS, &time, NULL, szLocalTime, MAX_PATH);
619
620 GetEventType(pevlr->EventType, szEventTypeText);
621 GetEventCategory(lpLogName, lpSourceName, pevlr, szCategory);
622
623 swprintf(szEventID, L"%u", (DWORD)(pevlr->EventID & 0xFFFF));
624 swprintf(szCategoryID, L"%u", (DWORD)(pevlr->EventCategory));
625
626 lviEventItem.mask = LVIF_IMAGE | LVIF_TEXT | LVIF_PARAM;
627 lviEventItem.iItem = 0;
628 lviEventItem.iSubItem = 0;
629 lviEventItem.lParam = (LPARAM)pevlr;
630 lviEventItem.pszText = szEventTypeText;
631
632 switch (pevlr->EventType)
633 {
634 case EVENTLOG_ERROR_TYPE:
635 lviEventItem.iImage = 2;
636 break;
637
638 case EVENTLOG_AUDIT_FAILURE:
639 lviEventItem.iImage = 2;
640 break;
641
642 case EVENTLOG_WARNING_TYPE:
643 lviEventItem.iImage = 1;
644 break;
645
646 case EVENTLOG_INFORMATION_TYPE:
647 lviEventItem.iImage = 0;
648 break;
649
650 case EVENTLOG_AUDIT_SUCCESS:
651 lviEventItem.iImage = 0;
652 break;
653
654 case EVENTLOG_SUCCESS:
655 lviEventItem.iImage = 0;
656 break;
657 }
658
659 lviEventItem.iItem = ListView_InsertItem(hwndListView, &lviEventItem);
660
661 ListView_SetItemText(hwndListView, lviEventItem.iItem, 1, szLocalDate);
662 ListView_SetItemText(hwndListView, lviEventItem.iItem, 2, szLocalTime);
663 ListView_SetItemText(hwndListView, lviEventItem.iItem, 3, lpSourceName);
664 ListView_SetItemText(hwndListView, lviEventItem.iItem, 4, szCategory);
665 ListView_SetItemText(hwndListView, lviEventItem.iItem, 5, szEventID);
666 ListView_SetItemText(hwndListView, lviEventItem.iItem, 6, szUsername); //User
667 ListView_SetItemText(hwndListView, lviEventItem.iItem, 7, lpComputerName); //Computer
668 ListView_SetItemText(hwndListView, lviEventItem.iItem, 8, lpData); //Event Text
669
670 dwRead -= pevlr->Length;
671 pevlr = (EVENTLOGRECORD *)((LPBYTE) pevlr + pevlr->Length);
672 }
673
674 dwRecordsToRead--;
675 dwCurrentRecord++;
676 }
677
678 // All events loaded
679 EndDialog(hwndDlg, 0);
680
681 swprintf(szWindowTitle, L"%s - %s Log on \\\\%s", szTitle, lpLogName, lpComputerName);
682 swprintf(szStatusText, L"%s has %d event(s)", lpLogName, dwTotalRecords);
683
684 // Update the status bar
685 SendMessageW(hwndStatus, SB_SETTEXT, (WPARAM)0, (LPARAM)szStatusText);
686
687 // Set the window title
688 SetWindowTextW(hwndMainWindow, szWindowTitle);
689
690 // Resume list view redraw
691 SendMessageW(hwndListView, WM_SETREDRAW, TRUE, 0);
692
693 // Close the event log.
694 CloseEventLog(hEventLog);
695
696 return TRUE;
697 }
698
699
700 VOID
701 Refresh(VOID)
702 {
703 QueryEventMessages(lpComputerName,
704 lpSourceLogName);
705 }
706
707
708 //
709 // FUNCTION: MyRegisterClass()
710 //
711 // PURPOSE: Registers the window class.
712 //
713 // COMMENTS:
714 //
715 // This function and its usage are only necessary if you want this code
716 // to be compatible with Win32 systems prior to the 'RegisterClassEx'
717 // function that was added to Windows 95. It is important to call this function
718 // so that the application will get 'well formed' small icons associated
719 // with it.
720 //
721 ATOM
722 MyRegisterClass(HINSTANCE hInstance)
723 {
724 WNDCLASSEXW wcex;
725
726 wcex.cbSize = sizeof(WNDCLASSEX);
727
728 wcex.style = CS_HREDRAW | CS_VREDRAW;
729 wcex.lpfnWndProc = WndProc;
730 wcex.cbClsExtra = 0;
731 wcex.cbWndExtra = 0;
732 wcex.hInstance = hInstance;
733 wcex.hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_EVENTVWR));
734 wcex.hCursor = LoadCursor(NULL, IDC_ARROW);
735 wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
736 wcex.lpszMenuName = MAKEINTRESOURCE(IDC_EVENTVWR);
737 wcex.lpszClassName = szWindowClass;
738 wcex.hIconSm = LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL));
739
740 return RegisterClassExW(&wcex);
741 }
742
743
744 //
745 // FUNCTION: InitInstance(HINSTANCE, int)
746 //
747 // PURPOSE: Saves instance handle and creates main window
748 //
749 // COMMENTS:
750 //
751 // In this function, we save the instance handle in a global variable and
752 // create and display the main program window.
753 //
754 BOOL
755 InitInstance(HINSTANCE hInstance,
756 int nCmdShow)
757 {
758 HIMAGELIST hSmall;
759 LVCOLUMNW lvc = {0};
760
761 hInst = hInstance; // Store instance handle in our global variable
762
763 hwndMainWindow = CreateWindowW(szWindowClass,
764 szTitle,
765 WS_OVERLAPPEDWINDOW,
766 CW_USEDEFAULT, 0, CW_USEDEFAULT, 0,
767 NULL,
768 NULL,
769 hInstance,
770 NULL);
771 if (!hwndMainWindow)
772 {
773 return FALSE;
774 }
775
776 hwndStatus = CreateWindowExW(0, // no extended styles
777 STATUSCLASSNAMEW, // status bar
778 L"Done.", // no text
779 WS_CHILD | WS_BORDER | WS_VISIBLE, // styles
780 0, 0, 0, 0, // x, y, cx, cy
781 hwndMainWindow, // parent window
782 (HMENU)100, // window ID
783 hInstance, // instance
784 NULL); // window data
785
786 // Create our listview child window. Note that I use WS_EX_CLIENTEDGE
787 // and WS_BORDER to create the normal "sunken" look. Also note that
788 // LVS_EX_ styles cannot be set in CreateWindowEx().
789 hwndListView = CreateWindowExW(WS_EX_CLIENTEDGE,
790 WC_LISTVIEWW,
791 L"",
792 LVS_SHOWSELALWAYS | WS_CHILD | WS_VISIBLE | LVS_REPORT,
793 0,
794 0,
795 243,
796 200,
797 hwndMainWindow,
798 NULL,
799 hInstance,
800 NULL);
801
802 // After the ListView is created, we can add extended list view styles.
803 (void)ListView_SetExtendedListViewStyle (hwndListView, LVS_EX_FULLROWSELECT);
804
805 // Create the ImageList
806 hSmall = ImageList_Create(GetSystemMetrics(SM_CXSMICON),
807 GetSystemMetrics(SM_CYSMICON),
808 ILC_MASK,
809 1,
810 1);
811
812 // Add event type icons to ImageList
813 ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_INFORMATIONICON)));
814 ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_WARNINGICON)));
815 ImageList_AddIcon (hSmall, LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ERRORICON)));
816
817 // Assign ImageList to List View
818 (void)ListView_SetImageList (hwndListView, hSmall, LVSIL_SMALL);
819
820 // Now set up the listview with its columns.
821 lvc.mask = LVCF_TEXT | LVCF_WIDTH;
822 lvc.cx = 90;
823 lvc.pszText = L"Type";
824 (void)ListView_InsertColumn(hwndListView, 0, &lvc);
825
826 lvc.cx = 70;
827 lvc.pszText = L"Date";
828 (void)ListView_InsertColumn(hwndListView, 1, &lvc);
829
830 lvc.cx = 70;
831 lvc.pszText = L"Time";
832 (void)ListView_InsertColumn(hwndListView, 2, &lvc);
833
834 lvc.cx = 150;
835 lvc.pszText = L"Source";
836 (void)ListView_InsertColumn(hwndListView, 3, &lvc);
837
838 lvc.cx = 100;
839 lvc.pszText = L"Category";
840 (void)ListView_InsertColumn(hwndListView, 4, &lvc);
841
842 lvc.cx = 60;
843 lvc.pszText = L"Event";
844 (void)ListView_InsertColumn(hwndListView, 5, &lvc);
845
846 lvc.cx = 120;
847 lvc.pszText = L"User";
848 (void)ListView_InsertColumn(hwndListView, 6, &lvc);
849
850 lvc.cx = 100;
851 lvc.pszText = L"Computer";
852 (void)ListView_InsertColumn(hwndListView, 7, &lvc);
853
854 lvc.cx = 0;
855 lvc.pszText = L"Event Data";
856 (void)ListView_InsertColumn(hwndListView, 8, &lvc);
857
858 ShowWindow(hwndMainWindow, nCmdShow);
859 UpdateWindow(hwndMainWindow);
860
861 QueryEventMessages(lpComputerName, // Use the local computer.
862 EVENT_SOURCE_APPLICATION); // The event log category
863
864 return TRUE;
865 }
866
867
868 //
869 // FUNCTION: WndProc(HWND, UINT, WPARAM, LPARAM)
870 //
871 // PURPOSE: Processes messages for the main window.
872 //
873 // WM_COMMAND - process the application menu
874 // WM_PAINT - Paint the main window
875 // WM_DESTROY - post a quit message and return
876 //
877 //
878 LRESULT CALLBACK
879 WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
880 {
881 RECT rect;
882 NMHDR *hdr;
883
884 switch (message)
885 {
886 case WM_CREATE:
887 CheckMenuRadioItem(GetMenu(hWnd),
888 ID_LOG_APPLICATION,
889 ID_LOG_SYSTEM,
890 ID_LOG_APPLICATION,
891 MF_BYCOMMAND);
892 break;
893
894 case WM_NOTIFY:
895 switch (((LPNMHDR)lParam)->code)
896 {
897 case NM_DBLCLK :
898 hdr = (NMHDR FAR*)lParam;
899 if (hdr->hwndFrom == hwndListView)
900 {
901 LPNMITEMACTIVATE lpnmitem = (LPNMITEMACTIVATE)lParam;
902
903 if (lpnmitem->iItem != -1)
904 {
905 DialogBox(hInst,
906 MAKEINTRESOURCE(IDD_EVENTDETAILDIALOG),
907 hWnd,
908 EventDetails);
909 }
910 }
911 break;
912 }
913 break;
914
915 case WM_COMMAND:
916 // Parse the menu selections:
917 switch (LOWORD(wParam))
918 {
919 case ID_LOG_APPLICATION:
920 if (QueryEventMessages(lpComputerName, // Use the local computer.
921 EVENT_SOURCE_APPLICATION)) // The event log category
922 {
923 CheckMenuRadioItem(GetMenu(hWnd),
924 ID_LOG_APPLICATION,
925 ID_LOG_SYSTEM,
926 ID_LOG_APPLICATION,
927 MF_BYCOMMAND);
928 }
929 break;
930
931 case ID_LOG_SECURITY:
932 if (QueryEventMessages(lpComputerName, // Use the local computer.
933 EVENT_SOURCE_SECURITY)) // The event log category
934 {
935 CheckMenuRadioItem(GetMenu(hWnd),
936 ID_LOG_APPLICATION,
937 ID_LOG_SYSTEM,
938 ID_LOG_SECURITY,
939 MF_BYCOMMAND);
940 }
941 break;
942
943 case ID_LOG_SYSTEM:
944 if (QueryEventMessages(lpComputerName, // Use the local computer.
945 EVENT_SOURCE_SYSTEM)) // The event log category
946 {
947 CheckMenuRadioItem(GetMenu(hWnd),
948 ID_LOG_APPLICATION,
949 ID_LOG_SYSTEM,
950 ID_LOG_SYSTEM,
951 MF_BYCOMMAND);
952 }
953 break;
954
955 case IDM_REFRESH:
956 Refresh();
957 break;
958
959 case IDM_ABOUT:
960 DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About);
961 break;
962
963 case IDM_HELP:
964 MessageBoxW(NULL,
965 L"Help not implemented yet!",
966 L"Event Log",
967 MB_OK | MB_ICONINFORMATION);
968 break;
969
970 case IDM_EXIT:
971 DestroyWindow(hWnd);
972 break;
973
974 default:
975 return DefWindowProc(hWnd, message, wParam, lParam);
976 }
977 break;
978
979 case WM_SIZE:
980 {
981 // Gets the window rectangle
982 GetClientRect(hWnd, &rect);
983
984 // Relocate the listview
985 MoveWindow(hwndListView,
986 0,
987 0,
988 rect.right,
989 rect.bottom - 20,
990 1);
991
992 // Resize the statusbar;
993 SendMessage(hwndStatus, message, wParam, lParam);
994 }
995 break;
996 case WM_DESTROY:
997 FreeRecords();
998 PostQuitMessage(0);
999 break;
1000
1001 default:
1002 return DefWindowProc(hWnd, message, wParam, lParam);
1003 }
1004
1005 return 0;
1006 }
1007
1008
1009 // Message handler for about box.
1010 INT_PTR CALLBACK
1011 About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
1012 {
1013 UNREFERENCED_PARAMETER(lParam);
1014 switch (message)
1015 {
1016 case WM_INITDIALOG:
1017 {
1018 return (INT_PTR)TRUE;
1019 }
1020
1021 case WM_COMMAND:
1022 if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)
1023 {
1024 EndDialog(hDlg, LOWORD(wParam));
1025 return (INT_PTR)TRUE;
1026 }
1027 break;
1028 }
1029
1030 return (INT_PTR)FALSE;
1031 }
1032
1033 VOID
1034 DisplayEvent(HWND hDlg)
1035 {
1036 WCHAR szEventType[MAX_PATH];
1037 WCHAR szTime[MAX_PATH];
1038 WCHAR szDate[MAX_PATH];
1039 WCHAR szUser[MAX_PATH];
1040 WCHAR szComputer[MAX_PATH];
1041 WCHAR szSource[MAX_PATH];
1042 WCHAR szCategory[MAX_PATH];
1043 WCHAR szEventID[MAX_PATH];
1044 WCHAR szEventText[EVENT_MESSAGE_EVENTTEXT_BUFFER];
1045 WCHAR szEventData[MAX_PATH];
1046 BOOL bEventData = FALSE;
1047 LVITEMW li;
1048 EVENTLOGRECORD* pevlr;
1049 int iIndex;
1050
1051 // Get index of selected item
1052 iIndex = (int)SendMessage (hwndListView, LVM_GETNEXTITEM, -1, LVNI_SELECTED | LVNI_FOCUSED);
1053
1054 li.mask = LVIF_PARAM;
1055 li.iItem = iIndex;
1056 li.iSubItem = 0;
1057
1058 (void)ListView_GetItem(hwndListView, &li);
1059
1060 pevlr = (EVENTLOGRECORD*)li.lParam;
1061
1062 if (iIndex != -1)
1063 {
1064 ListView_GetItemText(hwndListView, iIndex, 0, szEventType, sizeof(szEventType) * sizeof(WCHAR));
1065 ListView_GetItemText(hwndListView, iIndex, 1, szDate, sizeof(szDate) * sizeof(WCHAR));
1066 ListView_GetItemText(hwndListView, iIndex, 2, szTime, sizeof(szTime) * sizeof(WCHAR));
1067 ListView_GetItemText(hwndListView, iIndex, 3, szSource, sizeof(szSource) * sizeof(WCHAR));
1068 ListView_GetItemText(hwndListView, iIndex, 4, szCategory, sizeof(szCategory) * sizeof(WCHAR));
1069 ListView_GetItemText(hwndListView, iIndex, 5, szEventID, sizeof(szEventID) * sizeof(WCHAR));
1070 ListView_GetItemText(hwndListView, iIndex, 6, szUser, sizeof(szUser) * sizeof(WCHAR));
1071 ListView_GetItemText(hwndListView, iIndex, 7, szComputer, sizeof(szComputer) * sizeof(WCHAR));
1072
1073 bEventData = !(pevlr->DataLength == 0);
1074
1075 if (pevlr->DataLength > 0)
1076 {
1077 MultiByteToWideChar(CP_ACP,
1078 0,
1079 (LPCSTR)((LPBYTE)pevlr + pevlr->DataOffset),
1080 pevlr->DataLength,
1081 szEventData,
1082 MAX_PATH);
1083 }
1084
1085 GetEventMessage(lpSourceLogName, szSource, pevlr, szEventText);
1086
1087 EnableWindow(GetDlgItem(hDlg, IDC_BYTESRADIO), bEventData);
1088 EnableWindow(GetDlgItem(hDlg, IDC_WORDRADIO), bEventData);
1089
1090 SetDlgItemTextW(hDlg, IDC_EVENTDATESTATIC, szDate);
1091 SetDlgItemTextW(hDlg, IDC_EVENTTIMESTATIC, szTime);
1092 SetDlgItemTextW(hDlg, IDC_EVENTUSERSTATIC, szUser);
1093 SetDlgItemTextW(hDlg, IDC_EVENTSOURCESTATIC, szSource);
1094 SetDlgItemTextW(hDlg, IDC_EVENTCOMPUTERSTATIC, szComputer);
1095 SetDlgItemTextW(hDlg, IDC_EVENTCATEGORYSTATIC, szCategory);
1096 SetDlgItemTextW(hDlg, IDC_EVENTIDSTATIC, szEventID);
1097 SetDlgItemTextW(hDlg, IDC_EVENTTYPESTATIC, szEventType);
1098 SetDlgItemTextW(hDlg, IDC_EVENTTEXTEDIT, szEventText);
1099 SetDlgItemTextW(hDlg, IDC_EVENTDATAEDIT, szEventData);
1100 }
1101 else
1102 {
1103 MessageBoxW(NULL,
1104 L"No Items in ListView",
1105 L"Error",
1106 MB_OK | MB_ICONINFORMATION);
1107 }
1108 }
1109
1110
1111 static
1112 INT_PTR CALLBACK
1113 StatusMessageWindowProc(IN HWND hwndDlg,
1114 IN UINT uMsg,
1115 IN WPARAM wParam,
1116 IN LPARAM lParam)
1117 {
1118 UNREFERENCED_PARAMETER(wParam);
1119
1120 switch (uMsg)
1121 {
1122 case WM_INITDIALOG:
1123 {
1124 return TRUE;
1125 }
1126 }
1127 return FALSE;
1128 }
1129
1130
1131 // Message handler for event details box.
1132 INT_PTR CALLBACK
1133 EventDetails(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
1134 {
1135 UNREFERENCED_PARAMETER(lParam);
1136
1137 switch (message)
1138 {
1139 case WM_INITDIALOG:
1140 // Show event info on dialog box
1141 DisplayEvent(hDlg);
1142 return (INT_PTR)TRUE;
1143
1144 case WM_COMMAND:
1145 switch (LOWORD(wParam))
1146 {
1147 case IDOK:
1148 case IDCANCEL:
1149 EndDialog(hDlg, LOWORD(wParam));
1150 return (INT_PTR)TRUE;
1151
1152 case IDPREVIOUS:
1153 SendMessage(hwndListView, WM_KEYDOWN, VK_UP, 0);
1154
1155 // Show event info on dialog box
1156 DisplayEvent(hDlg);
1157 return (INT_PTR)TRUE;
1158
1159 case IDNEXT:
1160 SendMessage(hwndListView, WM_KEYDOWN, VK_DOWN, 0);
1161
1162 // Show event info on dialog box
1163 DisplayEvent(hDlg);
1164 return (INT_PTR)TRUE;
1165
1166 case IDC_BYTESRADIO:
1167 return (INT_PTR)TRUE;
1168
1169 case IDC_WORDRADIO:
1170 return (INT_PTR)TRUE;
1171
1172 case IDHELP:
1173 MessageBoxW(NULL,
1174 L"Help not implemented yet!",
1175 L"Event Log",
1176 MB_OK | MB_ICONINFORMATION);
1177 return (INT_PTR)TRUE;
1178
1179 default:
1180 break;
1181 }
1182 break;
1183 }
1184
1185 return (INT_PTR)FALSE;
1186 }
A free Windows-compatible Operating System