[TFTPD] Fix compilation, and use the #define MAX_SERVERS where needed instead of...
[reactos.git] / base / services / eventlog / eventlog.c
1 /*
2 * PROJECT: ReactOS EventLog Service
3 * LICENSE: GPL - See COPYING in the top level directory
4 * FILE: base/services/eventlog/eventlog.c
5 * PURPOSE: Event logging service
6 * COPYRIGHT: Copyright 2002 Eric Kohl
7 * Copyright 2005 Saveliy Tretiakov
8 * Hermes Belusca-Maito
9 */
10
11 /* INCLUDES *****************************************************************/
12
13 #include "eventlog.h"
14 #include <stdio.h>
15 #include <netevent.h>
16
17 #define NDEBUG
18 #include <debug.h>
19
20 /* GLOBALS ******************************************************************/
21
22 static VOID CALLBACK ServiceMain(DWORD, LPWSTR*);
23 static WCHAR ServiceName[] = L"EventLog";
24 static SERVICE_TABLE_ENTRYW ServiceTable[2] =
25 {
26 { ServiceName, ServiceMain },
27 { NULL, NULL }
28 };
29
30 SERVICE_STATUS ServiceStatus;
31 SERVICE_STATUS_HANDLE ServiceStatusHandle;
32
33 BOOL onLiveCD = FALSE; // On LiveCD events will go to debug output only
34
35 PEVENTSOURCE EventLogSource = NULL;
36
37 /* FUNCTIONS ****************************************************************/
38
39 static VOID
40 UpdateServiceStatus(DWORD dwState)
41 {
42 ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
43 ServiceStatus.dwCurrentState = dwState;
44 ServiceStatus.dwControlsAccepted = 0;
45 ServiceStatus.dwWin32ExitCode = 0;
46 ServiceStatus.dwServiceSpecificExitCode = 0;
47 ServiceStatus.dwCheckPoint = 0;
48
49 if (dwState == SERVICE_START_PENDING ||
50 dwState == SERVICE_STOP_PENDING ||
51 dwState == SERVICE_PAUSE_PENDING ||
52 dwState == SERVICE_CONTINUE_PENDING)
53 ServiceStatus.dwWaitHint = 10000;
54 else
55 ServiceStatus.dwWaitHint = 0;
56
57 SetServiceStatus(ServiceStatusHandle,
58 &ServiceStatus);
59 }
60
61 static DWORD WINAPI
62 ServiceControlHandler(DWORD dwControl,
63 DWORD dwEventType,
64 LPVOID lpEventData,
65 LPVOID lpContext)
66 {
67 DPRINT("ServiceControlHandler() called\n");
68
69 switch (dwControl)
70 {
71 case SERVICE_CONTROL_STOP:
72 DPRINT(" SERVICE_CONTROL_STOP received\n");
73
74 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
75 0,
76 EVENT_EventlogStopped, 0, NULL, 0, NULL);
77
78 /* Stop listening to incoming RPC messages */
79 RpcMgmtStopServerListening(NULL);
80 UpdateServiceStatus(SERVICE_STOPPED);
81 return ERROR_SUCCESS;
82
83 case SERVICE_CONTROL_PAUSE:
84 DPRINT(" SERVICE_CONTROL_PAUSE received\n");
85 UpdateServiceStatus(SERVICE_PAUSED);
86 return ERROR_SUCCESS;
87
88 case SERVICE_CONTROL_CONTINUE:
89 DPRINT(" SERVICE_CONTROL_CONTINUE received\n");
90 UpdateServiceStatus(SERVICE_RUNNING);
91 return ERROR_SUCCESS;
92
93 case SERVICE_CONTROL_INTERROGATE:
94 DPRINT(" SERVICE_CONTROL_INTERROGATE received\n");
95 SetServiceStatus(ServiceStatusHandle,
96 &ServiceStatus);
97 return ERROR_SUCCESS;
98
99 case SERVICE_CONTROL_SHUTDOWN:
100 DPRINT(" SERVICE_CONTROL_SHUTDOWN received\n");
101
102 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
103 0,
104 EVENT_EventlogStopped, 0, NULL, 0, NULL);
105
106 UpdateServiceStatus(SERVICE_STOPPED);
107 return ERROR_SUCCESS;
108
109 default:
110 DPRINT1(" Control %lu received\n", dwControl);
111 return ERROR_CALL_NOT_IMPLEMENTED;
112 }
113 }
114
115
116 static DWORD
117 ServiceInit(VOID)
118 {
119 HANDLE hThread;
120
121 hThread = CreateThread(NULL,
122 0,
123 (LPTHREAD_START_ROUTINE)PortThreadRoutine,
124 NULL,
125 0,
126 NULL);
127 if (!hThread)
128 {
129 DPRINT("Cannot create PortThread\n");
130 return GetLastError();
131 }
132 else
133 CloseHandle(hThread);
134
135 hThread = CreateThread(NULL,
136 0,
137 RpcThreadRoutine,
138 NULL,
139 0,
140 NULL);
141
142 if (!hThread)
143 {
144 DPRINT("Cannot create RpcThread\n");
145 return GetLastError();
146 }
147 else
148 CloseHandle(hThread);
149
150 return ERROR_SUCCESS;
151 }
152
153
154 static VOID
155 ReportProductInfoEvent(VOID)
156 {
157 OSVERSIONINFOW versionInfo;
158 WCHAR szBuffer[512];
159 PWSTR str;
160 size_t cchRemain;
161 HKEY hKey;
162 DWORD dwValueLength;
163 DWORD dwType;
164 LONG lResult = ERROR_SUCCESS;
165
166 ZeroMemory(&versionInfo, sizeof(versionInfo));
167 versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
168
169 /* Get version information */
170 if (!GetVersionExW(&versionInfo))
171 return;
172
173 ZeroMemory(szBuffer, sizeof(szBuffer));
174 str = szBuffer;
175 cchRemain = ARRAYSIZE(szBuffer);
176
177 /* Write the version number into the buffer */
178 StringCchPrintfExW(str, cchRemain,
179 &str, &cchRemain, 0,
180 L"%lu.%lu",
181 versionInfo.dwMajorVersion,
182 versionInfo.dwMinorVersion);
183 str++;
184 cchRemain++;
185
186 /* Write the build number into the buffer */
187 StringCchPrintfExW(str, cchRemain,
188 &str, &cchRemain, 0,
189 L"%lu",
190 versionInfo.dwBuildNumber);
191 str++;
192 cchRemain++;
193
194 /* Write the service pack info into the buffer */
195 StringCchCopyExW(str, cchRemain,
196 versionInfo.szCSDVersion,
197 &str, &cchRemain, 0);
198 str++;
199 cchRemain++;
200
201 /* Read 'CurrentType' from the registry and write it into the buffer */
202 lResult = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
203 L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
204 0,
205 KEY_QUERY_VALUE,
206 &hKey);
207 if (lResult == ERROR_SUCCESS)
208 {
209 dwValueLength = cchRemain;
210 lResult = RegQueryValueExW(hKey,
211 L"CurrentType",
212 NULL,
213 &dwType,
214 (LPBYTE)str,
215 &dwValueLength);
216
217 RegCloseKey(hKey);
218 }
219
220 /* Log the product information */
221 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
222 0,
223 EVENT_EventLogProductInfo,
224 4,
225 szBuffer,
226 0,
227 NULL);
228 }
229
230
231 static VOID CALLBACK
232 ServiceMain(DWORD argc,
233 LPWSTR* argv)
234 {
235 DWORD dwError;
236
237 UNREFERENCED_PARAMETER(argc);
238 UNREFERENCED_PARAMETER(argv);
239
240 DPRINT("ServiceMain() called\n");
241
242 ServiceStatusHandle = RegisterServiceCtrlHandlerExW(ServiceName,
243 ServiceControlHandler,
244 NULL);
245 if (!ServiceStatusHandle)
246 {
247 dwError = GetLastError();
248 DPRINT1("RegisterServiceCtrlHandlerW() failed! (Error %lu)\n", dwError);
249 return;
250 }
251
252 UpdateServiceStatus(SERVICE_START_PENDING);
253
254 dwError = ServiceInit();
255 if (dwError != ERROR_SUCCESS)
256 {
257 DPRINT("Service stopped (dwError: %lu\n", dwError);
258 UpdateServiceStatus(SERVICE_START_PENDING);
259 }
260 else
261 {
262 DPRINT("Service started\n");
263 UpdateServiceStatus(SERVICE_RUNNING);
264
265 ReportProductInfoEvent();
266
267 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
268 0,
269 EVENT_EventlogStarted,
270 0,
271 NULL,
272 0,
273 NULL);
274 }
275
276 DPRINT("ServiceMain() done\n");
277 }
278
279
280 static PLOGFILE
281 LoadLogFile(HKEY hKey, PWSTR LogName)
282 {
283 DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
284 PWSTR Buf = NULL, Expanded = NULL;
285 LONG Result;
286 PLOGFILE pLogf = NULL;
287 UNICODE_STRING FileName;
288 ULONG ulMaxSize, ulRetention;
289 NTSTATUS Status;
290
291 DPRINT("LoadLogFile: `%S'\n", LogName);
292
293 Result = RegQueryInfoKeyW(hKey, NULL, NULL, NULL, NULL, NULL, NULL,
294 NULL, NULL, &MaxValueLen, NULL, NULL);
295 if (Result != ERROR_SUCCESS)
296 {
297 DPRINT1("RegQueryInfoKeyW failed: %lu\n", Result);
298 return NULL;
299 }
300
301 MaxValueLen = ROUND_DOWN(MaxValueLen, sizeof(WCHAR));
302 Buf = HeapAlloc(GetProcessHeap(), 0, MaxValueLen);
303 if (!Buf)
304 {
305 DPRINT1("Cannot allocate heap!\n");
306 return NULL;
307 }
308
309 ValueLen = MaxValueLen;
310 Result = RegQueryValueExW(hKey,
311 L"File",
312 NULL,
313 &Type,
314 (LPBYTE)Buf,
315 &ValueLen);
316 /*
317 * If we failed, because the registry value was inexistent
318 * or the value type was incorrect, create a new "File" value
319 * that holds the default event log path.
320 */
321 if ((Result != ERROR_SUCCESS) || (Type != REG_EXPAND_SZ && Type != REG_SZ))
322 {
323 MaxValueLen = (wcslen(L"%SystemRoot%\\System32\\Config\\") +
324 wcslen(LogName) + wcslen(L".evt") + 1) * sizeof(WCHAR);
325
326 Expanded = HeapReAlloc(GetProcessHeap(), 0, Buf, MaxValueLen);
327 if (!Expanded)
328 {
329 DPRINT1("Cannot reallocate heap!\n");
330 HeapFree(GetProcessHeap(), 0, Buf);
331 return NULL;
332 }
333 Buf = Expanded;
334
335 StringCbCopyW(Buf, MaxValueLen, L"%SystemRoot%\\System32\\Config\\");
336 StringCbCatW(Buf, MaxValueLen, LogName);
337 StringCbCatW(Buf, MaxValueLen, L".evt");
338
339 ValueLen = MaxValueLen;
340 Result = RegSetValueExW(hKey,
341 L"File",
342 0,
343 REG_EXPAND_SZ,
344 (LPBYTE)Buf,
345 ValueLen);
346 if (Result != ERROR_SUCCESS)
347 {
348 DPRINT1("RegSetValueExW failed: %lu\n", Result);
349 HeapFree(GetProcessHeap(), 0, Buf);
350 return NULL;
351 }
352 }
353
354 ExpandedLen = ExpandEnvironmentStringsW(Buf, NULL, 0);
355 Expanded = HeapAlloc(GetProcessHeap(), 0, ExpandedLen * sizeof(WCHAR));
356 if (!Expanded)
357 {
358 DPRINT1("Cannot allocate heap!\n");
359 HeapFree(GetProcessHeap(), 0, Buf);
360 return NULL;
361 }
362
363 ExpandEnvironmentStringsW(Buf, Expanded, ExpandedLen);
364
365 if (!RtlDosPathNameToNtPathName_U(Expanded, &FileName, NULL, NULL))
366 {
367 DPRINT1("Cannot convert path!\n");
368 HeapFree(GetProcessHeap(), 0, Expanded);
369 HeapFree(GetProcessHeap(), 0, Buf);
370 return NULL;
371 }
372
373 DPRINT("%S -> %S\n", Buf, Expanded);
374
375 ValueLen = sizeof(ulMaxSize);
376 Result = RegQueryValueExW(hKey,
377 L"MaxSize",
378 NULL,
379 &Type,
380 (LPBYTE)&ulMaxSize,
381 &ValueLen);
382 if ((Result != ERROR_SUCCESS) || (Type != REG_DWORD))
383 {
384 ulMaxSize = 512 * 1024; /* 512 kBytes */
385
386 Result = RegSetValueExW(hKey,
387 L"MaxSize",
388 0,
389 REG_DWORD,
390 (LPBYTE)&ulMaxSize,
391 sizeof(ulMaxSize));
392 }
393
394 ValueLen = sizeof(ulRetention);
395 Result = RegQueryValueExW(hKey,
396 L"Retention",
397 NULL,
398 &Type,
399 (LPBYTE)&ulRetention,
400 &ValueLen);
401 if ((Result != ERROR_SUCCESS) || (Type != REG_DWORD))
402 {
403 /* On Windows 2003 it is 604800 (secs) == 7 days */
404 ulRetention = 0;
405
406 Result = RegSetValueExW(hKey,
407 L"Retention",
408 0,
409 REG_DWORD,
410 (LPBYTE)&ulRetention,
411 sizeof(ulRetention));
412 }
413
414 // TODO: Add, or use, default values for "AutoBackupLogFiles" (REG_DWORD)
415 // and "CustomSD" (REG_SZ).
416
417 Status = LogfCreate(&pLogf, LogName, &FileName, ulMaxSize, ulRetention, TRUE, FALSE);
418 if (!NT_SUCCESS(Status))
419 {
420 DPRINT1("Failed to create %S! (Status %08lx)\n", Expanded, Status);
421 }
422
423 HeapFree(GetProcessHeap(), 0, Expanded);
424 HeapFree(GetProcessHeap(), 0, Buf);
425 return pLogf;
426 }
427
428 static BOOL
429 LoadLogFiles(HKEY eventlogKey)
430 {
431 LONG Result;
432 DWORD MaxLognameLen, LognameLen;
433 DWORD dwIndex;
434 PWSTR Buf = NULL;
435 PLOGFILE pLogFile;
436
437 Result = RegQueryInfoKeyW(eventlogKey, NULL, NULL, NULL, NULL, &MaxLognameLen,
438 NULL, NULL, NULL, NULL, NULL, NULL);
439 if (Result != ERROR_SUCCESS)
440 {
441 DPRINT1("RegQueryInfoKeyW failed: %lu\n", Result);
442 return FALSE;
443 }
444
445 MaxLognameLen++;
446
447 Buf = HeapAlloc(GetProcessHeap(), 0, MaxLognameLen * sizeof(WCHAR));
448 if (!Buf)
449 {
450 DPRINT1("Error: cannot allocate heap!\n");
451 return FALSE;
452 }
453
454 LognameLen = MaxLognameLen;
455 dwIndex = 0;
456 while (RegEnumKeyExW(eventlogKey,
457 dwIndex,
458 Buf,
459 &LognameLen,
460 NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
461 {
462 HKEY SubKey;
463
464 DPRINT("%S\n", Buf);
465
466 Result = RegOpenKeyExW(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
467 if (Result != ERROR_SUCCESS)
468 {
469 DPRINT1("Failed to open %S key.\n", Buf);
470 HeapFree(GetProcessHeap(), 0, Buf);
471 return FALSE;
472 }
473
474 pLogFile = LoadLogFile(SubKey, Buf);
475 if (pLogFile != NULL)
476 {
477 DPRINT("Loaded %S\n", Buf);
478 LoadEventSources(SubKey, pLogFile);
479 }
480 else
481 {
482 DPRINT1("Failed to load %S\n", Buf);
483 }
484
485 RegCloseKey(SubKey);
486
487 LognameLen = MaxLognameLen;
488 dwIndex++;
489 }
490
491 HeapFree(GetProcessHeap(), 0, Buf);
492 return TRUE;
493 }
494
495
496 int wmain(int argc, WCHAR* argv[])
497 {
498 INT RetCode = 0;
499 LONG Result;
500 HKEY elogKey;
501 WCHAR LogPath[MAX_PATH];
502
503 LogfListInitialize();
504 InitEventSourceList();
505
506 GetSystemWindowsDirectoryW(LogPath, ARRAYSIZE(LogPath));
507
508 if (GetDriveTypeW(LogPath) == DRIVE_CDROM)
509 {
510 DPRINT("LiveCD detected\n");
511 onLiveCD = TRUE;
512 }
513 else
514 {
515 Result = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
516 L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
517 0,
518 KEY_ALL_ACCESS,
519 &elogKey);
520 if (Result != ERROR_SUCCESS)
521 {
522 DPRINT1("Fatal error: cannot open eventlog registry key.\n");
523 RetCode = 1;
524 goto bye_bye;
525 }
526
527 LoadLogFiles(elogKey);
528 }
529
530 EventLogSource = GetEventSourceByName(L"EventLog");
531 if (!EventLogSource)
532 {
533 DPRINT1("The 'EventLog' source is unavailable. The EventLog service will not be able to log its own events.\n");
534 }
535
536 StartServiceCtrlDispatcher(ServiceTable);
537
538 bye_bye:
539 LogfCloseAll();
540
541 return RetCode;
542 }
543
544 VOID PRINT_RECORD(PEVENTLOGRECORD pRec)
545 {
546 UINT i;
547 PWSTR str;
548 LARGE_INTEGER SystemTime;
549 TIME_FIELDS Time;
550
551 DPRINT1("PRINT_RECORD(0x%p)\n", pRec);
552
553 DbgPrint("Length = %lu\n", pRec->Length);
554 DbgPrint("Reserved = 0x%x\n", pRec->Reserved);
555 DbgPrint("RecordNumber = %lu\n", pRec->RecordNumber);
556
557 RtlSecondsSince1970ToTime(pRec->TimeGenerated, &SystemTime);
558 RtlTimeToTimeFields(&SystemTime, &Time);
559 DbgPrint("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n",
560 Time.Day, Time.Month, Time.Year,
561 Time.Hour, Time.Minute, Time.Second);
562
563 RtlSecondsSince1970ToTime(pRec->TimeWritten, &SystemTime);
564 RtlTimeToTimeFields(&SystemTime, &Time);
565 DbgPrint("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n",
566 Time.Day, Time.Month, Time.Year,
567 Time.Hour, Time.Minute, Time.Second);
568
569 DbgPrint("EventID = %lu\n", pRec->EventID);
570
571 switch (pRec->EventType)
572 {
573 case EVENTLOG_ERROR_TYPE:
574 DbgPrint("EventType = EVENTLOG_ERROR_TYPE\n");
575 break;
576 case EVENTLOG_WARNING_TYPE:
577 DbgPrint("EventType = EVENTLOG_WARNING_TYPE\n");
578 break;
579 case EVENTLOG_INFORMATION_TYPE:
580 DbgPrint("EventType = EVENTLOG_INFORMATION_TYPE\n");
581 break;
582 case EVENTLOG_AUDIT_SUCCESS:
583 DbgPrint("EventType = EVENTLOG_AUDIT_SUCCESS\n");
584 break;
585 case EVENTLOG_AUDIT_FAILURE:
586 DbgPrint("EventType = EVENTLOG_AUDIT_FAILURE\n");
587 break;
588 default:
589 DbgPrint("EventType = %hu\n", pRec->EventType);
590 }
591
592 DbgPrint("NumStrings = %hu\n", pRec->NumStrings);
593 DbgPrint("EventCategory = %hu\n", pRec->EventCategory);
594 DbgPrint("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
595 DbgPrint("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber);
596 DbgPrint("StringOffset = %lu\n", pRec->StringOffset);
597 DbgPrint("UserSidLength = %lu\n", pRec->UserSidLength);
598 DbgPrint("UserSidOffset = %lu\n", pRec->UserSidOffset);
599 DbgPrint("DataLength = %lu\n", pRec->DataLength);
600 DbgPrint("DataOffset = %lu\n", pRec->DataOffset);
601
602 i = sizeof(EVENTLOGRECORD);
603 DbgPrint("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + i));
604
605 i += (wcslen((PWSTR)((ULONG_PTR)pRec + i)) + 1) * sizeof(WCHAR);
606 DbgPrint("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + i));
607
608 if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
609 {
610 DbgPrint("Strings:\n");
611 str = (PWSTR)((ULONG_PTR)pRec + pRec->StringOffset);
612 for (i = 0; i < pRec->NumStrings; i++)
613 {
614 DbgPrint("[%u] %S\n", i, str);
615 str += wcslen(str) + 1;
616 }
617 }
618
619 DbgPrint("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4));
620 }