base/services/eventlog/eventlog.c

   1 /*
   2  * PROJECT:          ReactOS kernel
   3  * LICENSE:          GPL - See COPYING in the top level directory
   4  * FILE:             services/eventlog/eventlog.c
   5  * PURPOSE:          Event logging service
   6  * COPYRIGHT:        Copyright 2002 Eric Kohl
   7  *                   Copyright 2005 Saveliy Tretiakov
   8  */
   9
  10 /* INCLUDES *****************************************************************/
  11
  12 #include "eventlog.h"
  13
  14 #include <stdio.h>
  15 #include <netevent.h>
  16
  17 #define NDEBUG
  18 #include <debug.h>
  19
  20 /* GLOBALS ******************************************************************/
  21
  22 static VOID CALLBACK ServiceMain(DWORD, LPWSTR *);
  23 static WCHAR ServiceName[] = L"EventLog";
  24 static SERVICE_TABLE_ENTRYW ServiceTable[2] =
  25 {
  26     { ServiceName, ServiceMain },
  27     { NULL, NULL }
  28 };
  29
  30 SERVICE_STATUS ServiceStatus;
  31 SERVICE_STATUS_HANDLE ServiceStatusHandle;
  32
  33 BOOL onLiveCD = FALSE;  // On livecd events will go to debug output only
  34 HANDLE MyHeap = NULL;
  35
  36 /* FUNCTIONS ****************************************************************/
  37
  38 static VOID
  39 UpdateServiceStatus(DWORD dwState)
  40 {
  41     ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
  42     ServiceStatus.dwCurrentState = dwState;
  43     ServiceStatus.dwControlsAccepted = 0;
  44     ServiceStatus.dwWin32ExitCode = 0;
  45     ServiceStatus.dwServiceSpecificExitCode = 0;
  46     ServiceStatus.dwCheckPoint = 0;
  47
  48     if (dwState == SERVICE_START_PENDING ||
  49         dwState == SERVICE_STOP_PENDING ||
  50         dwState == SERVICE_PAUSE_PENDING ||
  51         dwState == SERVICE_CONTINUE_PENDING)
  52         ServiceStatus.dwWaitHint = 10000;
  53     else
  54         ServiceStatus.dwWaitHint = 0;
  55
  56     SetServiceStatus(ServiceStatusHandle,
  57                      &ServiceStatus);
  58 }
  59
  60 static DWORD WINAPI
  61 ServiceControlHandler(DWORD dwControl,
  62                       DWORD dwEventType,
  63                       LPVOID lpEventData,
  64                       LPVOID lpContext)
  65 {
  66     DPRINT("ServiceControlHandler() called\n");
  67
  68     switch (dwControl)
  69     {
  70         case SERVICE_CONTROL_STOP:
  71             DPRINT("  SERVICE_CONTROL_STOP received\n");
  72
  73             LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
  74                             0,
  75                             EVENT_EventlogStopped, 0, NULL, 0, NULL);
  76
  77
  78             /* Stop listening to incoming RPC messages */
  79             RpcMgmtStopServerListening(NULL);
  80             UpdateServiceStatus(SERVICE_STOPPED);
  81             return ERROR_SUCCESS;
  82
  83         case SERVICE_CONTROL_PAUSE:
  84             DPRINT("  SERVICE_CONTROL_PAUSE received\n");
  85             UpdateServiceStatus(SERVICE_PAUSED);
  86             return ERROR_SUCCESS;
  87
  88         case SERVICE_CONTROL_CONTINUE:
  89             DPRINT("  SERVICE_CONTROL_CONTINUE received\n");
  90             UpdateServiceStatus(SERVICE_RUNNING);
  91             return ERROR_SUCCESS;
  92
  93         case SERVICE_CONTROL_INTERROGATE:
  94             DPRINT("  SERVICE_CONTROL_INTERROGATE received\n");
  95             SetServiceStatus(ServiceStatusHandle,
  96                              &ServiceStatus);
  97             return ERROR_SUCCESS;
  98
  99         case SERVICE_CONTROL_SHUTDOWN:
 100             DPRINT("  SERVICE_CONTROL_SHUTDOWN received\n");
 101
 102             LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
 103                             0,
 104                             EVENT_EventlogStopped, 0, NULL, 0, NULL);
 105
 106             UpdateServiceStatus(SERVICE_STOPPED);
 107             return ERROR_SUCCESS;
 108
 109         default :
 110             DPRINT1("  Control %lu received\n", dwControl);
 111             return ERROR_CALL_NOT_IMPLEMENTED;
 112     }
 113 }
 114
 115
 116 static DWORD
 117 ServiceInit(VOID)
 118 {
 119     HANDLE hThread;
 120
 121     hThread = CreateThread(NULL,
 122                            0,
 123                            (LPTHREAD_START_ROUTINE)
 124                             PortThreadRoutine,
 125                            NULL,
 126                            0,
 127                            NULL);
 128
 129     if (!hThread)
 130     {
 131         DPRINT("Can't create PortThread\n");
 132         return GetLastError();
 133     }
 134     else
 135         CloseHandle(hThread);
 136
 137     hThread = CreateThread(NULL,
 138                            0,
 139                            (LPTHREAD_START_ROUTINE)
 140                             RpcThreadRoutine,
 141                            NULL,
 142                            0,
 143                            NULL);
 144
 145     if (!hThread)
 146     {
 147         DPRINT("Can't create RpcThread\n");
 148         return GetLastError();
 149     }
 150     else
 151         CloseHandle(hThread);
 152
 153     return ERROR_SUCCESS;
 154 }
 155
 156
 157 static VOID
 158 ReportProductInfoEvent(VOID)
 159 {
 160     OSVERSIONINFOW versionInfo;
 161     WCHAR szBuffer[512];
 162     DWORD dwLength;
 163     HKEY hKey;
 164     DWORD dwValueLength;
 165     DWORD dwType;
 166     LONG lResult = ERROR_SUCCESS;
 167
 168     ZeroMemory(&versionInfo, sizeof(OSVERSIONINFO));
 169     versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
 170
 171     /* Get version information */
 172     if (!GetVersionExW(&versionInfo))
 173         return;
 174
 175     ZeroMemory(szBuffer, 512 * sizeof(WCHAR));
 176
 177     /* Write version into the buffer */
 178     dwLength = swprintf(szBuffer,
 179                         L"%lu.%lu",
 180                         versionInfo.dwMajorVersion,
 181                         versionInfo.dwMinorVersion) + 1;
 182
 183     /* Write build number into the buffer */
 184     dwLength += swprintf(&szBuffer[dwLength],
 185                          L"%lu",
 186                          versionInfo.dwBuildNumber) + 1;
 187
 188     /* Write service pack info into the buffer */
 189     wcscpy(&szBuffer[dwLength], versionInfo.szCSDVersion);
 190     dwLength += wcslen(versionInfo.szCSDVersion) + 1;
 191
 192     /* Read 'CurrentType' from the registry and write it into the buffer */
 193     lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
 194                            L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
 195                            0,
 196                            KEY_QUERY_VALUE,
 197                            &hKey);
 198     if (lResult == ERROR_SUCCESS)
 199     {
 200         dwValueLength = 512 - dwLength;
 201         lResult = RegQueryValueEx(hKey,
 202                                   L"CurrentType",
 203                                   NULL,
 204                                   &dwType,
 205                                   (LPBYTE)&szBuffer[dwLength],
 206                                   &dwValueLength);
 207
 208         RegCloseKey(hKey);
 209     }
 210
 211     /* Log the product information */
 212     LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
 213                     0,
 214                     EVENT_EventLogProductInfo,
 215                     4,
 216                     szBuffer,
 217                     0,
 218                     NULL);
 219 }
 220
 221
 222 static VOID CALLBACK
 223 ServiceMain(DWORD argc,
 224             LPWSTR *argv)
 225 {
 226     DWORD dwError;
 227
 228     UNREFERENCED_PARAMETER(argc);
 229     UNREFERENCED_PARAMETER(argv);
 230
 231     DPRINT("ServiceMain() called\n");
 232
 233     ServiceStatusHandle = RegisterServiceCtrlHandlerExW(ServiceName,
 234                                                         ServiceControlHandler,
 235                                                         NULL);
 236     if (!ServiceStatusHandle)
 237     {
 238         dwError = GetLastError();
 239         DPRINT1("RegisterServiceCtrlHandlerW() failed! (Error %lu)\n", dwError);
 240         return;
 241     }
 242
 243     UpdateServiceStatus(SERVICE_START_PENDING);
 244
 245     dwError = ServiceInit();
 246     if (dwError != ERROR_SUCCESS)
 247     {
 248         DPRINT("Service stopped (dwError: %lu\n", dwError);
 249         UpdateServiceStatus(SERVICE_START_PENDING);
 250     }
 251     else
 252     {
 253         DPRINT("Service started\n");
 254         UpdateServiceStatus(SERVICE_RUNNING);
 255
 256         ReportProductInfoEvent();
 257
 258         LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
 259                         0,
 260                         EVENT_EventlogStarted,
 261                         0,
 262                         NULL,
 263                         0,
 264                         NULL);
 265     }
 266
 267     DPRINT("ServiceMain() done\n");
 268 }
 269
 270
 271 PLOGFILE LoadLogFile(HKEY hKey, WCHAR * LogName)
 272 {
 273     DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
 274     WCHAR *Buf = NULL, *Expanded = NULL;
 275     LONG Result;
 276     PLOGFILE pLogf = NULL;
 277     UNICODE_STRING FileName;
 278     NTSTATUS Status;
 279
 280     DPRINT("LoadLogFile: %S\n", LogName);
 281
 282     RegQueryInfoKey(hKey, NULL, NULL, NULL, NULL, NULL, NULL,
 283                     NULL, NULL, &MaxValueLen, NULL, NULL);
 284
 285     Buf = HeapAlloc(MyHeap, 0, MaxValueLen);
 286     if (!Buf)
 287     {
 288         DPRINT1("Can't allocate heap!\n");
 289         return NULL;
 290     }
 291
 292     ValueLen = MaxValueLen;
 293
 294     Result = RegQueryValueEx(hKey,
 295                              L"File",
 296                              NULL,
 297                              &Type,
 298                              (LPBYTE) Buf,
 299                              &ValueLen);
 300     if (Result != ERROR_SUCCESS)
 301     {
 302         DPRINT1("RegQueryValueEx failed: %lu\n", GetLastError());
 303         HeapFree(MyHeap, 0, Buf);
 304         return NULL;
 305     }
 306
 307     if (Type != REG_EXPAND_SZ && Type != REG_SZ)
 308     {
 309         DPRINT1("%S\\File - value of wrong type %x.\n", LogName, Type);
 310         HeapFree(MyHeap, 0, Buf);
 311         return NULL;
 312     }
 313
 314     ExpandedLen = ExpandEnvironmentStrings(Buf, NULL, 0);
 315     Expanded = HeapAlloc(MyHeap, 0, ExpandedLen * sizeof(WCHAR));
 316     if (!Expanded)
 317     {
 318         DPRINT1("Can't allocate heap!\n");
 319         HeapFree(MyHeap, 0, Buf);
 320         return NULL;
 321     }
 322
 323     ExpandEnvironmentStrings(Buf, Expanded, ExpandedLen);
 324
 325     if (!RtlDosPathNameToNtPathName_U(Expanded, &FileName,
 326                                       NULL, NULL))
 327     {
 328         DPRINT1("Can't convert path!\n");
 329         HeapFree(MyHeap, 0, Expanded);
 330         HeapFree(MyHeap, 0, Buf);
 331         return NULL;
 332     }
 333
 334     DPRINT("%S -> %S\n", Buf, Expanded);
 335
 336     Status = LogfCreate(&pLogf, LogName, &FileName, TRUE, FALSE);
 337     if (!NT_SUCCESS(Status))
 338     {
 339         DPRINT1("Failed to create %S! (Status %08lx)\n", Expanded, Status);
 340     }
 341
 342     HeapFree(MyHeap, 0, Buf);
 343     HeapFree(MyHeap, 0, Expanded);
 344     return pLogf;
 345 }
 346
 347 BOOL LoadLogFiles(HKEY eventlogKey)
 348 {
 349     LONG result;
 350     DWORD MaxLognameLen, LognameLen;
 351     WCHAR *Buf = NULL;
 352     INT i;
 353     PLOGFILE pLogFile;
 354
 355     RegQueryInfoKey(eventlogKey,
 356                     NULL, NULL, NULL, NULL,
 357                     &MaxLognameLen,
 358                     NULL, NULL, NULL, NULL, NULL, NULL);
 359
 360     MaxLognameLen++;
 361
 362     Buf = HeapAlloc(MyHeap, 0, MaxLognameLen * sizeof(WCHAR));
 363
 364     if (!Buf)
 365     {
 366         DPRINT1("Error: can't allocate heap!\n");
 367         return FALSE;
 368     }
 369
 370     i = 0;
 371     LognameLen = MaxLognameLen;
 372
 373     while (RegEnumKeyEx(eventlogKey,
 374                         i,
 375                         Buf,
 376                         &LognameLen,
 377                         NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
 378     {
 379         HKEY SubKey;
 380
 381         DPRINT("%S\n", Buf);
 382
 383         result = RegOpenKeyEx(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
 384         if (result != ERROR_SUCCESS)
 385         {
 386             DPRINT1("Failed to open %S key.\n", Buf);
 387             HeapFree(MyHeap, 0, Buf);
 388             return FALSE;
 389         }
 390
 391         pLogFile = LoadLogFile(SubKey, Buf);
 392         if (pLogFile != NULL)
 393         {
 394             DPRINT("Loaded %S\n", Buf);
 395             LoadEventSources(SubKey, pLogFile);
 396         }
 397         else
 398         {
 399             DPRINT1("Failed to load %S\n", Buf);
 400         }
 401
 402         RegCloseKey(SubKey);
 403         LognameLen = MaxLognameLen;
 404         i++;
 405     }
 406
 407     HeapFree(MyHeap, 0, Buf);
 408     return TRUE;
 409 }
 410
 411 INT wmain()
 412 {
 413     WCHAR LogPath[MAX_PATH];
 414     INT RetCode = 0;
 415     LONG result;
 416     HKEY elogKey;
 417
 418     LogfListInitialize();
 419     InitEventSourceList();
 420
 421     MyHeap = HeapCreate(0, 1024 * 256, 0);
 422
 423     if (!MyHeap)
 424     {
 425         DPRINT1("FATAL ERROR, can't create heap.\n");
 426         RetCode = 1;
 427         goto bye_bye;
 428     }
 429
 430     GetWindowsDirectory(LogPath, MAX_PATH);
 431
 432     if (GetDriveType(LogPath) == DRIVE_CDROM)
 433     {
 434         DPRINT("LiveCD detected\n");
 435         onLiveCD = TRUE;
 436     }
 437     else
 438     {
 439         result = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
 440                               L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
 441                               0,
 442                               KEY_ALL_ACCESS,
 443                               &elogKey);
 444
 445         if (result != ERROR_SUCCESS)
 446         {
 447             DPRINT1("Fatal error: can't open eventlog registry key.\n");
 448             RetCode = 1;
 449             goto bye_bye;
 450         }
 451
 452         LoadLogFiles(elogKey);
 453     }
 454
 455     StartServiceCtrlDispatcher(ServiceTable);
 456
 457   bye_bye:
 458     LogfCloseAll();
 459
 460     if (MyHeap)
 461         HeapDestroy(MyHeap);
 462
 463     return RetCode;
 464 }
 465
 466 VOID EventTimeToSystemTime(DWORD EventTime, SYSTEMTIME * pSystemTime)
 467 {
 468     SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
 469     FILETIME ftLocal;
 470     union
 471     {
 472         FILETIME ft;
 473         ULONGLONG ll;
 474     } u1970, uUCT;
 475
 476     uUCT.ft.dwHighDateTime = 0;
 477     uUCT.ft.dwLowDateTime = EventTime;
 478     SystemTimeToFileTime(&st1970, &u1970.ft);
 479     uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
 480     FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
 481     FileTimeToSystemTime(&ftLocal, pSystemTime);
 482 }
 483
 484 VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
 485 {
 486     SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
 487     union
 488     {
 489         FILETIME ft;
 490         ULONGLONG ll;
 491     } Time, u1970;
 492
 493     SystemTimeToFileTime(pSystemTime, &Time.ft);
 494     SystemTimeToFileTime(&st1970, &u1970.ft);
 495     *pEventTime = (DWORD)((Time.ll - u1970.ll) / 10000000ull);
 496 }
 497
 498 VOID PRINT_HEADER(PEVENTLOGHEADER header)
 499 {
 500     DPRINT("HeaderSize = %lu\n", header->HeaderSize);
 501     DPRINT("Signature = 0x%x\n", header->Signature);
 502     DPRINT("MajorVersion = %lu\n", header->MajorVersion);
 503     DPRINT("MinorVersion = %lu\n", header->MinorVersion);
 504     DPRINT("StartOffset = %lu\n", header->StartOffset);
 505     DPRINT("EndOffset = 0x%x\n", header->EndOffset);
 506     DPRINT("CurrentRecordNumber = %lu\n", header->CurrentRecordNumber);
 507     DPRINT("OldestRecordNumber = %lu\n", header->OldestRecordNumber);
 508     DPRINT("MaxSize = 0x%x\n", header->MaxSize);
 509     DPRINT("Retention = 0x%x\n", header->Retention);
 510     DPRINT("EndHeaderSize = %lu\n", header->EndHeaderSize);
 511     DPRINT("Flags: ");
 512     if (header->Flags & ELF_LOGFILE_HEADER_DIRTY)  DPRINT("ELF_LOGFILE_HEADER_DIRTY");
 513     if (header->Flags & ELF_LOGFILE_HEADER_WRAP)  DPRINT("| ELF_LOGFILE_HEADER_WRAP ");
 514     if (header->Flags & ELF_LOGFILE_LOGFULL_WRITTEN)  DPRINT("| ELF_LOGFILE_LOGFULL_WRITTEN ");
 515     if (header->Flags & ELF_LOGFILE_ARCHIVE_SET)  DPRINT("| ELF_LOGFILE_ARCHIVE_SET ");
 516     DPRINT("\n");
 517 }
 518
 519 VOID PRINT_RECORD(PEVENTLOGRECORD pRec)
 520 {
 521     UINT i;
 522     WCHAR *str;
 523     SYSTEMTIME time;
 524
 525     DPRINT("Length = %lu\n", pRec->Length);
 526     DPRINT("Reserved = 0x%x\n", pRec->Reserved);
 527     DPRINT("RecordNumber = %lu\n", pRec->RecordNumber);
 528
 529     EventTimeToSystemTime(pRec->TimeGenerated, &time);
 530     DPRINT("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n",
 531            time.wDay, time.wMonth, time.wYear,
 532            time.wHour, time.wMinute, time.wSecond);
 533
 534     EventTimeToSystemTime(pRec->TimeWritten, &time);
 535     DPRINT("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n",
 536            time.wDay, time.wMonth, time.wYear,
 537            time.wHour, time.wMinute, time.wSecond);
 538
 539     DPRINT("EventID = %lu\n", pRec->EventID);
 540
 541     switch (pRec->EventType)
 542     {
 543         case EVENTLOG_ERROR_TYPE:
 544             DPRINT("EventType = EVENTLOG_ERROR_TYPE\n");
 545             break;
 546         case EVENTLOG_WARNING_TYPE:
 547             DPRINT("EventType = EVENTLOG_WARNING_TYPE\n");
 548             break;
 549         case EVENTLOG_INFORMATION_TYPE:
 550             DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n");
 551             break;
 552         case EVENTLOG_AUDIT_SUCCESS:
 553             DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n");
 554             break;
 555         case EVENTLOG_AUDIT_FAILURE:
 556             DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n");
 557             break;
 558         default:
 559             DPRINT("EventType = %hu\n", pRec->EventType);
 560     }
 561
 562     DPRINT("NumStrings = %hu\n", pRec->NumStrings);
 563     DPRINT("EventCategory = %hu\n", pRec->EventCategory);
 564     DPRINT("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
 565     DPRINT("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber);
 566     DPRINT("StringOffset = %lu\n", pRec->StringOffset);
 567     DPRINT("UserSidLength = %lu\n", pRec->UserSidLength);
 568     DPRINT("UserSidOffset = %lu\n", pRec->UserSidOffset);
 569     DPRINT("DataLength = %lu\n", pRec->DataLength);
 570     DPRINT("DataOffset = %lu\n", pRec->DataOffset);
 571
 572     DPRINT("SourceName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD)));
 573
 574     i = (lstrlenW((WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD))) + 1) *
 575         sizeof(WCHAR);
 576
 577     DPRINT("ComputerName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD) + i));
 578
 579     if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
 580     {
 581         DPRINT("Strings:\n");
 582         str = (WCHAR *) (((PBYTE) pRec) + pRec->StringOffset);
 583         for (i = 0; i < pRec->NumStrings; i++)
 584         {
 585             DPRINT("[%u] %S\n", i, str);
 586             str = str + lstrlenW(str) + 1;
 587         }
 588     }
 589
 590     DPRINT("Length2 = %lu\n", *(PDWORD) (((PBYTE) pRec) + pRec->Length - 4));
 591 }