dll/win32/advapi32/service/eventlog.c

   1 /*
   2  * Win32 advapi functions
   3  *
   4  * Copyright 1995 Sven Verdoolaege
   5  * Copyright 1998 Juergen Schmied
   6  * Copyright 2003 Mike Hearn
   7  * Copyright 2007 Hervé Poussineau
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  22  */
  23
  24 #include <advapi32.h>
  25 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
  26
  27 static RPC_UNICODE_STRING EmptyStringU = { 0, 0, L"" };
  28 static RPC_STRING EmptyStringA = { 0, 0, "" };
  29
  30
  31 handle_t __RPC_USER
  32 EVENTLOG_HANDLE_A_bind(EVENTLOG_HANDLE_A UNCServerName)
  33 {
  34     handle_t hBinding = NULL;
  35     UCHAR *pszStringBinding;
  36     RPC_STATUS status;
  37
  38     TRACE("EVENTLOG_HANDLE_A_bind() called\n");
  39
  40     status = RpcStringBindingComposeA(NULL,
  41                                       (UCHAR *)"ncacn_np",
  42                                       (UCHAR *)UNCServerName,
  43                                       (UCHAR *)"\\pipe\\EventLog",
  44                                       NULL,
  45                                       (UCHAR **)&pszStringBinding);
  46     if (status)
  47     {
  48         ERR("RpcStringBindingCompose returned 0x%x\n", status);
  49         return NULL;
  50     }
  51
  52     /* Set the binding handle that will be used to bind to the server. */
  53     status = RpcBindingFromStringBindingA(pszStringBinding,
  54                                           &hBinding);
  55     if (status)
  56     {
  57         ERR("RpcBindingFromStringBinding returned 0x%x\n", status);
  58     }
  59
  60     status = RpcStringFreeA(&pszStringBinding);
  61     if (status)
  62     {
  63         ERR("RpcStringFree returned 0x%x\n", status);
  64     }
  65
  66     return hBinding;
  67 }
  68
  69
  70 void __RPC_USER
  71 EVENTLOG_HANDLE_A_unbind(EVENTLOG_HANDLE_A UNCServerName,
  72                          handle_t hBinding)
  73 {
  74     RPC_STATUS status;
  75
  76     TRACE("EVENTLOG_HANDLE_A_unbind() called\n");
  77
  78     status = RpcBindingFree(&hBinding);
  79     if (status)
  80     {
  81         ERR("RpcBindingFree returned 0x%x\n", status);
  82     }
  83 }
  84
  85
  86 handle_t __RPC_USER
  87 EVENTLOG_HANDLE_W_bind(EVENTLOG_HANDLE_W UNCServerName)
  88 {
  89     handle_t hBinding = NULL;
  90     LPWSTR pszStringBinding;
  91     RPC_STATUS status;
  92
  93     TRACE("EVENTLOG_HANDLE_W_bind() called\n");
  94
  95     status = RpcStringBindingComposeW(NULL,
  96                                       L"ncacn_np",
  97                                       (LPWSTR)UNCServerName,
  98                                       L"\\pipe\\EventLog",
  99                                       NULL,
 100                                       &pszStringBinding);
 101     if (status)
 102     {
 103         ERR("RpcStringBindingCompose returned 0x%x\n", status);
 104         return NULL;
 105     }
 106
 107     /* Set the binding handle that will be used to bind to the server. */
 108     status = RpcBindingFromStringBindingW(pszStringBinding,
 109                                           &hBinding);
 110     if (status)
 111     {
 112         ERR("RpcBindingFromStringBinding returned 0x%x\n", status);
 113     }
 114
 115     status = RpcStringFreeW(&pszStringBinding);
 116     if (status)
 117     {
 118         ERR("RpcStringFree returned 0x%x\n", status);
 119     }
 120
 121     return hBinding;
 122 }
 123
 124
 125 void __RPC_USER
 126 EVENTLOG_HANDLE_W_unbind(EVENTLOG_HANDLE_W UNCServerName,
 127                          handle_t hBinding)
 128 {
 129     RPC_STATUS status;
 130
 131     TRACE("EVENTLOG_HANDLE_W_unbind() called\n");
 132
 133     status = RpcBindingFree(&hBinding);
 134     if (status)
 135     {
 136         ERR("RpcBindingFree returned 0x%x\n", status);
 137     }
 138 }
 139
 140
 141 /******************************************************************************
 142  * BackupEventLogA [ADVAPI32.@]
 143  */
 144 BOOL WINAPI
 145 BackupEventLogA(IN HANDLE hEventLog,
 146                 IN LPCSTR lpBackupFileName)
 147 {
 148     ANSI_STRING BackupFileNameA;
 149     UNICODE_STRING BackupFileNameW;
 150     NTSTATUS Status;
 151     BOOL Result;
 152
 153     TRACE("%p, %s\n", hEventLog, lpBackupFileName);
 154
 155     if (lpBackupFileName == NULL)
 156     {
 157         SetLastError(ERROR_INVALID_PARAMETER);
 158         return FALSE;
 159     }
 160
 161     RtlInitAnsiString(&BackupFileNameA, lpBackupFileName);
 162
 163     Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
 164                                           &BackupFileNameA,
 165                                           TRUE);
 166     if (!NT_SUCCESS(Status))
 167     {
 168         SetLastError(RtlNtStatusToDosError(Status));
 169         return FALSE;
 170     }
 171
 172     Result = BackupEventLogW(hEventLog,
 173                              BackupFileNameW.Buffer);
 174
 175     RtlFreeUnicodeString(&BackupFileNameW);
 176
 177     return(Result);
 178 }
 179
 180
 181 /******************************************************************************
 182  * BackupEventLogW [ADVAPI32.@]
 183  *
 184  * PARAMS
 185  *   hEventLog        []
 186  *   lpBackupFileName []
 187  */
 188 BOOL WINAPI
 189 BackupEventLogW(IN HANDLE hEventLog,
 190                 IN LPCWSTR lpBackupFileName)
 191 {
 192     UNICODE_STRING BackupFileNameW;
 193     NTSTATUS Status;
 194
 195     TRACE("%p, %s\n", hEventLog, debugstr_w(lpBackupFileName));
 196
 197     if (lpBackupFileName == NULL)
 198     {
 199         SetLastError(ERROR_INVALID_PARAMETER);
 200         return FALSE;
 201     }
 202
 203     if (!RtlDosPathNameToNtPathName_U(lpBackupFileName, &BackupFileNameW,
 204                                       NULL, NULL))
 205     {
 206         SetLastError(ERROR_INVALID_PARAMETER);
 207         return FALSE;
 208     }
 209
 210     RpcTryExcept
 211     {
 212         Status = ElfrBackupELFW(hEventLog,
 213                                 (PRPC_UNICODE_STRING)&BackupFileNameW);
 214     }
 215     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 216     {
 217         Status = I_RpcMapWin32Status(RpcExceptionCode());
 218     }
 219     RpcEndExcept;
 220
 221     RtlFreeHeap(RtlGetProcessHeap(), 0, BackupFileNameW.Buffer);
 222
 223     if (!NT_SUCCESS(Status))
 224     {
 225         SetLastError(RtlNtStatusToDosError(Status));
 226         return FALSE;
 227     }
 228
 229     return TRUE;
 230 }
 231
 232
 233 /******************************************************************************
 234  * ClearEventLogA [ADVAPI32.@]
 235  */
 236 BOOL WINAPI
 237 ClearEventLogA(IN HANDLE hEventLog,
 238                IN LPCSTR lpBackupFileName)
 239 {
 240     ANSI_STRING BackupFileNameA;
 241     UNICODE_STRING BackupFileNameW;
 242     NTSTATUS Status;
 243     BOOL Result;
 244
 245     TRACE("%p, %s\n", hEventLog, lpBackupFileName);
 246
 247     if (lpBackupFileName == NULL)
 248     {
 249         RtlInitUnicodeString(&BackupFileNameW, NULL);
 250     }
 251     else
 252     {
 253         RtlInitAnsiString(&BackupFileNameA, lpBackupFileName);
 254
 255         Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
 256                                               &BackupFileNameA,
 257                                               TRUE);
 258         if (!NT_SUCCESS(Status))
 259         {
 260             SetLastError(RtlNtStatusToDosError(Status));
 261             return FALSE;
 262         }
 263     }
 264
 265     Result = ClearEventLogW(hEventLog,
 266                             BackupFileNameW.Buffer);
 267
 268     RtlFreeUnicodeString(&BackupFileNameW);
 269
 270     return Result;
 271 }
 272
 273
 274 /******************************************************************************
 275  * ClearEventLogW [ADVAPI32.@]
 276  */
 277 BOOL WINAPI
 278 ClearEventLogW(IN HANDLE hEventLog,
 279                IN LPCWSTR lpBackupFileName)
 280 {
 281     UNICODE_STRING BackupFileNameW;
 282     NTSTATUS Status;
 283
 284     TRACE("%p, %s\n", hEventLog, debugstr_w(lpBackupFileName));
 285
 286     if (lpBackupFileName == NULL)
 287     {
 288         RtlInitUnicodeString(&BackupFileNameW, NULL);
 289     }
 290     else
 291     {
 292         if (!RtlDosPathNameToNtPathName_U(lpBackupFileName, &BackupFileNameW,
 293                                           NULL, NULL))
 294         {
 295             SetLastError(ERROR_INVALID_PARAMETER);
 296             return FALSE;
 297         }
 298     }
 299
 300     RpcTryExcept
 301     {
 302         Status = ElfrClearELFW(hEventLog,
 303                                (PRPC_UNICODE_STRING)&BackupFileNameW);
 304     }
 305     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 306     {
 307         Status = I_RpcMapWin32Status(RpcExceptionCode());
 308     }
 309     RpcEndExcept;
 310
 311     if (lpBackupFileName != NULL)
 312         RtlFreeHeap(RtlGetProcessHeap(), 0, BackupFileNameW.Buffer);
 313
 314     if (!NT_SUCCESS(Status))
 315     {
 316         SetLastError(RtlNtStatusToDosError(Status));
 317         return FALSE;
 318     }
 319
 320     return TRUE;
 321 }
 322
 323
 324 /******************************************************************************
 325  * CloseEventLog [ADVAPI32.@]
 326  */
 327 BOOL WINAPI
 328 CloseEventLog(IN HANDLE hEventLog)
 329 {
 330     NTSTATUS Status;
 331
 332     TRACE("%p\n", hEventLog);
 333
 334     RpcTryExcept
 335     {
 336         Status = ElfrCloseEL(&hEventLog);
 337     }
 338     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 339     {
 340         Status = I_RpcMapWin32Status(RpcExceptionCode());
 341     }
 342     RpcEndExcept;
 343
 344     if (!NT_SUCCESS(Status))
 345     {
 346         SetLastError(RtlNtStatusToDosError(Status));
 347         return FALSE;
 348     }
 349
 350     return TRUE;
 351 }
 352
 353
 354 /******************************************************************************
 355  * DeregisterEventSource [ADVAPI32.@]
 356  * Closes a handle to the specified event log
 357  *
 358  * PARAMS
 359  *    hEventLog [I] Handle to event log
 360  *
 361  * RETURNS STD
 362  */
 363 BOOL WINAPI
 364 DeregisterEventSource(IN HANDLE hEventLog)
 365 {
 366     NTSTATUS Status;
 367
 368     TRACE("%p\n", hEventLog);
 369
 370     RpcTryExcept
 371     {
 372         Status = ElfrDeregisterEventSource(&hEventLog);
 373     }
 374     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 375     {
 376         Status = I_RpcMapWin32Status(RpcExceptionCode());
 377     }
 378     RpcEndExcept;
 379
 380     if (!NT_SUCCESS(Status))
 381     {
 382         SetLastError(RtlNtStatusToDosError(Status));
 383         return FALSE;
 384     }
 385
 386     return TRUE;
 387 }
 388
 389
 390 /******************************************************************************
 391  * GetEventLogInformation [ADVAPI32.@]
 392  *
 393  * PARAMS
 394  *   hEventLog      [I] Handle to event log
 395  *   dwInfoLevel    [I] Level of event log information to return
 396  *   lpBuffer       [O] Buffer that receives the event log information
 397  *   cbBufSize      [I] Size of the lpBuffer buffer
 398  *   pcbBytesNeeded [O] Required buffer size
 399  */
 400 BOOL WINAPI
 401 GetEventLogInformation(IN HANDLE hEventLog,
 402                        IN DWORD dwInfoLevel,
 403                        OUT LPVOID lpBuffer,
 404                        IN DWORD cbBufSize,
 405                        OUT LPDWORD pcbBytesNeeded)
 406 {
 407     NTSTATUS Status;
 408
 409     if (dwInfoLevel != EVENTLOG_FULL_INFO)
 410     {
 411         SetLastError(ERROR_INVALID_LEVEL);
 412         return FALSE;
 413     }
 414
 415     RpcTryExcept
 416     {
 417         Status = ElfrGetLogInformation(hEventLog,
 418                                        dwInfoLevel,
 419                                        (LPBYTE)lpBuffer,
 420                                        cbBufSize,
 421                                        pcbBytesNeeded);
 422     }
 423     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 424     {
 425         Status = I_RpcMapWin32Status(RpcExceptionCode());
 426     }
 427     RpcEndExcept;
 428
 429     if (!NT_SUCCESS(Status))
 430     {
 431         SetLastError(RtlNtStatusToDosError(Status));
 432         return FALSE;
 433     }
 434
 435     return TRUE;
 436 }
 437
 438
 439 /******************************************************************************
 440  * GetNumberOfEventLogRecords [ADVAPI32.@]
 441  *
 442  * PARAMS
 443  *   hEventLog       []
 444  *   NumberOfRecords []
 445  */
 446 BOOL WINAPI
 447 GetNumberOfEventLogRecords(IN HANDLE hEventLog,
 448                            OUT PDWORD NumberOfRecords)
 449 {
 450     NTSTATUS Status;
 451     DWORD Records;
 452
 453     TRACE("%p, %p\n", hEventLog, NumberOfRecords);
 454
 455     if (NumberOfRecords == NULL)
 456     {
 457         SetLastError(ERROR_INVALID_PARAMETER);
 458         return FALSE;
 459     }
 460
 461     RpcTryExcept
 462     {
 463         Status = ElfrNumberOfRecords(hEventLog,
 464                                      &Records);
 465     }
 466     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 467     {
 468         Status = I_RpcMapWin32Status(RpcExceptionCode());
 469     }
 470     RpcEndExcept;
 471
 472     if (!NT_SUCCESS(Status))
 473     {
 474         SetLastError(RtlNtStatusToDosError(Status));
 475         return FALSE;
 476     }
 477
 478     *NumberOfRecords = Records;
 479
 480     return TRUE;
 481 }
 482
 483
 484 /******************************************************************************
 485  * GetOldestEventLogRecord [ADVAPI32.@]
 486  *
 487  * PARAMS
 488  *   hEventLog    []
 489  *   OldestRecord []
 490  */
 491 BOOL WINAPI
 492 GetOldestEventLogRecord(IN HANDLE hEventLog,
 493                         OUT PDWORD OldestRecord)
 494 {
 495     NTSTATUS Status;
 496     DWORD Oldest;
 497
 498     TRACE("%p, %p\n", hEventLog, OldestRecord);
 499
 500     if (OldestRecord == NULL)
 501     {
 502         SetLastError(ERROR_INVALID_PARAMETER);
 503         return FALSE;
 504     }
 505
 506     RpcTryExcept
 507     {
 508         Status = ElfrOldestRecord(hEventLog,
 509                                   &Oldest);
 510     }
 511     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 512     {
 513         Status = I_RpcMapWin32Status(RpcExceptionCode());
 514     }
 515     RpcEndExcept;
 516
 517     if (!NT_SUCCESS(Status))
 518     {
 519         SetLastError(RtlNtStatusToDosError(Status));
 520         return FALSE;
 521     }
 522
 523     *OldestRecord = Oldest;
 524
 525     return TRUE;
 526 }
 527
 528
 529 /******************************************************************************
 530  * NotifyChangeEventLog [ADVAPI32.@]
 531  *
 532  * PARAMS
 533  *   hEventLog []
 534  *   hEvent    []
 535  */
 536 BOOL WINAPI
 537 NotifyChangeEventLog(IN HANDLE hEventLog,
 538                      IN HANDLE hEvent)
 539 {
 540     /* Use ElfrChangeNotify */
 541     UNIMPLEMENTED;
 542     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
 543     return FALSE;
 544 }
 545
 546
 547 /******************************************************************************
 548  * OpenBackupEventLogA [ADVAPI32.@]
 549  */
 550 HANDLE WINAPI
 551 OpenBackupEventLogA(IN LPCSTR lpUNCServerName,
 552                     IN LPCSTR lpFileName)
 553 {
 554     ANSI_STRING UNCServerNameA;
 555     UNICODE_STRING UNCServerNameW;
 556     ANSI_STRING FileNameA;
 557     UNICODE_STRING FileNameW;
 558     HANDLE LogHandle;
 559     NTSTATUS Status;
 560
 561     TRACE("%s, %s\n", lpUNCServerName, lpFileName);
 562
 563     /* Convert the server name to unicode */
 564     if (lpUNCServerName == NULL)
 565     {
 566         RtlInitUnicodeString(&UNCServerNameW, NULL);
 567     }
 568     else
 569     {
 570         RtlInitAnsiString(&UNCServerNameA, lpUNCServerName);
 571
 572         Status = RtlAnsiStringToUnicodeString(&UNCServerNameW,
 573                                               &UNCServerNameA,
 574                                               TRUE);
 575         if (!NT_SUCCESS(Status))
 576         {
 577             SetLastError(RtlNtStatusToDosError(Status));
 578             return NULL;
 579         }
 580     }
 581
 582     /* Convert the file name to unicode */
 583     if (lpFileName == NULL)
 584     {
 585         RtlInitUnicodeString(&FileNameW, NULL);
 586     }
 587     else
 588     {
 589         RtlInitAnsiString(&FileNameA, lpFileName);
 590
 591         Status = RtlAnsiStringToUnicodeString(&FileNameW,
 592                                               &FileNameA,
 593                                               TRUE);
 594         if (!NT_SUCCESS(Status))
 595         {
 596             RtlFreeUnicodeString(&UNCServerNameW);
 597             SetLastError(RtlNtStatusToDosError(Status));
 598             return NULL;
 599         }
 600     }
 601
 602     /* Call the unicode function */
 603     LogHandle = OpenBackupEventLogW(UNCServerNameW.Buffer,
 604                                     FileNameW.Buffer);
 605
 606     /* Free the unicode strings */
 607     RtlFreeUnicodeString(&UNCServerNameW);
 608     RtlFreeUnicodeString(&FileNameW);
 609
 610     return LogHandle;
 611 }
 612
 613
 614 /******************************************************************************
 615  * OpenBackupEventLogW [ADVAPI32.@]
 616  *
 617  * PARAMS
 618  *   lpUNCServerName []
 619  *   lpFileName      []
 620  */
 621 HANDLE WINAPI
 622 OpenBackupEventLogW(IN LPCWSTR lpUNCServerName,
 623                     IN LPCWSTR lpFileName)
 624 {
 625     UNICODE_STRING FileNameW;
 626     IELF_HANDLE LogHandle;
 627     NTSTATUS Status;
 628
 629     TRACE("%s, %s\n", debugstr_w(lpUNCServerName), debugstr_w(lpFileName));
 630
 631     if (lpFileName == NULL)
 632     {
 633         SetLastError(ERROR_INVALID_PARAMETER);
 634         return NULL;
 635     }
 636
 637     if (!RtlDosPathNameToNtPathName_U(lpFileName, &FileNameW,
 638                                       NULL, NULL))
 639     {
 640         SetLastError(ERROR_INVALID_PARAMETER);
 641         return NULL;
 642     }
 643
 644     RpcTryExcept
 645     {
 646         Status = ElfrOpenBELW((LPWSTR)lpUNCServerName,
 647                               (PRPC_UNICODE_STRING)&FileNameW,
 648                               1,
 649                               1,
 650                               &LogHandle);
 651     }
 652     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 653     {
 654         Status = I_RpcMapWin32Status(RpcExceptionCode());
 655     }
 656     RpcEndExcept;
 657
 658     if (FileNameW.Buffer != NULL)
 659         RtlFreeHeap(RtlGetProcessHeap(), 0, FileNameW.Buffer);
 660
 661     if (!NT_SUCCESS(Status))
 662     {
 663         SetLastError(RtlNtStatusToDosError(Status));
 664         return NULL;
 665     }
 666
 667     return (HANDLE)LogHandle;
 668 }
 669
 670
 671 /******************************************************************************
 672  * OpenEventLogA [ADVAPI32.@]
 673  *
 674  * Opens a handle to the specified event log.
 675  *
 676  * PARAMS
 677  *  lpUNCServerName [I] UNC name of the server on which the event log is
 678  *                      opened.
 679  *  lpSourceName    [I] Name of the log.
 680  *
 681  * RETURNS
 682  *  Success: Handle to an event log.
 683  *  Failure: NULL
 684  */
 685 HANDLE WINAPI
 686 OpenEventLogA(IN LPCSTR lpUNCServerName,
 687               IN LPCSTR lpSourceName)
 688 {
 689     LPSTR UNCServerName;
 690     ANSI_STRING SourceName;
 691     IELF_HANDLE LogHandle = NULL;
 692     NTSTATUS Status;
 693
 694     TRACE("%s, %s\n", lpUNCServerName, lpSourceName);
 695
 696     if (lpSourceName == NULL)
 697     {
 698         SetLastError(ERROR_INVALID_PARAMETER);
 699         return NULL;
 700     }
 701
 702     if (lpUNCServerName == NULL || *lpUNCServerName == 0)
 703         UNCServerName = NULL;
 704     else
 705         UNCServerName = (LPSTR)lpUNCServerName;
 706
 707     RtlInitAnsiString(&SourceName, lpSourceName);
 708
 709     RpcTryExcept
 710     {
 711         Status = ElfrOpenELA(UNCServerName,
 712                              (PRPC_STRING)&SourceName,
 713                              &EmptyStringA,
 714                              1,
 715                              1,
 716                              &LogHandle);
 717     }
 718     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 719     {
 720         Status = I_RpcMapWin32Status(RpcExceptionCode());
 721     }
 722     RpcEndExcept;
 723
 724     if (!NT_SUCCESS(Status))
 725     {
 726         SetLastError(RtlNtStatusToDosError(Status));
 727         return NULL;
 728     }
 729
 730     return (HANDLE)LogHandle;
 731 }
 732
 733
 734 /******************************************************************************
 735  * OpenEventLogW [ADVAPI32.@]
 736  *
 737  * PARAMS
 738  *   lpUNCServerName []
 739  *   lpSourceName    []
 740  */
 741 HANDLE WINAPI
 742 OpenEventLogW(IN LPCWSTR lpUNCServerName,
 743               IN LPCWSTR lpSourceName)
 744 {
 745     LPWSTR UNCServerName;
 746     UNICODE_STRING SourceName;
 747     IELF_HANDLE LogHandle;
 748     NTSTATUS Status;
 749
 750     TRACE("%s, %s\n", debugstr_w(lpUNCServerName), debugstr_w(lpSourceName));
 751
 752     if (lpSourceName == NULL)
 753     {
 754         SetLastError(ERROR_INVALID_PARAMETER);
 755         return NULL;
 756     }
 757
 758     if (lpUNCServerName == NULL || *lpUNCServerName == 0)
 759         UNCServerName = NULL;
 760     else
 761         UNCServerName = (LPWSTR)lpUNCServerName;
 762
 763     RtlInitUnicodeString(&SourceName, lpSourceName);
 764
 765     RpcTryExcept
 766     {
 767         Status = ElfrOpenELW(UNCServerName,
 768                              (PRPC_UNICODE_STRING)&SourceName,
 769                              &EmptyStringU,
 770                              1,
 771                              1,
 772                              &LogHandle);
 773     }
 774     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 775     {
 776         Status = I_RpcMapWin32Status(RpcExceptionCode());
 777     }
 778     RpcEndExcept;
 779
 780     if (!NT_SUCCESS(Status))
 781     {
 782         SetLastError(RtlNtStatusToDosError(Status));
 783         return NULL;
 784     }
 785
 786     return (HANDLE)LogHandle;
 787 }
 788
 789
 790 /******************************************************************************
 791  * ReadEventLogA [ADVAPI32.@]
 792  */
 793 BOOL WINAPI
 794 ReadEventLogA(IN HANDLE hEventLog,
 795               IN DWORD dwReadFlags,
 796               IN DWORD dwRecordOffset,
 797               OUT LPVOID lpBuffer,
 798               IN DWORD nNumberOfBytesToRead,
 799               OUT DWORD *pnBytesRead,
 800               OUT DWORD *pnMinNumberOfBytesNeeded)
 801 {
 802     NTSTATUS Status;
 803     DWORD bytesRead, minNumberOfBytesNeeded;
 804     DWORD dwFlags;
 805
 806     TRACE("%p, %lu, %lu, %p, %lu, %p, %p\n",
 807         hEventLog, dwReadFlags, dwRecordOffset, lpBuffer,
 808         nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
 809
 810     if (lpBuffer == NULL ||
 811         pnBytesRead == NULL ||
 812         pnMinNumberOfBytesNeeded == NULL)
 813     {
 814         SetLastError(ERROR_INVALID_PARAMETER);
 815         return FALSE;
 816     }
 817
 818     dwFlags = dwReadFlags & (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ);
 819     if (dwFlags == (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ))
 820     {
 821         SetLastError(ERROR_INVALID_PARAMETER);
 822         return FALSE;
 823     }
 824
 825     dwFlags = dwReadFlags & (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ);
 826     if (dwFlags == (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ))
 827     {
 828         SetLastError(ERROR_INVALID_PARAMETER);
 829         return FALSE;
 830     }
 831
 832     RpcTryExcept
 833     {
 834         Status = ElfrReadELA(hEventLog,
 835                              dwReadFlags,
 836                              dwRecordOffset,
 837                              nNumberOfBytesToRead,
 838                              lpBuffer,
 839                              &bytesRead,
 840                              &minNumberOfBytesNeeded);
 841     }
 842     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 843     {
 844         Status = I_RpcMapWin32Status(RpcExceptionCode());
 845     }
 846     RpcEndExcept;
 847
 848     *pnBytesRead = (DWORD)bytesRead;
 849     *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
 850
 851     if (!NT_SUCCESS(Status))
 852     {
 853         SetLastError(RtlNtStatusToDosError(Status));
 854         return FALSE;
 855     }
 856
 857     return TRUE;
 858 }
 859
 860
 861 /******************************************************************************
 862  * ReadEventLogW [ADVAPI32.@]
 863  *
 864  * PARAMS
 865  *   hEventLog                []
 866  *   dwReadFlags              []
 867  *   dwRecordOffset           []
 868  *   lpBuffer                 []
 869  *   nNumberOfBytesToRead     []
 870  *   pnBytesRead              []
 871  *   pnMinNumberOfBytesNeeded []
 872  */
 873 BOOL WINAPI
 874 ReadEventLogW(IN HANDLE hEventLog,
 875               IN DWORD dwReadFlags,
 876               IN DWORD dwRecordOffset,
 877               OUT LPVOID lpBuffer,
 878               IN DWORD nNumberOfBytesToRead,
 879               OUT DWORD *pnBytesRead,
 880               OUT DWORD *pnMinNumberOfBytesNeeded)
 881 {
 882     NTSTATUS Status;
 883     DWORD bytesRead, minNumberOfBytesNeeded;
 884     DWORD dwFlags;
 885
 886     TRACE("%p, %lu, %lu, %p, %lu, %p, %p\n",
 887         hEventLog, dwReadFlags, dwRecordOffset, lpBuffer,
 888         nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
 889
 890     if (lpBuffer == NULL ||
 891         pnBytesRead == NULL ||
 892         pnMinNumberOfBytesNeeded == NULL)
 893     {
 894         SetLastError(ERROR_INVALID_PARAMETER);
 895         return FALSE;
 896     }
 897
 898     dwFlags = dwReadFlags & (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ);
 899     if (dwFlags == (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ))
 900     {
 901         SetLastError(ERROR_INVALID_PARAMETER);
 902         return FALSE;
 903     }
 904
 905     dwFlags = dwReadFlags & (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ);
 906     if (dwFlags == (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ))
 907     {
 908         SetLastError(ERROR_INVALID_PARAMETER);
 909         return FALSE;
 910     }
 911
 912     RpcTryExcept
 913     {
 914         Status = ElfrReadELW(hEventLog,
 915                              dwReadFlags,
 916                              dwRecordOffset,
 917                              nNumberOfBytesToRead,
 918                              lpBuffer,
 919                              &bytesRead,
 920                              &minNumberOfBytesNeeded);
 921     }
 922     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 923     {
 924         Status = I_RpcMapWin32Status(RpcExceptionCode());
 925     }
 926     RpcEndExcept;
 927
 928     *pnBytesRead = (DWORD)bytesRead;
 929     *pnMinNumberOfBytesNeeded = (DWORD)minNumberOfBytesNeeded;
 930
 931     if (!NT_SUCCESS(Status))
 932     {
 933         SetLastError(RtlNtStatusToDosError(Status));
 934         return FALSE;
 935     }
 936
 937     return TRUE;
 938 }
 939
 940
 941 /******************************************************************************
 942  * RegisterEventSourceA [ADVAPI32.@]
 943  */
 944 HANDLE WINAPI
 945 RegisterEventSourceA(IN LPCSTR lpUNCServerName,
 946                      IN LPCSTR lpSourceName)
 947 {
 948     ANSI_STRING SourceName;
 949     IELF_HANDLE LogHandle;
 950     NTSTATUS Status;
 951
 952     TRACE("%s, %s\n", lpUNCServerName, lpSourceName);
 953
 954     RtlInitAnsiString(&SourceName, lpSourceName);
 955
 956     RpcTryExcept
 957     {
 958         Status = ElfrRegisterEventSourceA((LPSTR)lpUNCServerName,
 959                                           (PRPC_STRING)&SourceName,
 960                                           &EmptyStringA,
 961                                           1,
 962                                           1,
 963                                           &LogHandle);
 964     }
 965     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
 966     {
 967         Status = I_RpcMapWin32Status(RpcExceptionCode());
 968     }
 969     RpcEndExcept;
 970
 971     if (!NT_SUCCESS(Status))
 972     {
 973         SetLastError(RtlNtStatusToDosError(Status));
 974         return NULL;
 975     }
 976
 977     return (HANDLE)LogHandle;
 978 }
 979
 980
 981 /******************************************************************************
 982  * RegisterEventSourceW [ADVAPI32.@]
 983  * Returns a registered handle to an event log
 984  *
 985  * PARAMS
 986  *   lpUNCServerName [I] Server name for source
 987  *   lpSourceName    [I] Source name for registered handle
 988  *
 989  * RETURNS
 990  *    Success: Handle
 991  *    Failure: NULL
 992  */
 993 HANDLE WINAPI
 994 RegisterEventSourceW(IN LPCWSTR lpUNCServerName,
 995                      IN LPCWSTR lpSourceName)
 996 {
 997     UNICODE_STRING SourceName;
 998     IELF_HANDLE LogHandle;
 999     NTSTATUS Status;
1000
1001     TRACE("%s, %s\n", debugstr_w(lpUNCServerName), debugstr_w(lpSourceName));
1002
1003     RtlInitUnicodeString(&SourceName, lpSourceName);
1004
1005     RpcTryExcept
1006     {
1007         Status = ElfrRegisterEventSourceW((LPWSTR)lpUNCServerName,
1008                                           (PRPC_UNICODE_STRING)&SourceName,
1009                                           &EmptyStringU,
1010                                           1,
1011                                           1,
1012                                           &LogHandle);
1013     }
1014     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
1015     {
1016         Status = I_RpcMapWin32Status(RpcExceptionCode());
1017     }
1018     RpcEndExcept;
1019
1020     if (!NT_SUCCESS(Status))
1021     {
1022         SetLastError(RtlNtStatusToDosError(Status));
1023         return NULL;
1024     }
1025
1026     return (HANDLE)LogHandle;
1027 }
1028
1029
1030 /******************************************************************************
1031  * ReportEventA [ADVAPI32.@]
1032  */
1033 BOOL WINAPI
1034 ReportEventA(IN HANDLE hEventLog,
1035              IN WORD wType,
1036              IN WORD wCategory,
1037              IN DWORD dwEventID,
1038              IN PSID lpUserSid,
1039              IN WORD wNumStrings,
1040              IN DWORD dwDataSize,
1041              IN LPCSTR *lpStrings,
1042              IN LPVOID lpRawData)
1043 {
1044     NTSTATUS Status;
1045     PANSI_STRING *Strings;
1046     ANSI_STRING ComputerName;
1047     WORD i;
1048     CHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
1049     DWORD dwSize;
1050     LARGE_INTEGER SystemTime;
1051     ULONG Seconds;
1052
1053     TRACE("%p, %u, %u, %lu, %p, %u, %lu, %p, %p\n",
1054           hEventLog, wType, wCategory, dwEventID, lpUserSid,
1055           wNumStrings, dwDataSize, lpStrings, lpRawData);
1056
1057     Strings = HeapAlloc(GetProcessHeap(),
1058                         HEAP_ZERO_MEMORY,
1059                         wNumStrings * sizeof(PANSI_STRING));
1060     if (!Strings)
1061     {
1062         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1063         return FALSE;
1064     }
1065
1066     for (i = 0; i < wNumStrings; i++)
1067     {
1068         Strings[i] = HeapAlloc(GetProcessHeap(),
1069                                HEAP_ZERO_MEMORY,
1070                                sizeof(ANSI_STRING));
1071         if (Strings[i])
1072         {
1073             RtlInitAnsiString(Strings[i], lpStrings[i]);
1074         }
1075     }
1076
1077     dwSize = MAX_COMPUTERNAME_LENGTH + 1;
1078     GetComputerNameA(szComputerName, &dwSize);
1079     RtlInitAnsiString(&ComputerName, szComputerName);
1080
1081     NtQuerySystemTime(&SystemTime);
1082     RtlTimeToSecondsSince1970(&SystemTime, &Seconds);
1083
1084     RpcTryExcept
1085     {
1086         Status = ElfrReportEventA(hEventLog,
1087                                   Seconds,
1088                                   wType,
1089                                   wCategory,
1090                                   dwEventID,
1091                                   wNumStrings,
1092                                   dwDataSize,
1093                                   (PRPC_STRING)&ComputerName,
1094                                   lpUserSid,
1095                                   (PRPC_STRING*)Strings,
1096                                   lpRawData,
1097                                   0,
1098                                   NULL,
1099                                   NULL);
1100     }
1101     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
1102     {
1103         Status = I_RpcMapWin32Status(RpcExceptionCode());
1104     }
1105     RpcEndExcept;
1106
1107     for (i = 0; i < wNumStrings; i++)
1108     {
1109         if (Strings[i] != NULL)
1110             HeapFree(GetProcessHeap(), 0, Strings[i]);
1111     }
1112
1113     HeapFree(GetProcessHeap(), 0, Strings);
1114
1115     if (!NT_SUCCESS(Status))
1116     {
1117         SetLastError(RtlNtStatusToDosError(Status));
1118         return FALSE;
1119     }
1120
1121     return TRUE;
1122 }
1123
1124
1125 /******************************************************************************
1126  * ReportEventW [ADVAPI32.@]
1127  *
1128  * PARAMS
1129  *   hEventLog   []
1130  *   wType       []
1131  *   wCategory   []
1132  *   dwEventID   []
1133  *   lpUserSid   []
1134  *   wNumStrings []
1135  *   dwDataSize  []
1136  *   lpStrings   []
1137  *   lpRawData   []
1138  */
1139 BOOL WINAPI
1140 ReportEventW(IN HANDLE hEventLog,
1141              IN WORD wType,
1142              IN WORD wCategory,
1143              IN DWORD dwEventID,
1144              IN PSID lpUserSid,
1145              IN WORD wNumStrings,
1146              IN DWORD dwDataSize,
1147              IN LPCWSTR *lpStrings,
1148              IN LPVOID lpRawData)
1149 {
1150     NTSTATUS Status;
1151     PUNICODE_STRING *Strings;
1152     UNICODE_STRING ComputerName;
1153     WORD i;
1154     WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
1155     DWORD dwSize;
1156     LARGE_INTEGER SystemTime;
1157     ULONG Seconds;
1158
1159     TRACE("%p, %u, %u, %lu, %p, %u, %lu, %p, %p\n",
1160           hEventLog, wType, wCategory, dwEventID, lpUserSid,
1161           wNumStrings, dwDataSize, lpStrings, lpRawData);
1162
1163     Strings = HeapAlloc(GetProcessHeap(),
1164                         0,
1165                         wNumStrings * sizeof(PUNICODE_STRING));
1166     if (!Strings)
1167     {
1168         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1169         return FALSE;
1170     }
1171
1172     for (i = 0; i < wNumStrings; i++)
1173     {
1174         Strings[i] = HeapAlloc(GetProcessHeap(),
1175                                HEAP_ZERO_MEMORY,
1176                                sizeof(ANSI_STRING));
1177         if (Strings[i])
1178         {
1179             RtlInitUnicodeString(Strings[i], lpStrings[i]);
1180         }
1181     }
1182
1183     dwSize = MAX_COMPUTERNAME_LENGTH + 1;
1184     GetComputerNameW(szComputerName, &dwSize);
1185     RtlInitUnicodeString(&ComputerName, szComputerName);
1186
1187     NtQuerySystemTime(&SystemTime);
1188     RtlTimeToSecondsSince1970(&SystemTime, &Seconds);
1189
1190     RpcTryExcept
1191     {
1192         Status = ElfrReportEventW(hEventLog,
1193                                   Seconds,
1194                                   wType,
1195                                   wCategory,
1196                                   dwEventID,
1197                                   wNumStrings,
1198                                   dwDataSize,
1199                                   (PRPC_UNICODE_STRING)&ComputerName,
1200                                   lpUserSid,
1201                                   (PRPC_UNICODE_STRING*)Strings,
1202                                   lpRawData,
1203                                   0,
1204                                   NULL,
1205                                   NULL);
1206     }
1207     RpcExcept(EXCEPTION_EXECUTE_HANDLER)
1208     {
1209         Status = I_RpcMapWin32Status(RpcExceptionCode());
1210     }
1211     RpcEndExcept;
1212
1213     for (i = 0; i < wNumStrings; i++)
1214     {
1215         if (Strings[i] != NULL)
1216             HeapFree(GetProcessHeap(), 0, Strings[i]);
1217     }
1218
1219     HeapFree(GetProcessHeap(), 0, Strings);
1220
1221     if (!NT_SUCCESS(Status))
1222     {
1223         SetLastError(RtlNtStatusToDosError(Status));
1224         return FALSE;
1225     }
1226
1227     return TRUE;
1228 }
1229