aebcc8a737d05cbf42ec909c2748eea1733b5625
[reactos.git] / reactos / base / services / eventlog / eventlog.c
1 /*
2 * PROJECT: ReactOS kernel
3 * LICENSE: GPL - See COPYING in the top level directory
4 * FILE: services/eventlog/eventlog.c
5 * PURPOSE: Event logging service
6 * COPYRIGHT: Copyright 2002 Eric Kohl
7 * Copyright 2005 Saveliy Tretiakov
8 */
9
10 /* INCLUDES *****************************************************************/
11
12 #include "eventlog.h"
13
14 /* GLOBALS ******************************************************************/
15
16 static VOID CALLBACK ServiceMain(DWORD, LPWSTR *);
17 static WCHAR ServiceName[] = L"EventLog";
18 static SERVICE_TABLE_ENTRYW ServiceTable[2] =
19 {
20 { ServiceName, ServiceMain },
21 { NULL, NULL }
22 };
23
24 SERVICE_STATUS ServiceStatus;
25 SERVICE_STATUS_HANDLE ServiceStatusHandle;
26
27 BOOL onLiveCD = FALSE; // On livecd events will go to debug output only
28 HANDLE MyHeap = NULL;
29
30 /* FUNCTIONS ****************************************************************/
31
32 static VOID
33 UpdateServiceStatus(DWORD dwState)
34 {
35 ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
36 ServiceStatus.dwCurrentState = dwState;
37 ServiceStatus.dwControlsAccepted = 0;
38 ServiceStatus.dwWin32ExitCode = 0;
39 ServiceStatus.dwServiceSpecificExitCode = 0;
40 ServiceStatus.dwCheckPoint = 0;
41
42 if (dwState == SERVICE_START_PENDING ||
43 dwState == SERVICE_STOP_PENDING ||
44 dwState == SERVICE_PAUSE_PENDING ||
45 dwState == SERVICE_CONTINUE_PENDING)
46 ServiceStatus.dwWaitHint = 10000;
47 else
48 ServiceStatus.dwWaitHint = 0;
49
50 SetServiceStatus(ServiceStatusHandle,
51 &ServiceStatus);
52 }
53
54 static DWORD WINAPI
55 ServiceControlHandler(DWORD dwControl,
56 DWORD dwEventType,
57 LPVOID lpEventData,
58 LPVOID lpContext)
59 {
60 DPRINT("ServiceControlHandler() called\n");
61
62 switch (dwControl)
63 {
64 case SERVICE_CONTROL_STOP:
65 DPRINT(" SERVICE_CONTROL_STOP received\n");
66
67 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
68 0,
69 EVENT_EventlogStopped, 0, NULL, 0, NULL);
70
71
72 /* Stop listening to incoming RPC messages */
73 RpcMgmtStopServerListening(NULL);
74 UpdateServiceStatus(SERVICE_STOPPED);
75 return ERROR_SUCCESS;
76
77 case SERVICE_CONTROL_PAUSE:
78 DPRINT(" SERVICE_CONTROL_PAUSE received\n");
79 UpdateServiceStatus(SERVICE_PAUSED);
80 return ERROR_SUCCESS;
81
82 case SERVICE_CONTROL_CONTINUE:
83 DPRINT(" SERVICE_CONTROL_CONTINUE received\n");
84 UpdateServiceStatus(SERVICE_RUNNING);
85 return ERROR_SUCCESS;
86
87 case SERVICE_CONTROL_INTERROGATE:
88 DPRINT(" SERVICE_CONTROL_INTERROGATE received\n");
89 SetServiceStatus(ServiceStatusHandle,
90 &ServiceStatus);
91 return ERROR_SUCCESS;
92
93 case SERVICE_CONTROL_SHUTDOWN:
94 DPRINT(" SERVICE_CONTROL_SHUTDOWN received\n");
95
96 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
97 0,
98 EVENT_EventlogStopped, 0, NULL, 0, NULL);
99
100 UpdateServiceStatus(SERVICE_STOPPED);
101 return ERROR_SUCCESS;
102
103 default :
104 DPRINT1(" Control %lu received\n");
105 return ERROR_CALL_NOT_IMPLEMENTED;
106 }
107 }
108
109
110 static DWORD
111 ServiceInit(VOID)
112 {
113 HANDLE hThread;
114
115 hThread = CreateThread(NULL,
116 0,
117 (LPTHREAD_START_ROUTINE)
118 PortThreadRoutine,
119 NULL,
120 0,
121 NULL);
122
123 if (!hThread)
124 {
125 DPRINT("Can't create PortThread\n");
126 return GetLastError();
127 }
128 else
129 CloseHandle(hThread);
130
131 hThread = CreateThread(NULL,
132 0,
133 (LPTHREAD_START_ROUTINE)
134 RpcThreadRoutine,
135 NULL,
136 0,
137 NULL);
138
139 if (!hThread)
140 {
141 DPRINT("Can't create RpcThread\n");
142 return GetLastError();
143 }
144 else
145 CloseHandle(hThread);
146
147 return ERROR_SUCCESS;
148 }
149
150
151 static VOID
152 ReportProductInfoEvent(VOID)
153 {
154 OSVERSIONINFOW versionInfo;
155 WCHAR szBuffer[512];
156 DWORD dwLength;
157 HKEY hKey;
158 DWORD dwValueLength;
159 DWORD dwType;
160 LONG lResult = ERROR_SUCCESS;
161
162 ZeroMemory(&versionInfo, sizeof(OSVERSIONINFO));
163 versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
164
165 /* Get version information */
166 if (!GetVersionExW(&versionInfo))
167 return;
168
169 ZeroMemory(szBuffer, 512 * sizeof(WCHAR));
170
171 /* Write version into the buffer */
172 dwLength = swprintf(szBuffer,
173 L"%lu.%lu",
174 versionInfo.dwMajorVersion,
175 versionInfo.dwMinorVersion) + 1;
176
177 /* Write build number into the buffer */
178 dwLength += swprintf(&szBuffer[dwLength],
179 L"%lu",
180 versionInfo.dwBuildNumber) + 1;
181
182 /* Write service pack info into the buffer */
183 wcscpy(&szBuffer[dwLength], versionInfo.szCSDVersion);
184 dwLength += wcslen(versionInfo.szCSDVersion) + 1;
185
186 /* Read 'CurrentType' from the registry and write it into the buffer */
187 lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
188 L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
189 0,
190 KEY_QUERY_VALUE,
191 &hKey);
192 if (lResult == ERROR_SUCCESS)
193 {
194 dwValueLength = 512 - dwLength;
195 lResult = RegQueryValueEx(hKey,
196 L"CurrentType",
197 NULL,
198 &dwType,
199 (LPBYTE)&szBuffer[dwLength],
200 &dwValueLength);
201
202 RegCloseKey(hKey);
203 }
204
205 /* Log the product information */
206 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
207 0,
208 EVENT_EventLogProductInfo,
209 4,
210 szBuffer,
211 0,
212 NULL);
213 }
214
215
216 static VOID CALLBACK
217 ServiceMain(DWORD argc,
218 LPWSTR *argv)
219 {
220 DWORD dwError;
221
222 UNREFERENCED_PARAMETER(argc);
223 UNREFERENCED_PARAMETER(argv);
224
225 DPRINT("ServiceMain() called\n");
226
227 ServiceStatusHandle = RegisterServiceCtrlHandlerExW(ServiceName,
228 ServiceControlHandler,
229 NULL);
230 if (!ServiceStatusHandle)
231 {
232 dwError = GetLastError();
233 DPRINT1("RegisterServiceCtrlHandlerW() failed! (Error %lu)\n", dwError);
234 return;
235 }
236
237 UpdateServiceStatus(SERVICE_START_PENDING);
238
239 dwError = ServiceInit();
240 if (dwError != ERROR_SUCCESS)
241 {
242 DPRINT("Service stopped (dwError: %lu\n", dwError);
243 UpdateServiceStatus(SERVICE_START_PENDING);
244 }
245 else
246 {
247 DPRINT("Service started\n");
248 UpdateServiceStatus(SERVICE_RUNNING);
249
250 ReportProductInfoEvent();
251
252 LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
253 0,
254 EVENT_EventlogStarted,
255 0,
256 NULL,
257 0,
258 NULL);
259 }
260
261 DPRINT("ServiceMain() done\n");
262 }
263
264
265 PLOGFILE LoadLogFile(HKEY hKey, WCHAR * LogName)
266 {
267 DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
268 WCHAR *Buf = NULL, *Expanded = NULL;
269 LONG Result;
270 PLOGFILE pLogf;
271
272 DPRINT("LoadLogFile: %S\n", LogName);
273
274 RegQueryInfoKey(hKey, NULL, NULL, NULL, NULL, NULL, NULL,
275 NULL, NULL, &MaxValueLen, NULL, NULL);
276
277 Buf = HeapAlloc(MyHeap, 0, MaxValueLen);
278 if (!Buf)
279 {
280 DPRINT1("Can't allocate heap!\n");
281 return NULL;
282 }
283
284 ValueLen = MaxValueLen;
285
286 Result = RegQueryValueEx(hKey,
287 L"File",
288 NULL,
289 &Type,
290 (LPBYTE) Buf,
291 &ValueLen);
292 if (Result != ERROR_SUCCESS)
293 {
294 DPRINT1("RegQueryValueEx failed: %d\n", GetLastError());
295 HeapFree(MyHeap, 0, Buf);
296 return NULL;
297 }
298
299 if (Type != REG_EXPAND_SZ && Type != REG_SZ)
300 {
301 DPRINT1("%S\\File - value of wrong type %x.\n", LogName, Type);
302 HeapFree(MyHeap, 0, Buf);
303 return NULL;
304 }
305
306 ExpandedLen = ExpandEnvironmentStrings(Buf, NULL, 0);
307 Expanded = HeapAlloc(MyHeap, 0, ExpandedLen * sizeof(WCHAR));
308 if (!Expanded)
309 {
310 DPRINT1("Can't allocate heap!\n");
311 HeapFree(MyHeap, 0, Buf);
312 return NULL;
313 }
314
315 ExpandEnvironmentStrings(Buf, Expanded, ExpandedLen);
316
317 DPRINT("%S -> %S\n", Buf, Expanded);
318
319 pLogf = LogfCreate(LogName, Expanded);
320
321 if (pLogf == NULL)
322 {
323 DPRINT1("Failed to create %S!\n", Expanded);
324 }
325
326 HeapFree(MyHeap, 0, Buf);
327 HeapFree(MyHeap, 0, Expanded);
328 return pLogf;
329 }
330
331 BOOL LoadLogFiles(HKEY eventlogKey)
332 {
333 LONG result;
334 DWORD MaxLognameLen, LognameLen;
335 WCHAR *Buf = NULL;
336 INT i;
337 PLOGFILE pLogFile;
338
339 RegQueryInfoKey(eventlogKey,
340 NULL, NULL, NULL, NULL,
341 &MaxLognameLen,
342 NULL, NULL, NULL, NULL, NULL, NULL);
343
344 MaxLognameLen++;
345
346 Buf = HeapAlloc(MyHeap, 0, MaxLognameLen * sizeof(WCHAR));
347
348 if (!Buf)
349 {
350 DPRINT1("Error: can't allocate heap!\n");
351 return FALSE;
352 }
353
354 i = 0;
355 LognameLen = MaxLognameLen;
356
357 while (RegEnumKeyEx(eventlogKey,
358 i,
359 Buf,
360 &LognameLen,
361 NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
362 {
363 HKEY SubKey;
364
365 DPRINT("%S\n", Buf);
366
367 result = RegOpenKeyEx(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
368 if (result != ERROR_SUCCESS)
369 {
370 DPRINT1("Failed to open %S key.\n", Buf);
371 HeapFree(MyHeap, 0, Buf);
372 return FALSE;
373 }
374
375 pLogFile = LoadLogFile(SubKey, Buf);
376 if (pLogFile != NULL)
377 {
378 DPRINT("Loaded %S\n", Buf);
379 LoadEventSources(SubKey, pLogFile);
380 }
381 else
382 {
383 DPRINT1("Failed to load %S\n", Buf);
384 }
385
386 RegCloseKey(SubKey);
387 LognameLen = MaxLognameLen;
388 i++;
389 }
390
391 HeapFree(MyHeap, 0, Buf);
392 return TRUE;
393 }
394
395 INT wmain()
396 {
397 WCHAR LogPath[MAX_PATH];
398 INT RetCode = 0;
399 LONG result;
400 HKEY elogKey;
401
402 LogfListInitialize();
403 InitEventSourceList();
404
405 MyHeap = HeapCreate(0, 1024 * 256, 0);
406
407 if (!MyHeap)
408 {
409 DPRINT1("FATAL ERROR, can't create heap.\n");
410 RetCode = 1;
411 goto bye_bye;
412 }
413
414 GetWindowsDirectory(LogPath, MAX_PATH);
415
416 if (GetDriveType(LogPath) == DRIVE_CDROM)
417 {
418 DPRINT("LiveCD detected\n");
419 onLiveCD = TRUE;
420 }
421 else
422 {
423 result = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
424 L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
425 0,
426 KEY_ALL_ACCESS,
427 &elogKey);
428
429 if (result != ERROR_SUCCESS)
430 {
431 DPRINT1("Fatal error: can't open eventlog registry key.\n");
432 RetCode = 1;
433 goto bye_bye;
434 }
435
436 LoadLogFiles(elogKey);
437 }
438
439 StartServiceCtrlDispatcher(ServiceTable);
440
441 bye_bye:
442 LogfCloseAll();
443
444 if (MyHeap)
445 HeapDestroy(MyHeap);
446
447 return RetCode;
448 }
449
450 VOID EventTimeToSystemTime(DWORD EventTime, SYSTEMTIME * pSystemTime)
451 {
452 SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
453 FILETIME ftLocal;
454 union
455 {
456 FILETIME ft;
457 ULONGLONG ll;
458 } u1970, uUCT;
459
460 uUCT.ft.dwHighDateTime = 0;
461 uUCT.ft.dwLowDateTime = EventTime;
462 SystemTimeToFileTime(&st1970, &u1970.ft);
463 uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
464 FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
465 FileTimeToSystemTime(&ftLocal, pSystemTime);
466 }
467
468 VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
469 {
470 SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
471 union
472 {
473 FILETIME ft;
474 ULONGLONG ll;
475 } Time, u1970;
476
477 SystemTimeToFileTime(pSystemTime, &Time.ft);
478 SystemTimeToFileTime(&st1970, &u1970.ft);
479 *pEventTime = (DWORD)((Time.ll - u1970.ll) / 10000000ull);
480 }
481
482 VOID PRINT_HEADER(PEVENTLOGHEADER header)
483 {
484 DPRINT("HeaderSize = %d\n", header->HeaderSize);
485 DPRINT("Signature = 0x%x\n", header->Signature);
486 DPRINT("MajorVersion = %d\n", header->MajorVersion);
487 DPRINT("MinorVersion = %d\n", header->MinorVersion);
488 DPRINT("StartOffset = %d\n", header->StartOffset);
489 DPRINT("EndOffset = 0x%x\n", header->EndOffset);
490 DPRINT("CurrentRecordNumber = %d\n", header->CurrentRecordNumber);
491 DPRINT("OldestRecordNumber = %d\n", header->OldestRecordNumber);
492 DPRINT("MaxSize = 0x%x\n", header->MaxSize);
493 DPRINT("Retention = 0x%x\n", header->Retention);
494 DPRINT("EndHeaderSize = %d\n", header->EndHeaderSize);
495 DPRINT("Flags: ");
496 if (header->Flags & ELF_LOGFILE_HEADER_DIRTY) DPRINT("ELF_LOGFILE_HEADER_DIRTY");
497 if (header->Flags & ELF_LOGFILE_HEADER_WRAP) DPRINT("| ELF_LOGFILE_HEADER_WRAP ");
498 if (header->Flags & ELF_LOGGFILE_LOGFULL_WRITTEN) DPRINT("| ELF_LOGGFILE_LOGFULL_WRITTEN ");
499 if (header->Flags & ELF_LOGFILE_ARCHIVE_SET) DPRINT("| ELF_LOGFILE_ARCHIVE_SET ");
500 DPRINT("\n");
501 }
502
503 VOID PRINT_RECORD(PEVENTLOGRECORD pRec)
504 {
505 UINT i;
506 WCHAR *str;
507 SYSTEMTIME time;
508
509 DPRINT("Length = %d\n", pRec->Length);
510 DPRINT("Reserved = 0x%x\n", pRec->Reserved);
511 DPRINT("RecordNumber = %d\n", pRec->RecordNumber);
512
513 EventTimeToSystemTime(pRec->TimeGenerated, &time);
514 DPRINT("TimeGenerated = %d.%d.%d %d:%d:%d\n",
515 time.wDay, time.wMonth, time.wYear,
516 time.wHour, time.wMinute, time.wSecond);
517
518 EventTimeToSystemTime(pRec->TimeWritten, &time);
519 DPRINT("TimeWritten = %d.%d.%d %d:%d:%d\n",
520 time.wDay, time.wMonth, time.wYear,
521 time.wHour, time.wMinute, time.wSecond);
522
523 DPRINT("EventID = %d\n", pRec->EventID);
524
525 switch (pRec->EventType)
526 {
527 case EVENTLOG_ERROR_TYPE:
528 DPRINT("EventType = EVENTLOG_ERROR_TYPE\n");
529 break;
530 case EVENTLOG_WARNING_TYPE:
531 DPRINT("EventType = EVENTLOG_WARNING_TYPE\n");
532 break;
533 case EVENTLOG_INFORMATION_TYPE:
534 DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n");
535 break;
536 case EVENTLOG_AUDIT_SUCCESS:
537 DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n");
538 break;
539 case EVENTLOG_AUDIT_FAILURE:
540 DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n");
541 break;
542 default:
543 DPRINT("EventType = %d\n", pRec->EventType);
544 }
545
546 DPRINT("NumStrings = %d\n", pRec->NumStrings);
547 DPRINT("EventCategory = %d\n", pRec->EventCategory);
548 DPRINT("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
549 DPRINT("ClosingRecordNumber = %d\n", pRec->ClosingRecordNumber);
550 DPRINT("StringOffset = %d\n", pRec->StringOffset);
551 DPRINT("UserSidLength = %d\n", pRec->UserSidLength);
552 DPRINT("UserSidOffset = %d\n", pRec->UserSidOffset);
553 DPRINT("DataLength = %d\n", pRec->DataLength);
554 DPRINT("DataOffset = %d\n", pRec->DataOffset);
555
556 DPRINT("SourceName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD)));
557
558 i = (lstrlenW((WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD))) + 1) *
559 sizeof(WCHAR);
560
561 DPRINT("ComputerName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD) + i));
562
563 if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
564 {
565 DPRINT("Strings:\n");
566 str = (WCHAR *) (((PBYTE) pRec) + pRec->StringOffset);
567 for (i = 0; i < pRec->NumStrings; i++)
568 {
569 DPRINT("[%d] %S\n", i, str);
570 str = str + lstrlenW(str) + 1;
571 }
572 }
573
574 DPRINT("Length2 = %d\n", *(PDWORD) (((PBYTE) pRec) + pRec->Length - 4));
575 }