reactos/base/services/eventlog/eventlog.c

   1 /*
   2  * PROJECT:          ReactOS kernel
   3  * LICENSE:          GPL - See COPYING in the top level directory
   4  * FILE:             services/eventlog/eventlog.c
   5  * PURPOSE:          Event logging service
   6  * COPYRIGHT:        Copyright 2002 Eric Kohl
   7  *                   Copyright 2005 Saveliy Tretiakov
   8  */
   9
  10 /* INCLUDES *****************************************************************/
  11
  12 #include "eventlog.h"
  13
  14 /* GLOBALS ******************************************************************/
  15
  16 static VOID CALLBACK ServiceMain(DWORD, LPWSTR *);
  17 static WCHAR ServiceName[] = L"EventLog";
  18 static SERVICE_TABLE_ENTRYW ServiceTable[2] =
  19 {
  20     { ServiceName, ServiceMain },
  21     { NULL, NULL }
  22 };
  23
  24 SERVICE_STATUS ServiceStatus;
  25 SERVICE_STATUS_HANDLE ServiceStatusHandle;
  26
  27 BOOL onLiveCD = FALSE;  // On livecd events will go to debug output only
  28 HANDLE MyHeap = NULL;
  29
  30 /* FUNCTIONS ****************************************************************/
  31
  32 static VOID
  33 UpdateServiceStatus(DWORD dwState)
  34 {
  35     ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
  36     ServiceStatus.dwCurrentState = dwState;
  37     ServiceStatus.dwControlsAccepted = 0;
  38     ServiceStatus.dwWin32ExitCode = 0;
  39     ServiceStatus.dwServiceSpecificExitCode = 0;
  40     ServiceStatus.dwCheckPoint = 0;
  41
  42     if (dwState == SERVICE_START_PENDING ||
  43         dwState == SERVICE_STOP_PENDING ||
  44         dwState == SERVICE_PAUSE_PENDING ||
  45         dwState == SERVICE_CONTINUE_PENDING)
  46         ServiceStatus.dwWaitHint = 10000;
  47     else
  48         ServiceStatus.dwWaitHint = 0;
  49
  50     SetServiceStatus(ServiceStatusHandle,
  51                      &ServiceStatus);
  52 }
  53
  54 static DWORD WINAPI
  55 ServiceControlHandler(DWORD dwControl,
  56                       DWORD dwEventType,
  57                       LPVOID lpEventData,
  58                       LPVOID lpContext)
  59 {
  60     DPRINT("ServiceControlHandler() called\n");
  61
  62     switch (dwControl)
  63     {
  64         case SERVICE_CONTROL_STOP:
  65             DPRINT("  SERVICE_CONTROL_STOP received\n");
  66
  67             LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
  68                             0,
  69                             EVENT_EventlogStopped, 0, NULL, 0, NULL);
  70
  71
  72             /* Stop listening to incoming RPC messages */
  73             RpcMgmtStopServerListening(NULL);
  74             UpdateServiceStatus(SERVICE_STOPPED);
  75             return ERROR_SUCCESS;
  76
  77         case SERVICE_CONTROL_PAUSE:
  78             DPRINT("  SERVICE_CONTROL_PAUSE received\n");
  79             UpdateServiceStatus(SERVICE_PAUSED);
  80             return ERROR_SUCCESS;
  81
  82         case SERVICE_CONTROL_CONTINUE:
  83             DPRINT("  SERVICE_CONTROL_CONTINUE received\n");
  84             UpdateServiceStatus(SERVICE_RUNNING);
  85             return ERROR_SUCCESS;
  86
  87         case SERVICE_CONTROL_INTERROGATE:
  88             DPRINT("  SERVICE_CONTROL_INTERROGATE received\n");
  89             SetServiceStatus(ServiceStatusHandle,
  90                              &ServiceStatus);
  91             return ERROR_SUCCESS;
  92
  93         case SERVICE_CONTROL_SHUTDOWN:
  94             DPRINT("  SERVICE_CONTROL_SHUTDOWN received\n");
  95
  96             LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
  97                             0,
  98                             EVENT_EventlogStopped, 0, NULL, 0, NULL);
  99
 100             UpdateServiceStatus(SERVICE_STOPPED);
 101             return ERROR_SUCCESS;
 102
 103         default :
 104             DPRINT1("  Control %lu received\n");
 105             return ERROR_CALL_NOT_IMPLEMENTED;
 106     }
 107 }
 108
 109
 110 static DWORD
 111 ServiceInit(VOID)
 112 {
 113     HANDLE hThread;
 114
 115     hThread = CreateThread(NULL,
 116                            0,
 117                            (LPTHREAD_START_ROUTINE)
 118                             PortThreadRoutine,
 119                            NULL,
 120                            0,
 121                            NULL);
 122
 123     if (!hThread)
 124     {
 125         DPRINT("Can't create PortThread\n");
 126         return GetLastError();
 127     }
 128     else
 129         CloseHandle(hThread);
 130
 131     hThread = CreateThread(NULL,
 132                            0,
 133                            (LPTHREAD_START_ROUTINE)
 134                             RpcThreadRoutine,
 135                            NULL,
 136                            0,
 137                            NULL);
 138
 139     if (!hThread)
 140     {
 141         DPRINT("Can't create RpcThread\n");
 142         return GetLastError();
 143     }
 144     else
 145         CloseHandle(hThread);
 146
 147     return ERROR_SUCCESS;
 148 }
 149
 150
 151 static VOID
 152 ReportProductInfoEvent(VOID)
 153 {
 154     OSVERSIONINFOW versionInfo;
 155     WCHAR szBuffer[512];
 156     DWORD dwLength;
 157     HKEY hKey;
 158     DWORD dwValueLength;
 159     DWORD dwType;
 160     LONG lResult = ERROR_SUCCESS;
 161
 162     ZeroMemory(&versionInfo, sizeof(OSVERSIONINFO));
 163     versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
 164
 165     /* Get version information */
 166     if (!GetVersionExW(&versionInfo))
 167         return;
 168
 169     ZeroMemory(szBuffer, 512 * sizeof(WCHAR));
 170
 171     /* Write version into the buffer */
 172     dwLength = swprintf(szBuffer,
 173                         L"%lu.%lu",
 174                         versionInfo.dwMajorVersion,
 175                         versionInfo.dwMinorVersion) + 1;
 176
 177     /* Write build number into the buffer */
 178     dwLength += swprintf(&szBuffer[dwLength],
 179                          L"%lu",
 180                          versionInfo.dwBuildNumber) + 1;
 181
 182     /* Write service pack info into the buffer */
 183     wcscpy(&szBuffer[dwLength], versionInfo.szCSDVersion);
 184     dwLength += wcslen(versionInfo.szCSDVersion) + 1;
 185
 186     /* Read 'CurrentType' from the registry and write it into the buffer */
 187     lResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
 188                            L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
 189                            0,
 190                            KEY_QUERY_VALUE,
 191                            &hKey);
 192     if (lResult == ERROR_SUCCESS)
 193     {
 194         dwValueLength = 512 - dwLength;
 195         lResult = RegQueryValueEx(hKey,
 196                                   L"CurrentType",
 197                                   NULL,
 198                                   &dwType,
 199                                   (LPBYTE)&szBuffer[dwLength],
 200                                   &dwValueLength);
 201
 202         RegCloseKey(hKey);
 203     }
 204
 205     /* Log the product information */
 206     LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
 207                     0,
 208                     EVENT_EventLogProductInfo,
 209                     4,
 210                     szBuffer,
 211                     0,
 212                     NULL);
 213 }
 214
 215
 216 static VOID CALLBACK
 217 ServiceMain(DWORD argc,
 218             LPWSTR *argv)
 219 {
 220     DWORD dwError;
 221
 222     UNREFERENCED_PARAMETER(argc);
 223     UNREFERENCED_PARAMETER(argv);
 224
 225     DPRINT("ServiceMain() called\n");
 226
 227     ServiceStatusHandle = RegisterServiceCtrlHandlerExW(ServiceName,
 228                                                         ServiceControlHandler,
 229                                                         NULL);
 230     if (!ServiceStatusHandle)
 231     {
 232         dwError = GetLastError();
 233         DPRINT1("RegisterServiceCtrlHandlerW() failed! (Error %lu)\n", dwError);
 234         return;
 235     }
 236
 237     UpdateServiceStatus(SERVICE_START_PENDING);
 238
 239     dwError = ServiceInit();
 240     if (dwError != ERROR_SUCCESS)
 241     {
 242         DPRINT("Service stopped (dwError: %lu\n", dwError);
 243         UpdateServiceStatus(SERVICE_START_PENDING);
 244     }
 245     else
 246     {
 247         DPRINT("Service started\n");
 248         UpdateServiceStatus(SERVICE_RUNNING);
 249
 250         ReportProductInfoEvent();
 251
 252         LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
 253                         0,
 254                         EVENT_EventlogStarted,
 255                         0,
 256                         NULL,
 257                         0,
 258                         NULL);
 259     }
 260
 261     DPRINT("ServiceMain() done\n");
 262 }
 263
 264
 265 PLOGFILE LoadLogFile(HKEY hKey, WCHAR * LogName)
 266 {
 267     DWORD MaxValueLen, ValueLen, Type, ExpandedLen;
 268     WCHAR *Buf = NULL, *Expanded = NULL;
 269     LONG Result;
 270     PLOGFILE pLogf;
 271
 272     DPRINT("LoadLogFile: %S\n", LogName);
 273
 274     RegQueryInfoKey(hKey, NULL, NULL, NULL, NULL, NULL, NULL,
 275                     NULL, NULL, &MaxValueLen, NULL, NULL);
 276
 277     Buf = HeapAlloc(MyHeap, 0, MaxValueLen);
 278     if (!Buf)
 279     {
 280         DPRINT1("Can't allocate heap!\n");
 281         return NULL;
 282     }
 283
 284     ValueLen = MaxValueLen;
 285
 286     Result = RegQueryValueEx(hKey,
 287                              L"File",
 288                              NULL,
 289                              &Type,
 290                              (LPBYTE) Buf,
 291                              &ValueLen);
 292     if (Result != ERROR_SUCCESS)
 293     {
 294         DPRINT1("RegQueryValueEx failed: %d\n", GetLastError());
 295         HeapFree(MyHeap, 0, Buf);
 296         return NULL;
 297     }
 298
 299     if (Type != REG_EXPAND_SZ && Type != REG_SZ)
 300     {
 301         DPRINT1("%S\\File - value of wrong type %x.\n", LogName, Type);
 302         HeapFree(MyHeap, 0, Buf);
 303         return NULL;
 304     }
 305
 306     ExpandedLen = ExpandEnvironmentStrings(Buf, NULL, 0);
 307     Expanded = HeapAlloc(MyHeap, 0, ExpandedLen * sizeof(WCHAR));
 308     if (!Expanded)
 309     {
 310         DPRINT1("Can't allocate heap!\n");
 311         HeapFree(MyHeap, 0, Buf);
 312         return NULL;
 313     }
 314
 315     ExpandEnvironmentStrings(Buf, Expanded, ExpandedLen);
 316
 317     DPRINT("%S -> %S\n", Buf, Expanded);
 318
 319     pLogf = LogfCreate(LogName, Expanded);
 320
 321     if (pLogf == NULL)
 322     {
 323         DPRINT1("Failed to create %S!\n", Expanded);
 324     }
 325
 326     HeapFree(MyHeap, 0, Buf);
 327     HeapFree(MyHeap, 0, Expanded);
 328     return pLogf;
 329 }
 330
 331 BOOL LoadLogFiles(HKEY eventlogKey)
 332 {
 333     LONG result;
 334     DWORD MaxLognameLen, LognameLen;
 335     WCHAR *Buf = NULL;
 336     INT i;
 337     PLOGFILE pLogFile;
 338
 339     RegQueryInfoKey(eventlogKey,
 340                     NULL, NULL, NULL, NULL,
 341                     &MaxLognameLen,
 342                     NULL, NULL, NULL, NULL, NULL, NULL);
 343
 344     MaxLognameLen++;
 345
 346     Buf = HeapAlloc(MyHeap, 0, MaxLognameLen * sizeof(WCHAR));
 347
 348     if (!Buf)
 349     {
 350         DPRINT1("Error: can't allocate heap!\n");
 351         return FALSE;
 352     }
 353
 354     i = 0;
 355     LognameLen = MaxLognameLen;
 356
 357     while (RegEnumKeyEx(eventlogKey,
 358                         i,
 359                         Buf,
 360                         &LognameLen,
 361                         NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
 362     {
 363         HKEY SubKey;
 364
 365         DPRINT("%S\n", Buf);
 366
 367         result = RegOpenKeyEx(eventlogKey, Buf, 0, KEY_ALL_ACCESS, &SubKey);
 368         if (result != ERROR_SUCCESS)
 369         {
 370             DPRINT1("Failed to open %S key.\n", Buf);
 371             HeapFree(MyHeap, 0, Buf);
 372             return FALSE;
 373         }
 374
 375         pLogFile = LoadLogFile(SubKey, Buf);
 376         if (pLogFile != NULL)
 377         {
 378             DPRINT("Loaded %S\n", Buf);
 379             LoadEventSources(SubKey, pLogFile);
 380         }
 381         else
 382         {
 383             DPRINT1("Failed to load %S\n", Buf);
 384         }
 385
 386         RegCloseKey(SubKey);
 387         LognameLen = MaxLognameLen;
 388         i++;
 389     }
 390
 391     HeapFree(MyHeap, 0, Buf);
 392     return TRUE;
 393 }
 394
 395 INT wmain()
 396 {
 397     WCHAR LogPath[MAX_PATH];
 398     INT RetCode = 0;
 399     LONG result;
 400     HKEY elogKey;
 401
 402     LogfListInitialize();
 403     InitEventSourceList();
 404
 405     MyHeap = HeapCreate(0, 1024 * 256, 0);
 406
 407     if (!MyHeap)
 408     {
 409         DPRINT1("FATAL ERROR, can't create heap.\n");
 410         RetCode = 1;
 411         goto bye_bye;
 412     }
 413
 414     GetWindowsDirectory(LogPath, MAX_PATH);
 415
 416     if (GetDriveType(LogPath) == DRIVE_CDROM)
 417     {
 418         DPRINT("LiveCD detected\n");
 419         onLiveCD = TRUE;
 420     }
 421     else
 422     {
 423         result = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
 424                               L"SYSTEM\\CurrentControlSet\\Services\\EventLog",
 425                               0,
 426                               KEY_ALL_ACCESS,
 427                               &elogKey);
 428
 429         if (result != ERROR_SUCCESS)
 430         {
 431             DPRINT1("Fatal error: can't open eventlog registry key.\n");
 432             RetCode = 1;
 433             goto bye_bye;
 434         }
 435
 436         LoadLogFiles(elogKey);
 437     }
 438
 439     StartServiceCtrlDispatcher(ServiceTable);
 440
 441   bye_bye:
 442     LogfCloseAll();
 443
 444     if (MyHeap)
 445         HeapDestroy(MyHeap);
 446
 447     return RetCode;
 448 }
 449
 450 VOID EventTimeToSystemTime(DWORD EventTime, SYSTEMTIME * pSystemTime)
 451 {
 452     SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
 453     FILETIME ftLocal;
 454     union
 455     {
 456         FILETIME ft;
 457         ULONGLONG ll;
 458     } u1970, uUCT;
 459
 460     uUCT.ft.dwHighDateTime = 0;
 461     uUCT.ft.dwLowDateTime = EventTime;
 462     SystemTimeToFileTime(&st1970, &u1970.ft);
 463     uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
 464     FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
 465     FileTimeToSystemTime(&ftLocal, pSystemTime);
 466 }
 467
 468 VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
 469 {
 470     SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
 471     union
 472     {
 473         FILETIME ft;
 474         ULONGLONG ll;
 475     } Time, u1970;
 476
 477     SystemTimeToFileTime(pSystemTime, &Time.ft);
 478     SystemTimeToFileTime(&st1970, &u1970.ft);
 479     *pEventTime = (DWORD)((Time.ll - u1970.ll) / 10000000ull);
 480 }
 481
 482 VOID PRINT_HEADER(PEVENTLOGHEADER header)
 483 {
 484     DPRINT("HeaderSize = %d\n", header->HeaderSize);
 485     DPRINT("Signature = 0x%x\n", header->Signature);
 486     DPRINT("MajorVersion = %d\n", header->MajorVersion);
 487     DPRINT("MinorVersion = %d\n", header->MinorVersion);
 488     DPRINT("StartOffset = %d\n", header->StartOffset);
 489     DPRINT("EndOffset = 0x%x\n", header->EndOffset);
 490     DPRINT("CurrentRecordNumber = %d\n", header->CurrentRecordNumber);
 491     DPRINT("OldestRecordNumber = %d\n", header->OldestRecordNumber);
 492     DPRINT("MaxSize = 0x%x\n", header->MaxSize);
 493     DPRINT("Retention = 0x%x\n", header->Retention);
 494     DPRINT("EndHeaderSize = %d\n", header->EndHeaderSize);
 495     DPRINT("Flags: ");
 496     if (header->Flags & ELF_LOGFILE_HEADER_DIRTY)  DPRINT("ELF_LOGFILE_HEADER_DIRTY");
 497     if (header->Flags & ELF_LOGFILE_HEADER_WRAP)  DPRINT("| ELF_LOGFILE_HEADER_WRAP ");
 498     if (header->Flags & ELF_LOGGFILE_LOGFULL_WRITTEN)  DPRINT("| ELF_LOGGFILE_LOGFULL_WRITTEN ");
 499     if (header->Flags & ELF_LOGFILE_ARCHIVE_SET)  DPRINT("| ELF_LOGFILE_ARCHIVE_SET ");
 500     DPRINT("\n");
 501 }
 502
 503 VOID PRINT_RECORD(PEVENTLOGRECORD pRec)
 504 {
 505     UINT i;
 506     WCHAR *str;
 507     SYSTEMTIME time;
 508
 509     DPRINT("Length = %d\n", pRec->Length);
 510     DPRINT("Reserved = 0x%x\n", pRec->Reserved);
 511     DPRINT("RecordNumber = %d\n", pRec->RecordNumber);
 512
 513     EventTimeToSystemTime(pRec->TimeGenerated, &time);
 514     DPRINT("TimeGenerated = %d.%d.%d %d:%d:%d\n",
 515            time.wDay, time.wMonth, time.wYear,
 516            time.wHour, time.wMinute, time.wSecond);
 517
 518     EventTimeToSystemTime(pRec->TimeWritten, &time);
 519     DPRINT("TimeWritten = %d.%d.%d %d:%d:%d\n",
 520            time.wDay, time.wMonth, time.wYear,
 521            time.wHour, time.wMinute, time.wSecond);
 522
 523     DPRINT("EventID = %d\n", pRec->EventID);
 524
 525     switch (pRec->EventType)
 526     {
 527         case EVENTLOG_ERROR_TYPE:
 528             DPRINT("EventType = EVENTLOG_ERROR_TYPE\n");
 529             break;
 530         case EVENTLOG_WARNING_TYPE:
 531             DPRINT("EventType = EVENTLOG_WARNING_TYPE\n");
 532             break;
 533         case EVENTLOG_INFORMATION_TYPE:
 534             DPRINT("EventType = EVENTLOG_INFORMATION_TYPE\n");
 535             break;
 536         case EVENTLOG_AUDIT_SUCCESS:
 537             DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n");
 538             break;
 539         case EVENTLOG_AUDIT_FAILURE:
 540             DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n");
 541             break;
 542         default:
 543             DPRINT("EventType = %d\n", pRec->EventType);
 544     }
 545
 546     DPRINT("NumStrings = %d\n", pRec->NumStrings);
 547     DPRINT("EventCategory = %d\n", pRec->EventCategory);
 548     DPRINT("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
 549     DPRINT("ClosingRecordNumber = %d\n", pRec->ClosingRecordNumber);
 550     DPRINT("StringOffset = %d\n", pRec->StringOffset);
 551     DPRINT("UserSidLength = %d\n", pRec->UserSidLength);
 552     DPRINT("UserSidOffset = %d\n", pRec->UserSidOffset);
 553     DPRINT("DataLength = %d\n", pRec->DataLength);
 554     DPRINT("DataOffset = %d\n", pRec->DataOffset);
 555
 556     DPRINT("SourceName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD)));
 557
 558     i = (lstrlenW((WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD))) + 1) *
 559         sizeof(WCHAR);
 560
 561     DPRINT("ComputerName: %S\n", (WCHAR *) (((PBYTE) pRec) + sizeof(EVENTLOGRECORD) + i));
 562
 563     if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
 564     {
 565         DPRINT("Strings:\n");
 566         str = (WCHAR *) (((PBYTE) pRec) + pRec->StringOffset);
 567         for (i = 0; i < pRec->NumStrings; i++)
 568         {
 569             DPRINT("[%d] %S\n", i, str);
 570             str = str + lstrlenW(str) + 1;
 571         }
 572     }
 573
 574     DPRINT("Length2 = %d\n", *(PDWORD) (((PBYTE) pRec) + pRec->Length - 4));
 575 }