2 * PROJECT: ReactOS EventLog File Library
3 * LICENSE: GPL - See COPYING in the top level directory
4 * FILE: sdk/lib/evtlib/evtlib.h
5 * PURPOSE: Provides a library for reading and writing EventLog files
6 * in the NT <= 5.2 (.evt) format.
7 * PROGRAMMERS: Copyright 2005 Saveliy Tretiakov
15 /* PSDK/NDK Headers */
16 // #define WIN32_NO_STATUS
17 // #include <windef.h>
18 // #include <winbase.h>
21 #define NTOS_MODE_USER
22 #include <ndk/rtlfuncs.h>
25 #define ROUND_DOWN(n, align) (((ULONG)n) & ~((align) - 1l))
29 #define ROUND_UP(n, align) ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
33 * Our file format will be compatible with NT's
37 #define LOGFILE_SIGNATURE 0x654c664c // "LfLe"
40 * Flags used in the logfile header
42 #define ELF_LOGFILE_HEADER_DIRTY 1
43 #define ELF_LOGFILE_HEADER_WRAP 2
44 #define ELF_LOGFILE_LOGFULL_WRITTEN 4
45 #define ELF_LOGFILE_ARCHIVE_SET 8
48 * On-disk event log structures (log file header, event record and EOF record).
49 * NOTE: Contrary to what MSDN claims, both the EVENTLOGHEADER and EVENTLOGEOF
50 * structures are absent from winnt.h .
53 #include <pshpack4.h> // pshpack1
56 typedef struct _EVENTLOGHEADER
64 ULONG CurrentRecordNumber
;
65 ULONG OldestRecordNumber
;
70 } EVENTLOGHEADER
, *PEVENTLOGHEADER
;
73 /* Those flags and structure are defined in winnt.h */
77 #define EVENTLOG_SUCCESS 0
78 #define EVENTLOG_ERROR_TYPE 1
79 #define EVENTLOG_WARNING_TYPE 2
80 #define EVENTLOG_INFORMATION_TYPE 4
81 #define EVENTLOG_AUDIT_SUCCESS 8
82 #define EVENTLOG_AUDIT_FAILURE 16
84 typedef struct _EVENTLOGRECORD
86 ULONG Length
; /* Length of full record, including the data portion */
93 USHORT NumStrings
; /* Number of strings in the 'Strings' array */
96 ULONG ClosingRecordNumber
;
100 ULONG DataLength
; /* Length of the data portion */
101 ULONG DataOffset
; /* Offset from beginning of record */
103 * Length-varying data:
105 * WCHAR SourceName[];
106 * WCHAR ComputerName[];
107 * SID UserSid; // Must be aligned on a DWORD boundary
110 * CHAR Pad[]; // Padding for DWORD boundary
111 * ULONG Length; // Same as the first 'Length' member at the beginning
113 } EVENTLOGRECORD
, *PEVENTLOGRECORD
;
119 typedef struct _EVENTLOGEOF
121 ULONG RecordSizeBeginning
;
128 ULONG CurrentRecordNumber
;
129 ULONG OldestRecordNumber
;
131 } EVENTLOGEOF
, *PEVENTLOGEOF
;
133 #define EVENTLOGEOF_SIZE_FIXED (5 * sizeof(ULONG))
134 C_ASSERT(EVENTLOGEOF_SIZE_FIXED
== FIELD_OFFSET(EVENTLOGEOF
, BeginRecord
));
139 typedef struct _EVENT_OFFSET_INFO
143 } EVENT_OFFSET_INFO
, *PEVENT_OFFSET_INFO
;
145 #define TAG_ELF ' flE'
146 #define TAG_ELF_BUF 'BflE'
151 (NTAPI
*PELF_ALLOCATE_ROUTINE
)(
158 (NTAPI
*PELF_FREE_ROUTINE
)(
164 (NTAPI
*PELF_FILE_READ_ROUTINE
)(
165 IN
struct _EVTLOGFILE
* LogFile
,
166 IN PLARGE_INTEGER FileOffset
,
169 OUT PSIZE_T ReadLength OPTIONAL
173 (NTAPI
*PELF_FILE_WRITE_ROUTINE
)(
174 IN
struct _EVTLOGFILE
* LogFile
,
175 IN PLARGE_INTEGER FileOffset
,
178 OUT PSIZE_T WrittenLength OPTIONAL
182 (NTAPI
*PELF_FILE_SET_SIZE_ROUTINE
)(
183 IN
struct _EVTLOGFILE
* LogFile
,
189 (NTAPI
*PELF_FILE_FLUSH_ROUTINE
)(
190 IN
struct _EVTLOGFILE
* LogFile
,
191 IN PLARGE_INTEGER FileOffset
,
195 typedef struct _EVTLOGFILE
197 PELF_ALLOCATE_ROUTINE Allocate
;
198 PELF_FREE_ROUTINE Free
;
199 PELF_FILE_SET_SIZE_ROUTINE FileSetSize
;
200 PELF_FILE_WRITE_ROUTINE FileWrite
;
201 PELF_FILE_READ_ROUTINE FileRead
;
202 PELF_FILE_FLUSH_ROUTINE FileFlush
;
204 EVENTLOGHEADER Header
;
205 ULONG CurrentSize
; /* Equivalent to the file size, is <= MaxSize and can be extended to MaxSize if needed */
206 UNICODE_STRING FileName
;
207 PEVENT_OFFSET_INFO OffsetInfo
;
208 ULONG OffsetInfoSize
;
209 ULONG OffsetInfoNext
;
211 } EVTLOGFILE
, *PEVTLOGFILE
;
217 IN PEVTLOGFILE LogFile
,
218 IN PUNICODE_STRING FileName OPTIONAL
,
222 IN BOOLEAN CreateNew
,
224 IN PELF_ALLOCATE_ROUTINE Allocate
,
225 IN PELF_FREE_ROUTINE Free
,
226 IN PELF_FILE_SET_SIZE_ROUTINE FileSetSize
,
227 IN PELF_FILE_WRITE_ROUTINE FileWrite
,
228 IN PELF_FILE_READ_ROUTINE FileRead
,
229 IN PELF_FILE_FLUSH_ROUTINE FileFlush
); // What about Seek ??
234 IN PEVTLOGFILE LogFile
);
237 // ElfClearFile(PEVTLOGFILE LogFile);
242 IN PEVTLOGFILE LogFile
,
243 IN PEVTLOGFILE BackupLogFile
);
248 IN PEVTLOGFILE LogFile
);
252 ElfCloseFile( // ElfFree
253 IN PEVTLOGFILE LogFile
);
258 IN PEVTLOGFILE LogFile
,
259 IN ULONG RecordNumber
,
260 OUT PEVENTLOGRECORD Record
,
261 IN SIZE_T BufSize
, // Length
262 OUT PSIZE_T BytesRead OPTIONAL
,
263 OUT PSIZE_T BytesNeeded OPTIONAL
);
268 IN PEVTLOGFILE LogFile
,
269 IN PEVENTLOGRECORD Record
,
275 IN PEVTLOGFILE LogFile
);
280 IN PEVTLOGFILE LogFile
);
285 IN PEVTLOGFILE LogFile
);
288 VOID
PRINT_HEADER(PEVENTLOGHEADER Header
);
291 #endif /* __EVTLIB_H__ */