windows-server-2003/base/eventlog/eltest/eltest.c

/*++

Copyright (c) 1990  Microsoft Corporation

Module Name:

    ELTEST.C

Abstract:

    Test Routines for the EventLog.

THINGS I WANT THIS TO DO...
    AddReg <ServerName> <logname> <EntryName> <EventMessageFile>
        <CategoryMessageFile> <CategoryCount> <ParameterMessageFile>
        <TypesSupported>   - Creates A Registry Entry.

        eltest addreg application mytest mf= eltest.dll cat=

    CreateMessageFile <??? Is this possible ???>

    WriteEvent <ServerName> <EventSource> <Type> <Category> <EventId> <UserSid?>
        <NumStrings> <Strings> <RawData>

    ReadLog <Server> <LogFile> <ReadFlags> <RecordOffset> <bufSize>
        If LogFile isn't one of the popular ones, then it could be a backup
        logfile.

    GetNumEvents <Server> <LogFile>

    GetOldest <Server> <LogFile>

    Clear <Server> <LogFile>

    Backup <Server> <LogFile> <BackupFile>


    LOOPTESTS....
    I should be able to run this test like mprtest such that it doesn't leave
    the test process until told.  This way we can register an event source,
    then if we call WriteEvent without a specified EventSource, it will use
    the stored source.  Calling RegisterEventSource twice without calling
    DeRegisterSource would be an error.  (Or better yet, I could keep a table
    of sources and handles).

    RegisterEventSource <EventSource>
    DeRegisterSource <EventSource>




PROTOTYPES FOR FUNCTION....

BOOL
CloseEventLog (
    HANDLE hEventLog
    )
BOOL
DeregisterEventSource (
    HANDLE hEventLog
    )

BOOL
NotifyChangeEventLog(
    HANDLE  hEventLog,
    HANDLE  hEvent
    )
BOOL
GetNumberOfEventLogRecords (
    HANDLE hEventLog,
    PDWORD NumberOfRecords
    )
BOOL
GetOldestEventLogRecord (
    HANDLE hEventLog,
    PDWORD OldestRecord
    )
BOOL
ClearEventLogW (
    HANDLE hEventLog,
    LPCWSTR BackupFileName
    )
BOOL
BackupEventLogW (
    HANDLE hEventLog,
    LPCWSTR BackupFileName
    )
HANDLE
OpenEventLogW (
    LPCWSTR  UNCServerName,
    LPCWSTR  ModuleName
    )
HANDLE
RegisterEventSourceW (
    LPCWSTR  UNCServerName,
    LPCWSTR  ModuleName
    )
HANDLE
OpenBackupEventLogW (
    LPCWSTR  UNCServerName,
    LPCWSTR  FileName
    )
BOOL
ReadEventLogW (
    HANDLE      hEventLog,
    DWORD       dwReadFlags,
    DWORD       dwRecordOffset,
    LPVOID      lpBuffer,
    DWORD       nNumberOfBytesToRead,
    DWORD       *pnBytesRead,
    DWORD       *pnMinNumberOfBytesNeeded
    )
BOOL
ReportEventW (
    HANDLE      hEventLog,
    WORD        wType,
    WORD        wCategory       OPTIONAL,
    DWORD       dwEventID,
    PSID        lpUserSid       OPTIONAL,
    WORD        wNumStrings,
    DWORD       dwDataSize,
    LPCWSTR     *lpStrings      OPTIONAL,
    LPVOID      lpRawData       OPTIONAL
    )




Author:

    Dan Lafferty    (danl)  09-March-1994

Environment:

    User Mode - Win32

Revision History:

    09-Mar-1994     danl
        created

--*/

//
// INCLUDES
//
#define UNICODE 1
#include <nt.h>         // DbgPrint prototype
#include <ntrtl.h>      // DbgPrint prototype
#include <nturtl.h>     // needed for winbase.h


#include <stdlib.h>     // atoi
#include <stdio.h>      // printf
#include <conio.h>      // getch
#include <string.h>     // strcmp
#include <windows.h>    // win32 typedefs
#include <tstr.h>       // Unicode
#include <debugfmt.h>   // FORMAT_LPTSTR

//------------------
// DEFINES
//------------------
#define APPLICATION_LOG     "Application"
#define SYSTEM_LOG          "System"
#define SECURITY_LOG        "Security"

#define REG_APPLICATION_KEY "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\"
#define REG_SYSTEM_KEY      "SYSTEM\\CurrentControlSet\\Services\\EventLog\\System\\"
#define REG_SECURITY_KEY    "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Security\\"

#define EVENT_SOURCE_NAME       "tevent"
#define MSG_DLL                 "%SystemRoot%\\System32\\tevent.dll"

#define VALUE_EVENT_MF          TEXT("EventMessageFile")
#define VALUE_CATEGORY_MF       TEXT("CategoryMessageFile")
#define VALUE_PARAMETER_MF      TEXT("ParameterMessageFile")
#define VALUE_TYPES_SUPPORTED   TEXT("TypesSupported")
#define VALUE_CATEGORY_COUNT    TEXT("CategoryCount")

#define TYPES_SUPPORTED        (EVENTLOG_ERROR_TYPE     |   \
                                EVENTLOG_WARNING_TYPE   |   \
                                EVENTLOG_INFORMATION_TYPE)
//----------------------
// GLOBALS
//----------------------
    LPTSTR  ApplLogRegName=TEXT(REG_APPLICATION_KEY);
    LPTSTR  SysLogRegName =TEXT(REG_SYSTEM_KEY);
    LPTSTR  SecLogRegName =TEXT(REG_SECURITY_KEY);
    LPTSTR  ApplLogName   = TEXT(APPLICATION_LOG);
    LPTSTR  SysLogName    = TEXT(SYSTEM_LOG);
    LPTSTR  SecLogName    = TEXT(SECURITY_LOG);

//----------------------
// FUNCTION PROTOTYPES
//----------------------

VOID
AddRegUsage(VOID);

DWORD
AddSourceToRegistry(
    IN  LPTSTR  ServerName,
    IN  LPTSTR  LogName,
    IN  LPTSTR  EventSourceName,
    IN  LPTSTR  *argv,
    IN  DWORD   argc
    );

BOOL
ConvertToUnicode(
    OUT LPWSTR  *UnicodeOut,
    IN  LPSTR   AnsiIn
    );

DWORD
DelSourceInRegistry(
    IN  LPTSTR  ServerName,
    IN  LPTSTR  LogName,
    IN  LPTSTR  EventSourceName
    );

VOID
DisplayStatus (
    IN  LPTSTR              ServiceName,
    IN  LPTSTR              DisplayName,
    IN  LPSERVICE_STATUS    ServiceStatus
    );

BOOL
MakeArgsUnicode (
    DWORD           argc,
    PCHAR           argv[]
    );

BOOL
ProcessArgs (
    LPTSTR      ServerName,
    DWORD       argc,
    LPTSTR      argv[]
    );

VOID
Usage(
    VOID);

VOID
ConfigUsage(VOID);

VOID
CreateUsage(VOID);

VOID
QueryUsage(VOID);

LONG
wtol(
    IN LPWSTR string
    );

VOID
UserInputLoop(
    LPTSTR  ServerName
    );
DWORD
ReadLogFile(
    LPTSTR  ServerName,
    LPTSTR  LogName,
    IN  LPTSTR  *argv,
    IN  DWORD   argc
    );
VOID
ReadLogUsage(VOID);

VOID
DisplayRecord(
    PEVENTLOGRECORD     pElRecord,
    BOOL                PrintTheHeader
    );

/****************************************************************************/
VOID __cdecl
main (
    DWORD           argc,
    PCHAR           argvAnsi[]
    )

/*++

Routine Description:

    Allows manual testing of the EVENTLOG API.

        eltest



Arguments:



Return Value:



--*/
{
    UCHAR   i;
    DWORD   j;
    DWORD   argIndex;
    LPTSTR  pServerName=NULL;
    LPTSTR  *argv;

    if (argc <2) {
        Usage();
        return;
    }

    //
    // Make the arguments unicode if necessary.
    //
#ifdef UNICODE
    if (!MakeArgsUnicode(argc, argvAnsi)) {
        return;
    }
#endif

    argv = (LPTSTR *)argvAnsi;

    argIndex = 1;
    if (STRNCMP (argv[1], TEXT("\\\\"), 2) == 0) {
        pServerName = argv[1];
        argIndex = 2;               // skip over servername.
    }

    //
    // Check to see if we are to run in Loop Mode, or in single function
    // mode.  In Loop Mode, we go into a loop, and ask the user for
    // input until the user decides to quit.
    //
    // Process Arguments:
    //
    // INDEX   0       1            2              3
    //         EL <ServerName> <Function> <FunctionOptions...>
    //

    if (STRICMP (argv[argIndex], TEXT("Loop")) == 0) {
        UserInputLoop(pServerName);
    }
    else {
        ProcessArgs(pServerName, argc-argIndex, &(argv[argIndex]));
    }


#ifdef UNICODE
    //
    // Free up the unicode strings if there are any
    //
    for(j=0; j<argc; j++) {
        LocalFree(argv[j]);
    }
#endif

    return;
}

VOID
UserInputLoop(
    LPTSTR  ServerName
    )

/*++

Routine Description:

    This function sits in a loop, gathering input from the user, and
    processing that input until the user indicates that it should stop.
    The following user commands indicate that we should stop:
        done
        exit
        stop
        quit

Arguments:


Return Value:


--*/
{
    UCHAR   i;
    DWORD   j;
    LPTSTR  *argv;
    UCHAR   buffer[255];
    LPSTR   argvA[20];
    DWORD   argc=0;
    BOOL    KeepGoing;

    do {
        //------------------------------
        // Get input from the user
        //------------------------------
        buffer[0] = 90-2;

        printf("\nwaiting for instructions... \n");
        _cgets(buffer);

        if (buffer[1] > 0) {
            //--------------------------------------
            // put the string in argv/argc format.
            //--------------------------------------
            buffer[1]+=2;       // make this an end offset
            argc=0;
            for (i=2,j=0; i<buffer[1]; i++,j++) {
                argc++;
                argvA[j] = &(buffer[i]);
                while ((buffer[i] != ' ') && (buffer[i] != '\0')) {
                    i++;
                }
                buffer[i] = '\0';
            }

            //------------------------------------------
            // Make the arguments unicode if necessary.
            //------------------------------------------
#ifdef UNICODE

            if (!MakeArgsUnicode(argc, argvA)) {
                return;
            }

#endif
            //-----------------------------------------------
            // If the first argument doesn't indicate that
            // we should stop, then process the arguments.
            //-----------------------------------------------
            argv = (LPTSTR *)argvA;

            if((STRICMP (argv[0], TEXT("done")) == 0) ||
               (STRICMP (argv[0], TEXT("stop")) == 0) ||
               (STRICMP (argv[0], TEXT("exit")) == 0) ||
               (STRICMP (argv[0], TEXT("quit")) == 0)) {
                KeepGoing  = FALSE;
            }
            else {
                KeepGoing = ProcessArgs(ServerName, argc, argv);
            }

#ifdef UNICODE
            //-----------------------------------------------
            // Free up the unicode strings if there are any
            //-----------------------------------------------
            for(j=0; j<argc; j++) {
                LocalFree(argv[j]);
            }
#endif
        }
    } while (KeepGoing);

    return;

}

/****************************************************************************/
BOOL
ProcessArgs (
    LPTSTR      ServerName,
    DWORD       argc,
    LPTSTR      argv[]
    )

/*++

Routine Description:


Arguments:



Return Value:



--*/

{
    DWORD           status;
    DWORD           specialFlag = FALSE;
    DWORD           argIndex;       // index to unchecked portion of arglist.


    argIndex = 0;

    //
    // If we are adding a registry entry, the get a handle to it.
    // Otherwise, get a handle to the LogFile.
    //
    //-----------------------
    // AddSourceToRegistry
    //-----------------------
    if (STRICMP (argv[argIndex], TEXT("AddReg")) == 0 ) {

        //
        // Must have at least "AddReg logname EntryName"
        //
        if (argc < (argIndex + 3)) {
            AddRegUsage();
            goto CleanExit;
        }

        status = AddSourceToRegistry(
                    ServerName,
                    argv[argIndex+1],    // LogName
                    argv[argIndex+2],    // SourceName
                    &argv[argIndex+1],
                    argc-(argIndex+2)
                    );
    }
    //-----------------------
    // DeleteFromRegistry
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("DelReg")) == 0) {
        //
        // Must have at least "DelReg logname EntryName"
        //
        if (argc < (argIndex + 3)) {
            goto CleanExit;
        }

        status = DelSourceInRegistry(
                    ServerName,
                    argv[argIndex+1],    // LogName
                    argv[argIndex+2]     // SourceName
                    );

    }
    //-----------------------
    // WriteEvent
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("WriteEvent")) == 0) {
        printf("In WriteEvent\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //-----------------------
    // ReadLog
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("ReadLog")) == 0) {
        printf("In ReadLog\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
        //
        // Must have at least "ReadLog logname"
        //
        if (argc < (argIndex + 2)) {
            ReadLogUsage();
            goto CleanExit;
        }

        status = ReadLogFile(
                    ServerName,         // ServerName
                    argv[argIndex+1],   // LogName
                    &argv[argIndex+1],  // argv
                    argc-(argIndex+1)); // argc
    }
    //-----------------------
    // GetNumEvents
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("GetNumEvents")) == 0) {
        printf("in GetNumEvents\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //-----------------------
    // GetOldest
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("GetOldest")) == 0) {
        printf("in GetOldest\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //-----------------------
    // ClearLog
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("ClearLog")) == 0) {
        printf("in ClearLog\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //-----------------------
    // Backup
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("Backup")) == 0) {
        printf("in Backup\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //-----------------------
    // RegisterSource
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("RegisterSource")) == 0) {
        printf("in RegisterSource\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //-----------------------
    // DeRegisterSource
    //-----------------------
    else if (STRICMP (argv[argIndex], TEXT("DeRegisterSource")) == 0) {
        printf("in DeRegisterSource\n");
        if (ServerName != NULL) {
            printf("ServerName = "FORMAT_LPTSTR"\n",ServerName);
        }
    }
    //****************
    // Exit Program
    //****************
    else if (STRICMP (argv[0], TEXT("Exit")) == 0) {
        //
        // THIS SHOULD CLOSE HANDLES.
        //
        return(FALSE);
    }
    else {
        printf("Bad argument\n");
        Usage();
    }

CleanExit:


    return(TRUE);
}



BOOL
MakeArgsUnicode (
    DWORD           argc,
    PCHAR           argv[]
    )


/*++

Routine Description:


Arguments:


Return Value:


Note:


--*/
{
    DWORD   i;

    //
    // ScConvertToUnicode allocates storage for each string.
    // We will rely on process termination to free the memory.
    //
    for(i=0; i<argc; i++) {

        if(!ConvertToUnicode( (LPWSTR *)&(argv[i]), argv[i])) {
            printf("Couldn't convert argv[%d] to unicode\n",i);
            return(FALSE);
        }


    }
    return(TRUE);
}

BOOL
ConvertToUnicode(
    OUT LPWSTR  *UnicodeOut,
    IN  LPSTR   AnsiIn
    )

/*++

Routine Description:

    This function translates an AnsiString into a Unicode string.
    A new string buffer is created by this function.  If the call to
    this function is successful, the caller must take responsibility for
    the unicode string buffer that was allocated by this function.
    The allocated buffer should be free'd with a call to LocalFree.

    NOTE:  This function allocates memory for the Unicode String.

Arguments:

    AnsiIn - This is a pointer to an ansi string that is to be converted.

    UnicodeOut - This is a pointer to a location where the pointer to the
        unicode string is to be placed.

Return Value:

    TRUE - The conversion was successful.

    FALSE - The conversion was unsuccessful.  In this case a buffer for
        the unicode string was not allocated.

--*/
{

    NTSTATUS        ntStatus;
    DWORD           bufSize;
    UNICODE_STRING  unicodeString;
    ANSI_STRING     ansiString;

    //
    // Allocate a buffer for the unicode string.
    //

    bufSize = (strlen(AnsiIn)+1) * sizeof(WCHAR);

    *UnicodeOut = (LPWSTR)LocalAlloc(LMEM_ZEROINIT, (UINT)bufSize);

    if (*UnicodeOut == NULL) {
        printf("ScConvertToUnicode:LocalAlloc Failure %ld\n",GetLastError());
        return(FALSE);
    }

    //
    // Initialize the string structures
    //
    RtlInitAnsiString( &ansiString, AnsiIn);

    unicodeString.Buffer = *UnicodeOut;
    unicodeString.MaximumLength = (USHORT)bufSize;
    unicodeString.Length = 0;

    //
    // Call the conversion function.
    //
    ntStatus = RtlAnsiStringToUnicodeString (
                &unicodeString,     // Destination
                &ansiString,        // Source
                (BOOLEAN)FALSE);    // Allocate the destination

    if (!NT_SUCCESS(ntStatus)) {

        printf("ScConvertToUnicode:RtlAnsiStringToUnicodeString Failure %lx\n",
        ntStatus);

        return(FALSE);
    }

    //
    // Fill in the pointer location with the unicode string buffer pointer.
    //
    *UnicodeOut = unicodeString.Buffer;

    return(TRUE);

}

/****************************************************************************/
VOID
DisplayStatus (
    IN  LPTSTR              ServiceName,
    IN  LPTSTR              DisplayName,
    IN  LPSERVICE_STATUS    ServiceStatus
    )

/*++

Routine Description:

    Displays the service name and  the service status.

    |
    |SERVICE_NAME: messenger
    |DISPLAY_NAME: messenger
    |        TYPE       : WIN32
    |        STATE      : ACTIVE,STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN
    |        EXIT_CODE  : 0xC002001
    |        CHECKPOINT : 0x00000001
    |        WAIT_HINT  : 0x00003f21
    |

Arguments:

    ServiceName - This is a pointer to a string containing the name of
        the service.

    DisplayName - This is a pointer to a string containing the display
        name for the service.

    ServiceStatus - This is a pointer to a SERVICE_STATUS structure from
        which information is to be displayed.

Return Value:

    none.

--*/
{

    printf("\nSERVICE_NAME: "FORMAT_LPTSTR"\n", ServiceName);
    if (DisplayName != NULL) {
        printf("DISPLAY_NAME: "FORMAT_LPTSTR"\n", DisplayName);
    }

    printf("        TYPE               : %lx  ", ServiceStatus->dwServiceType);

    switch(ServiceStatus->dwServiceType){
    case SERVICE_WIN32_OWN_PROCESS:
        printf("WIN32_OWN_PROCESS \n");
        break;
    case SERVICE_WIN32_SHARE_PROCESS:
        printf("WIN32_SHARE_PROCESS \n");
        break;
    case SERVICE_WIN32:
        printf("WIN32 \n");
        break;
    case SERVICE_ADAPTER:
        printf("ADAPTER \n");
        break;
    case SERVICE_KERNEL_DRIVER:
        printf("KERNEL_DRIVER \n");
        break;
    case SERVICE_FILE_SYSTEM_DRIVER:
        printf("FILE_SYSTEM_DRIVER \n");
        break;
    case SERVICE_DRIVER:
        printf("DRIVER \n");
        break;
    default:
        printf(" ERROR \n");
    }

    printf("        STATE              : %lx  ", ServiceStatus->dwCurrentState);

    switch(ServiceStatus->dwCurrentState){
        case SERVICE_STOPPED:
            printf("STOPPED ");
            break;
        case SERVICE_START_PENDING:
            printf("START_PENDING ");
            break;
        case SERVICE_STOP_PENDING:
            printf("STOP_PENDING ");
            break;
        case SERVICE_RUNNING:
            printf("RUNNING ");
            break;
        case SERVICE_CONTINUE_PENDING:
            printf("CONTINUE_PENDING ");
            break;
        case SERVICE_PAUSE_PENDING:
            printf("PAUSE_PENDING ");
            break;
        case SERVICE_PAUSED:
            printf("PAUSED ");
            break;
        default:
            printf(" ERROR ");
    }

    //
    // Print Controls Accepted Information
    //

    if (ServiceStatus->dwControlsAccepted & SERVICE_ACCEPT_STOP) {
        printf("\n                                (STOPPABLE,");
    }
    else {
        printf("\n                                (NOT_STOPPABLE,");
    }

    if (ServiceStatus->dwControlsAccepted & SERVICE_ACCEPT_PAUSE_CONTINUE) {
        printf("PAUSABLE,");
    }
    else {
        printf("NOT_PAUSABLE,");
    }

    if (ServiceStatus->dwControlsAccepted & SERVICE_ACCEPT_SHUTDOWN) {
        printf("ACCEPTS_SHUTDOWN)\n");
    }
    else {
        printf("IGNORES_SHUTDOWN)\n");
    }

    //
    // Print Exit Code
    //
    printf("        WIN32_EXIT_CODE    : %d\t(0x%lx)\n",
        ServiceStatus->dwWin32ExitCode,
        ServiceStatus->dwWin32ExitCode);
    printf("        SERVICE_EXIT_CODE  : %d\t(0x%lx)\n",
        ServiceStatus->dwServiceSpecificExitCode,
        ServiceStatus->dwServiceSpecificExitCode  );

    //
    // Print CheckPoint & WaitHint Information
    //

    printf("        CHECKPOINT         : 0x%lx\n", ServiceStatus->dwCheckPoint);
    printf("        WAIT_HINT          : 0x%lx\n", ServiceStatus->dwWaitHint  );

    return;
}

VOID
Usage(
    VOID)
{
    printf("DESCRIPTION:\n");
    printf("\tEL is a command line program used for testing the eventlog \n");
    printf("USAGE:\n");
    printf("\tEL <ServerName> [Function] <FunctionOptions...> \n\n");
    printf("\tThe option <server> has the form \"\\\\ServerName\"\n");
    printf("\tFurther help on Functions can be obtained by typing: \"el [Function]\"\n");
    printf("\tFunctions:\n"
           "\t  AddReg-----------Creates a registry entry for an event source.\n"
           "\t  DelReg-----------Deletes a registry entry.\n"
           "\t  WriteEvent-------Writes an event.\n"
           "\t  ReadLog----------Reads from the logfile.\n"
           "\t  GetNumEvents-----Gets the number of events in the specified log.\n"
           "\t  GetOldest--------Gets the record number for the oldest record"
           "\t                   in the log\n"
           "\t  ClearLog---------Clears the specified Log.\n"
           "\t  Backup-----------Copies the specified log to a new file.\n"
           "\t  RegisterSource---Registers a name for the event source.\n"
           "\t                   The handle is stored internally.\n"
           "\t  DeRegisterSource-Closes handle opened with RegSource.\n"
           "\t  NotifyChange-----A thread is created which gets notified of EL changes.\n");

    printf("\n");
}

VOID
AddRegUsage(VOID)
{

    printf("\nAdds a subkey under one of the logfiles listed in the registry.\n");
    printf("SYNTAX: \n  eltest addreg <ServerName> logfile <SubKeyName> <option1> <option2>...\n");
    printf("ADDREG OPTIONS:\n");
    printf("NOTE: The option name includes the equal sign.\n");

    printf("    MsgFile=    Name of Event Message File\n"
           "    CatFile=    Name of Category Message File\n"
           "    ParamFile=  Name of Parameter Message File\n"
           "    CatCount=   Category Count\n"
           "    Type=       <error|warning|information|AuditSuccess|AuditFailure|All>\n");
    printf("EXAMPLE:\n   eltest addreg application myapp MsgFile= MyMsgs.dll"
           " Type= error Type= warning\n");

}

VOID
ConfigUsage(VOID)
{
    printf("Modifies a service entry in the registry and Service Database.\n");
    printf("SYNTAX: \nsc config <service> <option1> <option2>...\n");
    printf("CONFIG OPTIONS:\n");
    printf("NOTE: The option name includes the equal sign.\n"
        " type= <own|share|kernel|filesys|rec|adapt|error>\n"
        " start= <boot|system|auto|demand|disabled|error>\n"
        " error= <normal|severe|critical|error|ignore>\n"
        " binPath= <BinaryPathName>\n"
        " group= <LoadOrderGroup>\n"
        " tag= <yes|no>\n"
        " depend= <Dependencies(space seperated)>\n"
        " obj= <AccountName|ObjectName>\n"
        " DisplayName= <display name>\n"
        " password= <password> \n");
}
VOID
CreateUsage(VOID)
{
    printf("Creates a service entry in the registry and Service Database.\n");
    printf("SYNTAX: \nsc create <service> <option1> <option2>...\n");
    printf("CREATE OPTIONS:\n");
    printf("NOTE: The option name includes the equal sign.\n"
        " type= <own|share|kernel|filesys|rec|error>\n"
        " start= <boot|system|auto|demand|disabled|error>\n"
        " error= <normal|severe|critical|error|ignore>\n"
        " binPath= <BinaryPathName>\n"
        " group= <LoadOrderGroup>\n"
        " tag= <yes|no>\n"
        " depend= <Dependencies(space seperated)>\n"
        " obj= <AccountName|ObjectName>\n"
        " DisplayName= <display name>\n"
        " password= <password> \n");
}

VOID
ReadLogUsage(VOID)
{

    printf("\nReads a logfile and dumps the contents.\n");
    printf("SYNTAX: \n  eltest readlog <ServerName> logfile <option1> <option2>...\n");
    printf("READLOG OPTIONS:\n");
    printf("NOTE: The option name includes the equal sign.\n");

    printf("    ReadFlag=  <fwd|back|seek|seq> (default = fwd) \n"
           "    RecordNum=  record number where read should start (default=0)\n"
           "    BufSize=    size of the buffer (default = 10000)\n");
    printf("EXAMPLE:\n   eltest addreg application myapp MsgFile= MyMsgs.dll"
           " Type= error Type= warning\n");
}

DWORD
AddSourceToRegistry(
    IN  LPTSTR  ServerName,
    IN  LPTSTR  LogName,
    IN  LPTSTR  EventSourceName,
    IN  LPTSTR  *argv,
    IN  DWORD   argc
    )

/*++

Routine Description:

    This function writes to the registry all the information to register
    this application as an event source.

Arguments:


Return Value:


--*/
{
    TCHAR   tempName[MAX_PATH];
    HKEY    hKey;
    DWORD   dwStatus=NO_ERROR;
    HKEY    hRegistry=HKEY_LOCAL_MACHINE;

    LPTSTR  EventMessageFile=NULL;
    LPTSTR  CategoryMessageFile=NULL;
    LPTSTR  ParameterMessageFile=NULL;
    DWORD   dwTypes=0;
    DWORD   dwCategoryCount=0;
    DWORD   i;

    //
    // Look at the LogName, and generate the appropriate registry key
    // path for that log.
    //
    if (STRICMP(LogName, ApplLogName) == 0) {
        STRCPY(tempName, ApplLogRegName);
    }
    else if (STRICMP(LogName, SysLogName) == 0) {
        STRCPY(tempName, SysLogRegName);
    }
    else if (STRICMP(LogName, SecLogName) == 0) {
        STRCPY(tempName, SecLogRegName);
    }
    else {
        printf("AddSourceToRegistry: Invalid LogName\n");
        return(ERROR_INVALID_PARAMETER);
    }
    STRCAT(tempName, EventSourceName);


    //
    // Get Variable Arguments
    //
    for (i=0; i<argc ;i++ ) {
        if (STRICMP(argv[i], TEXT("EventMsgFile=")) == 0) {
            EventMessageFile = argv[i+1];
            i++;
        }
        if (STRICMP(argv[i], TEXT("CategoryMsgFile=")) == 0) {
            CategoryMessageFile = argv[i+1];
            i++;
        }
        if (STRICMP(argv[i], TEXT("ParameterMsgFile=")) == 0) {
            ParameterMessageFile = argv[i+1];
            i++;
        }
        if (STRICMP(argv[i], TEXT("Type=")) == 0) {
            //--------------------------------------------------------
            // We want to allow for several arguments of type= in the
            // same line.  These should cause the different arguments
            // to be or'd together.
            //--------------------------------------------------------
            if (STRICMP(argv[i+1],TEXT("error")) == 0) {
                dwTypes |= EVENTLOG_ERROR_TYPE;
            }
            if (STRICMP(argv[i+1],TEXT("warning")) == 0) {
                dwTypes |= EVENTLOG_WARNING_TYPE;
            }
            if (STRICMP(argv[i+1],TEXT("information")) == 0) {
                dwTypes |= EVENTLOG_INFORMATION_TYPE;
            }
            if (STRICMP(argv[i+1],TEXT("AuditSuccess")) == 0) {
                dwTypes |= EVENTLOG_AUDIT_SUCCESS;
            }
            if (STRICMP(argv[i+1],TEXT("AuditFailure")) == 0) {
                dwTypes |= EVENTLOG_AUDIT_FAILURE;
            }
            if (STRICMP(argv[i+1],TEXT("All")) == 0) {
                dwTypes |= (EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE |
                            EVENTLOG_INFORMATION_TYPE | EVENTLOG_AUDIT_SUCCESS |
                            EVENTLOG_AUDIT_FAILURE);
            }
            else {
                printf("Invalid Type\n");
                AddRegUsage();
                return(ERROR_INVALID_PARAMETER);
            }
            i++;
        }
        if (STRICMP(argv[i], TEXT("CategoryCount=")) == 0) {
            dwCategoryCount = ATOL(argv[i+1]);
            i++;
        }

    }

    //
    // Connect to the registry on the correct machine.
    //
    printf("Connect to Registry\n");
    dwStatus = RegConnectRegistry(ServerName, HKEY_LOCAL_MACHINE, &hRegistry);
    if (dwStatus != NO_ERROR) {
        printf("RegConnectRegistry Failed %d\n",GetLastError());
        return(dwStatus);
    }

    //
    // Create the new key for this source
    //
    printf("Create Key\n");
    dwStatus = RegCreateKey(hRegistry, tempName, &hKey);
    if (dwStatus != ERROR_SUCCESS) {
        printf("Couldn't create Source Key in registry %d\n",dwStatus);
        return(dwStatus);
    }
    if (EventMessageFile != NULL) {
        printf("Set EventMessageFile\n");
        dwStatus = RegSetValueEx(
                hKey,
                VALUE_EVENT_MF,
                0,
                REG_EXPAND_SZ,
                (LPBYTE)EventMessageFile,
                STRLEN(EventMessageFile) + sizeof(TCHAR));

        if (dwStatus != ERROR_SUCCESS) {
            printf("RegSetValue (messageFile) failed %d\n",GetLastError());
            goto CleanExit;
        }
    }
    //
    // Set the Category Message File
    //
    if (CategoryMessageFile != NULL) {
        printf("Set Category Message File\n");
        dwStatus = RegSetValueEx(
                hKey,
                VALUE_CATEGORY_MF,
                0,
                REG_EXPAND_SZ,
                (LPBYTE)CategoryMessageFile,
                STRLEN(CategoryMessageFile) + sizeof(TCHAR));

        if (dwStatus != ERROR_SUCCESS) {
            printf("RegSetValue (category mf) failed %d\n",GetLastError());
            goto CleanExit;
        }
    }

    //
    // Set the Parameter Message File
    //
    if (ParameterMessageFile != NULL) {
        printf("Set Parameter Message File\n");
        dwStatus = RegSetValueEx(
                hKey,
                VALUE_PARAMETER_MF,
                0,
                REG_EXPAND_SZ,
                (LPBYTE)ParameterMessageFile,
                STRLEN(ParameterMessageFile) + sizeof(TCHAR));

        if (dwStatus != ERROR_SUCCESS) {
            printf("RegSetValue (Parameter mf) failed %d\n",GetLastError());
            goto CleanExit;
        }
    }

    //
    // Set the Types Supported
    //
    if (dwTypes != 0) {
        printf("Set Types Supported\n");
        dwStatus = RegSetValueEx(
                hKey,
                VALUE_TYPES_SUPPORTED,
                0,
                REG_DWORD,
                (LPBYTE) &dwTypes,
                sizeof(DWORD));

        if (dwStatus != ERROR_SUCCESS) {
            printf("RegSetValue (TypesSupported) failed %d\n",GetLastError());
            goto CleanExit;
        }

    }

    //
    // Set the Category Count
    //
    if (dwCategoryCount != 0) {
        printf("Set CategoryCount\n");
        dwStatus = RegSetValueEx(
                hKey,
                VALUE_CATEGORY_COUNT,
                0,
                REG_DWORD,
                (LPBYTE) &dwCategoryCount,
                sizeof(DWORD));

        if (dwStatus != ERROR_SUCCESS) {
            printf("RegSetValue (CategoryCount) failed %d\n",GetLastError());
            goto CleanExit;
        }
    }
    dwStatus = NO_ERROR;
CleanExit:
    RegCloseKey(hKey);
    RegCloseKey(hRegistry);
    return(dwStatus);
}

DWORD
DelSourceInRegistry(
    IN  LPTSTR  ServerName,
    IN  LPTSTR  LogName,
    IN  LPTSTR  EventSourceName
    )

/*++

Routine Description:

    This function writes to the registry all the information to register
    this application as an event source.

Arguments:


Return Value:


--*/
{
    LPTSTR  tempName;
    HKEY    hParentKey;
    BOOL    status=FALSE;
    DWORD   dwStatus;
    HKEY    hRegistry=HKEY_LOCAL_MACHINE;


    //
    // Look at the LogName, and generate the appropriate registry key
    // path for that log.
    //
    if (STRICMP(LogName, ApplLogName) == 0) {
        tempName = ApplLogRegName;
    }
    else if (STRICMP(LogName, SysLogName) == 0) {
        tempName = SysLogRegName;
    }
    else if (STRICMP(LogName, SecLogName) == 0) {
        tempName = SecLogRegName;
    }
    else {
        printf("AddSourceToRegistry: Invalid LogName\n");
        return(ERROR_INVALID_PARAMETER);
    }

    //
    // Connect to the registry on the correct machine.
    //
    dwStatus = RegConnectRegistry(ServerName, HKEY_LOCAL_MACHINE, &hRegistry);
    if (dwStatus != NO_ERROR) {
        printf("RegConnectRegistry Failed %d\n",GetLastError());
        return(status);
    }

    //
    // Open the Parent Key of the key we want to delete.
    //
    dwStatus = RegOpenKeyEx(
                hRegistry,
                tempName,
                0,
                KEY_ALL_ACCESS,
                &hParentKey);

    if (dwStatus != ERROR_SUCCESS) {
        printf("Couldn't open Parent of key to be deleted. %d\n",dwStatus);
        goto CleanExit;
    }
    //
    // Delete the subkey.
    //
    dwStatus = RegDeleteKey(hParentKey, EventSourceName);
    if (dwStatus != ERROR_SUCCESS) {
        printf("Couldn't delete "FORMAT_LPTSTR" key from registry %d\n",
            EventSourceName, dwStatus);
    }

    RegCloseKey(hParentKey);
CleanExit:
    RegCloseKey(hRegistry);
    return(status);
}

DWORD
ReadLogFile(
    LPTSTR  ServerName,
    LPTSTR  LogName,
    IN  LPTSTR  *argv,
    IN  DWORD   argc
    )

/*++

Routine Description:


Arguments:


Return Value:


--*/
{
    DWORD   dwReadFlag = EVENTLOG_FORWARDS_READ;
    DWORD   dwRecordNum = 0;
    DWORD   BufSize = 10000;
    DWORD   numBytesRead;
    DWORD   numBytesReqd;
    LPVOID  pElBuffer = NULL;
    PEVENTLOGRECORD    pElRecord;
    BOOL    PrintTheHeader;
    DWORD   i;
    HANDLE  hEventLog=NULL;

    //
    // Get Variable Arguments
    //
    for (i=0; i<argc ;i++ ) {
        if (STRICMP(argv[i], TEXT("ReadFlag=")) == 0) {
            if (STRICMP(argv[i+1],TEXT("fwd")) == 0) {
                dwReadFlag |= EVENTLOG_FORWARDS_READ;
            }
            if (STRICMP(argv[i+1],TEXT("back")) == 0) {
                dwReadFlag |= EVENTLOG_BACKWARDS_READ;
            }
            if (STRICMP(argv[i+1],TEXT("seek")) == 0) {
                dwReadFlag |= EVENTLOG_SEEK_READ;
            }
            if (STRICMP(argv[i+1],TEXT("seq")) == 0) {
                dwReadFlag |= EVENTLOG_SEQUENTIAL_READ;
            }
            i++;
        }
        if (STRICMP(argv[i], TEXT("RecordNum=")) == 0) {
            dwRecordNum = ATOL(argv[i+1]);
            i++;
        }
        if (STRICMP(argv[i], TEXT("BufSize=")) == 0) {
            BufSize = ATOL(argv[i+1]);
            i++;
        }
        hEventLog = OpenEventLog(ServerName,LogName);
        if (hEventLog == NULL) {
            printf("OpenEventLog failed %d\n",GetLastError());
            return(0);
        }
        pElBuffer = LocalAlloc(LPTR, BufSize);
        if (pElBuffer == NULL) {
            printf("ReadLogFile: LocalAlloc Failed %d\n",GetLastError());
            goto CleanExit;
        }

        //---------------------------------------------------------
        // Read and Display the contents of the eventlog
        //---------------------------------------------------------
        PrintTheHeader = TRUE;
TryAgain:
        while(ReadEventLog(
                hEventLog,
                dwReadFlag,
                dwRecordNum,
                pElBuffer,
                BufSize,
                &numBytesRead,
                &numBytesReqd)) {

            pElRecord = (PEVENTLOGRECORD) pElBuffer;
            while ((PBYTE) pElRecord < (PBYTE) pElBuffer + numBytesRead) {
                //
                // Print the record to the display
                //
                DisplayRecord(pElRecord,PrintTheHeader);
                PrintTheHeader = FALSE;
                //
                // Move to the next event in the buffer
                //
                pElRecord = (PEVENTLOGRECORD)((PBYTE) pElRecord +
                    pElRecord->Length);
            }
        }
        switch(GetLastError()) {
        case ERROR_INSUFFICIENT_BUFFER:
            //
            // Increase the size of the buffer and try again
            //
            if (numBytesReqd > BufSize) {
                LocalFree(pElBuffer);
                BufSize = numBytesReqd;
                pElBuffer = LocalAlloc(LPTR, BufSize);
                if (!pElBuffer) {
                    printf("ReadLogFile: LocalAlloc Failed %d\n",GetLastError());
                }
                goto TryAgain;
            }
            else {
                printf("ReadLogFile #1: THIS SHOULD NEVER HAPPEN\n");
            }
            break;
        case ERROR_EVENTLOG_FILE_CHANGED:
            //
            // The current read position for this handle has been overwritten.
            // Reopen the file and print a message to the effect that some
            // records may have been missed.
            //
            printf("ReadLogFile: Current Read position has been overwritten\n");

            hEventLog = OpenEventLog(ServerName,LogName);
            if (hEventLog == NULL) {
                printf("OpenEventLog failed %d\n",GetLastError());
                goto CleanExit;
            }
            goto TryAgain;
        case ERROR_HANDLE_EOF:
            printf("EOF\n");
            break;
        default:
            printf("UnknownError: %d\n",GetLastError());
            break;
        }
    }
CleanExit:
    if (pElBuffer != NULL) {
        LocalFree(pElBuffer);
    }
    if (hEventLog != NULL) {
        CloseEventLog(hEventLog);
    }
    return(0);
}

VOID
DisplayRecord(
    PEVENTLOGRECORD     pElRecord,
    BOOL                PrintTheHeader
    )

/*++

Routine Description:


Arguments:


Return Value:


--*/
{
    if (PrintTheHeader) {
        printf("RecNum/tTimeGen/tWriteTime/tEventID/tType/tNumStr/tCat/n");
    }
    printf("%d/t%d/t%d/t%d/t%d/t%d/t%d\n",
        pElRecord->RecordNumber,
        pElRecord->TimeGenerated,
        pElRecord->TimeWritten,
        pElRecord->EventID,
        pElRecord->EventType,
        pElRecord->NumStrings,
        pElRecord->EventCategory);
}

LONG
wtol(
    IN LPWSTR string
    )
{
    LONG value = 0;

    while((*string != L'\0')  &&
            (*string >= L'0') &&
            ( *string <= L'9')) {
        value = value * 10 + (*string - L'0');
        string++;
    }

    return(value);
}