//***************************************************************************

//

//  NTEVTLOGF.H

//

//  Module: WBEM NT EVENT PROVIDER

//

// Copyright (c) 1996-2001 Microsoft Corporation, All Rights Reserved
//
//***************************************************************************

#ifndef _NT_EVT_PROV_EVTLOGF_H
#define _NT_EVT_PROV_EVTLOGF_H

class CEventlogFileAttributes
{
protected:

	CStringW						m_logname;
	CStringW						m_logpath;
	DWORD						m_retention;
	DWORD						m_fileSz;
	CArray<CStringW*, CStringW*>	m_sources;

	DWORD	ReadRegistry();
	void	SetRetentionStr(IWbemClassObject *pClassObj, IWbemClassObject *pInstObj, DWORD dwVal);
	BOOL	SetSuperClassProperties(IWbemClassObject *pInst);

static	ULONG	GetIndex(wchar_t *indexStr, BOOL *bError);

public:

		CEventlogFileAttributes(const wchar_t *log);
	
	DWORD	UpdateRegistry(IWbemClassObject *pInst);
	DWORD	EventLogOperation(const wchar_t *archive, BOOL bClear,
								WbemProvErrorObject &a_ErrorObject, BOOL &bSuccess);
	BOOL	GenerateInstance(IWbemClassObject *pClassObj, IWbemClassObject* pAClassObj, IWbemClassObject **ppInst);

		~CEventlogFileAttributes();
	
};

class CEventLogFile
{
private:

	static CStringW	ExpandFileName ( const wchar_t *filepath ) ;
	static BOOL		QueryRegForFileName(HKEY hk_Log, const wchar_t *valname, wchar_t **res, DWORD *dwType);

protected:

	HANDLE	m_hEvtLog;
	CStringW	m_EvtLogName;
	BOOL	m_bValid;
	BOOL	m_bBuffer;
	DWORD	m_BuffLen;
	DWORD	m_Reason;
	BYTE	*m_Buffer;
	CCriticalSection m_LogLock;


public:


		CEventLogFile(const WCHAR *logname, BOOL bVerify);

	void	ReadLastRecord();
	BOOL	GetLastRecordID(DWORD &rec, DWORD &numrecs);
	DWORD	ReadRecord(DWORD recID, DWORD *dwBytesRead = NULL, BOOL b_Back = FALSE);
	BOOL	IsValid() {return m_bValid;}
	BOOL	IsValidBuffer() {return m_bBuffer;}
	DWORD	ReadFirstRecord();
	CStringW GetLogName() { return m_EvtLogName; }
	DWORD	FindOldEvent(DWORD evtID, const wchar_t *source, DWORD *recID,time_t offset = 0);
	BYTE*	GetBuffer() { return m_Buffer; }
	DWORD	GetBufferLen() { return m_BuffLen; }
	DWORD	GetReason() { return m_Reason; }

	virtual void	RefreshHandle();

	static CStringW	GetLogName(const wchar_t *file_name);
	static CStringW	GetFileName(HKEY hk_Log, const wchar_t *valname = EVTLOG_REG_FILE_VALUE);
	static DWORD	GetFileNames(HKEY hk_Log, CStringW **names, const wchar_t *valname = MSG_MODULE);
	static BOOL		ms_bSetPrivilege;
	static BOOL		SetSecurityLogPrivilege(BOOL bProcess = FALSE, LPCWSTR privName = SE_SECURITY_NAME);
	static HANDLE	OpenLocalEventLog(LPCWSTR a_log, DWORD *a_Reason);

	virtual ~CEventLogFile();

};


class CMonitoredEventLogFile : public CEventLogFile, public ProvTaskObject
{
private:
	
	CEventProviderManager	*m_parent; 
	IWbemClassObject		*m_Class;
	DWORD					m_RecID;
	VARIANT					m_VpsdSelfRel;


	BOOL SetEventDescriptor();

public:

		CMonitoredEventLogFile(CEventProviderManager *parent, const wchar_t *logname);

	void	SetProcessRecord(DWORD recID) { m_RecID = recID; }
	void	Process();
	void	RefreshHandle();
	BOOL	GenerateInstance(IWbemClassObject **ppEvtInst, IWbemClassObject *pEmbedObj);

		~CMonitoredEventLogFile();

};


#endif //_NT_EVT_PROV_EVTLOGF_H