//***************************************************************************

//

//  NTEVTDEFS.H

//

//  Module: WBEM NT EVENT PROVIDER

//

// Copyright (c) 1996-2001 Microsoft Corporation, All Rights Reserved
//
//***************************************************************************

#ifndef _NT_EVT_PROV_NTEVTDEFS_H
#define _NT_EVT_PROV_NTEVTDEFS_H

#define ELF_LOGFILE_READ             0x0001
#define ELF_LOGFILE_WRITE            0x0002
#define ELF_LOGFILE_CLEAR            0x0004
#define ELF_LOGFILE_START            0x0008
#define ELF_LOGFILE_STOP             0x000C
#define ELF_LOGFILE_CONFIGURE        0x0010
#define ELF_LOGFILE_BACKUP           0x0020

#define ELF_LOGFILE_ALL_ACCESS       (STANDARD_RIGHTS_REQUIRED       | \
                                         ELF_LOGFILE_READ            | \
                                         ELF_LOGFILE_WRITE           | \
                                         ELF_LOGFILE_CLEAR           | \
                                         ELF_LOGFILE_START           | \
                                         ELF_LOGFILE_STOP            | \
                                         ELF_LOGFILE_CONFIGURE)

#define ELF_LOGFILE_OBJECT_ACES		12            // Number of ACEs in this DACL
#define NT_EVTLOG_MAX_CLASSES		7	

#define SECURITY_MUTEX_NAME		L"Cimom NT Security API protector"
#define PERFORMANCE_MUTEX_NAME	L"WbemPerformanceDataMutex"

#define EVENTTHREADNAME			L"Eventlog Monitor"

BOOL ObtainedSerialAccess(CMutex* pLock);
void ReleaseSerialAccess(CMutex* pLock);

#define HKEYCLASSES		L"SOFTWARE\\Classes\\"

#define TYPE_ARRAY_LEN		6
#define RETENTION_ARRAY_LEN	3
typedef ULONG (*GetIndexFunc)(const wchar_t*, BOOL*);

#define WBEM_QUERY_LANGUAGE_SQL1 L"WQL"

#define LOGON_EVTID		2147489653
#define LOGON_SOURCE	L"eventlog"
#define LOGON_TIME		1800 //30 MINS

#define SYSTEM_PROPERTY_CLASS				L"__CLASS"
#define SYSTEM_PROPERTY_SUPERCLASS			L"__SUPERCLASS"
#define SYSTEM_PROPERTY_DYNASTY				L"__DYNASTY"
#define SYSTEM_PROPERTY_DERIVATION			L"__DERIVATION"
#define SYSTEM_PROPERTY_GENUS				L"__GENUS"
#define SYSTEM_PROPERTY_NAMESPACE			L"__NAMESPACE"
#define SYSTEM_PROPERTY_PROPERTY_COUNT		L"__PROPERTY_COUNT"
#define SYSTEM_PROPERTY_SERVER				L"__SERVER"
#define SYSTEM_PROPERTY_RELPATH				L"__RELPATH"
#define SYSTEM_PROPERTY_PATH				L"__PATH"

#define EVENT_CLASS		L"__InstanceCreationEvent"
#define SD_PROP			L"SECURITY_DESCRIPTOR"
#define TARGET_PROP		L"TargetInstance"
#define NTEVT_CLASS		L"Win32_NTLogEvent"
#define RECORD_PROP		L"RecordNumber"
#define	LOGFILE_PROP	L"Logfile"
#define EVTID_PROP		L"EventIdentifier"
#define EVTID2_PROP		L"EventCode"
#define SOURCE_PROP		L"SourceName"
#define TYPE_PROP		L"Type"
#define EVTTYPE_PROP	L"EventType"
#define CATEGORY_PROP	L"Category"
#define CATSTR_PROP		L"CategoryString"
#define GENERATED_PROP	L"TimeGenerated"
#define WRITTEN_PROP	L"TimeWritten"
#define COMPUTER_PROP	L"ComputerName"
#define USER_PROP		L"User"
#define MESSAGE_PROP	L"Message"
#define INSSTRS_PROP	L"InsertionStrings"
#define DATA_PROP		L"Data"
#define EVT_ENUM_QUAL	L"Values"
#define EVT_MAP_QUAL	L"ValueMap"

#define EVENTLOG_BASE	L"SYSTEM\\CurrentControlSet\\Services\\Eventlog"
#define	MSG_MODULE		L"EventMessageFile"
#define PARAM_MODULE	L"ParameterMessageFile"
#define PRIM_MODULE		L"PrimaryModule"
#define CAT_MODULE		L"CategoryMessageFile"
#define GUEST_ACCESS	L"RestrictGuestAccess"
#define SYSTEM_LOG		L"System"
#define SECURITY_LOG	L"Security"

// {F55C5B4C-517D-11d1-AB57-00C04FD9159E}
DEFINE_GUID(CLSID_CNTEventProviderClassFactory, 
0xf55c5b4c, 0x517d, 0x11d1, 0xab, 0x57, 0x0, 0xc0, 0x4f, 0xd9, 0x15, 0x9e);


#define WBEM_PROPERTY_STATUSCODE   L"StatusCode"
#define WBEM_PROPERTY_PROVSTATUSCODE   L"ProvStatusCode"
#define WBEM_PROPERTY_PROVSTATUSMESSAGE   L"Description"
#define WBEM_PROPERTY_PRIVNOTHELD   L"PrivilegesNotHeld"
#define WBEM_PROPERTY_PRIVREQUIRED   L"PrivilegesRequired"

#define CLASS_PROP		L"__CLASS"

#define EVTLOG_REG_FILE_VALUE		L"File"
#define EVTLOG_REG_RETENTION_VALUE	L"Retention"
#define EVTLOG_REG_MAXSZ_VALUE		L"MaxSize"
#define EVTLOG_REG_SOURCES_VALUE	L"Sources"

#define NTEVTLOG_CLASS				L"Win32_NTEventlogFile"
#define PROP_MAXSZ					L"MaxFileSize"
#define PROP_RETENTION				L"OverWriteOutDated"
#define PROP_LOGNAME				L"LogfileName"
#define PROP_NUMRECS				L"NumberOfRecords"
#define PROP_RETENTION_STR			L"OverWritePolicy"
#define PROP_SOURCES				L"Sources"

#define PROP_NAME					L"Name"

#define PROP_CS_CRE_CLASS			L"CSCreationClassName"
#define PROP_CRE_CLASS				L"CreationClassName"
#define PROP_FS_CRE_CLASS			L"FSCreationClassName"
#define PROP_FS_NAME				L"FSName"
#define VAL_FS_CRE_CLASS			L"Win32_FileSystem"

#ifdef VERSION_ISA_PROPERTY
#define PROP_VERSION				L"Version"
#endif

#define METHOD_RESOBJ				L"__Parameters"
#define METHOD_CLEAR				L"ClearEventlog"
#define METHOD_BACKUP				L"BackupEventlog"
#define METHOD_PARAM				L"ArchiveFileName"
#define METHOD_RESULT_PARAM			L"ReturnValue"

#define FILE_CHUNK_SZ				0x00010000
#define MAX_EVT_LOG_SZ				0xffff0000
#define MAX_EVT_AGE					365
#define EVT_NEVER_AGE				0xffffffff
#define EVT_UNITS_FROM_DAYS			(60*60*24)	//from days to seconds

#define CONFIG_CLASS		L"NTEventlogProviderConfig"
#define CONFIG_INSTANCE		L"NTEventlogProviderConfig=@"
#define COMP_CLASS			L"Win32_ComputerSystem"
#define LAST_BOOT_PROP		L"LastBootUpTime"
#define USER_CLASS			L"Win32_UserAccount"
#define ASSOC_LOGRECORD		L"Win32_NTLogEventLog"
#define ASSOC_USERRECORD	L"Win32_NTLogEventUser"
#define ASSOC_COMPRECORD	L"Win32_NTLogEventComputer"
#define REF_LOG				L"Log"
#define REF_REC				L"Record"
#define REF_USER			L"User"
#define REF_COMP			L"Computer"

#define PROP_DOMAIN			L"Domain"

#define PROP_START_LOG		CStringW(CStringW(NTEVTLOG_CLASS) + CStringW(L'.') + CStringW(PROP_NAME) + CStringW(L"=\""))
#define PROP_START_REC		CStringW(CStringW(NTEVT_CLASS) + CStringW(L'.') + CStringW(LOGFILE_PROP) + CStringW(L"=\""))
#define PROP_MID_REC		CStringW(CStringW(L"\",") + CStringW(RECORD_PROP) + CStringW(L'='))
#define PROP_START_COMP		CStringW(CStringW(COMP_CLASS) + CStringW(L".Name=\""))
#define PROP_START_USER		CStringW(CStringW(USER_CLASS) + CStringW(L".Domain=\""))
#define PROP_MID_USER		CStringW(L"\",Name=\"")

#define ENUM_INST_QUERY_START	CStringW(L"select * from ")
#define ENUM_INST_QUERY_MID		CStringW(L" where __CLASS = \"")

#define PROP_END_QUOTE		CStringW(L"\"")

// {D2E4F828-65E4-11d1-AB64-00C04FD9159E}
DEFINE_GUID(CLSID_CNTEventLocatorClassFactory, 
0xd2e4f828, 0x65e4, 0x11d1, 0xab, 0x64, 0x0, 0xc0, 0x4f, 0xd9, 0x15, 0x9e);

// {FD4F53E0-65DC-11d1-AB64-00C04FD9159E}
DEFINE_GUID(CLSID_CNTEventInstanceProviderClassFactory, 
0xfd4f53e0, 0x65dc, 0x11d1, 0xab, 0x64, 0x0, 0xc0, 0x4f, 0xd9, 0x15, 0x9e);

#endif //_NT_EVT_PROV_NTEVTDEFS_H