windows-xp/Source/XPSP1/NT/base/eventlog/server/file.c

/*

Copyright (c) 1990  Microsoft Corporation

Module Name:

    FILE.C

Abstract:

    This file contains the routines that deal with file-related operations.

Author:

    Rajen Shah  (rajens)    07-Aug-1991

Revision History:

    29-Aug-1994     Danl
        We no longer grow log files in place.  So there is no need to
        reserve the MaxConfigSize block of memory.

    18-Apr-2001     Danl
        Modified the function RevalidateLogHeader to change an ASSERT to a check 
		in order to return a proper error code if the condition is TRUE
--*/

//
// INCLUDES
//

#include <eventp.h>
#include <alertmsg.h>  // ALERT_ELF manifests

//
// Macros
//

#define IS_EOF(Ptr, Size) \
    ((Ptr)->Length == ELFEOFRECORDSIZE && \
        RtlCompareMemory (Ptr, &EOFRecord, Size) == Size)

#ifdef CORRUPTED


BOOLEAN
VerifyLogIntegrity(
    PLOGFILE pLogFile
    )

/*++

Routine Description:

    This routine walks the log file to verify that it isn't corrupt


Arguments:

    A pointer to the LOGFILE structure for the log to validate.

Return Value:

    TRUE if log OK
    FALSE if it is corrupt

Note:


--*/
{

    PEVENTLOGRECORD pEventLogRecord;
    PEVENTLOGRECORD pNextRecord;
    PVOID PhysicalStart;
    PVOID PhysicalEOF;
    PVOID BeginRecord;
    PVOID EndRecord;

    pEventLogRecord =
        (PEVENTLOGRECORD)((PBYTE) pLogFile->BaseAddress + pLogFile->BeginRecord);

    PhysicalStart =
        (PVOID) ((PBYTE) pLogFile->BaseAddress + FILEHEADERBUFSIZE);

    PhysicalEOF =
        (PVOID) ((PBYTE) pLogFile->BaseAddress + pLogFile->ViewSize);

    BeginRecord = (PVOID)((PBYTE) pLogFile->BaseAddress + pLogFile->BeginRecord);
    EndRecord   = (PVOID)((PBYTE) pLogFile->BaseAddress + pLogFile->EndRecord);

    while(pEventLogRecord->Length != ELFEOFRECORDSIZE)
    {
        pNextRecord =
            (PEVENTLOGRECORD) NextRecordPosition(EVENTLOG_FORWARDS_READ,
                                                 (PVOID) pEventLogRecord,
                                                 pEventLogRecord->Length,
                                                 BeginRecord,
                                                 EndRecord,
                                                 PhysicalEOF,
                                                 PhysicalStart);

        if (!pNextRecord || pNextRecord->Length == 0)
        {
            ELF_LOG2(ERROR,
                     "VerifyLogIntegrity: The %ws logfile is corrupt near %p\n",
                     pLogFile->LogModuleName->Buffer,
                     pEventLogRecord);

            return FALSE;
        }

        pEventlogRecord = pNextRecord;
    }

    return TRUE;
}

#endif // CORRUPTED


NTSTATUS
FlushLogFile(
    PLOGFILE    pLogFile
    )

/*++

Routine Description:

    This routine flushes the file specified. It updates the file header,
    and then flushes the virtual memory which causes the data to get
    written to disk.

Arguments:

    pLogFile points to the log file structure.

Return Value:

    NONE

Note:


--*/
{
    NTSTATUS    Status;
    IO_STATUS_BLOCK IoStatusBlock;
    PVOID       BaseAddress;
    SIZE_T      RegionSize;
    PELF_LOGFILE_HEADER pLogFileHeader;

    //
    // If the dirty bit is set, update the file header before flushing it.
    //
    if (pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY)
    {
        ELF_LOG1(FILES,
                 "FlushLogFile: %ws log is dirty -- updating header before flushing\n",
                 pLogFile->LogModuleName->Buffer);

        pLogFileHeader = (PELF_LOGFILE_HEADER) pLogFile->BaseAddress;

        pLogFile->Flags &= ~ELF_LOGFILE_HEADER_DIRTY; // Remove dirty bit

        pLogFileHeader->Flags               = pLogFile->Flags;
        pLogFileHeader->StartOffset         = pLogFile->BeginRecord;
        pLogFileHeader->EndOffset           = pLogFile->EndRecord;
        pLogFileHeader->CurrentRecordNumber = pLogFile->CurrentRecordNumber;
        pLogFileHeader->OldestRecordNumber  = pLogFile->OldestRecordNumber;
    }

    //
    // Flush the memory in the section that is mapped to the file.
    //
    BaseAddress = pLogFile->BaseAddress;
    RegionSize  = pLogFile->ViewSize;

    Status = NtFlushVirtualMemory(NtCurrentProcess(),
                                  &BaseAddress,
                                  &RegionSize,
                                  &IoStatusBlock);

    return Status;
}



NTSTATUS
ElfpFlushFiles(
    VOID
    )

/*++

Routine Description:

    This routine flushes all the log files and forces them on disk.
    It is usually called in preparation for a shutdown or a pause.

Arguments:

    NONE

Return Value:

    NONE

Note:


--*/

{

    PLOGFILE    pLogFile;
    NTSTATUS    Status = STATUS_SUCCESS;

    //
    // Make sure that there's at least one file to flush
    //

    if (IsListEmpty(&LogFilesHead))
    {
        ELF_LOG0(FILES,
                 "ElfpFlushFiles: No log files -- returning success\n");

        return STATUS_SUCCESS;
    }

    pLogFile = (PLOGFILE) CONTAINING_RECORD(LogFilesHead.Flink, LOGFILE, FileList);

    //
    // Go through this loop at least once. This ensures that the termination
    // condition will work correctly.
    //
    do
    {
        Status = FlushLogFile(pLogFile);

        if (!NT_SUCCESS(Status))
        {
            ELF_LOG2(ERROR,
                     "ElfpFlushFiles: FlushLogFile on %ws log failed %#x\n",
                     pLogFile->LogModuleName->Buffer,
                     Status);
        }

        //
        // Get the next one
        //
        pLogFile = (PLOGFILE) CONTAINING_RECORD(pLogFile->FileList.Flink, LOGFILE, FileList);
    }
    while ((pLogFile->FileList.Flink != LogFilesHead.Flink) && (NT_SUCCESS(Status)));

    return Status;
}


NTSTATUS
ElfpCloseLogFile(
    PLOGFILE    pLogFile,
    DWORD       Flags
    )

/*++

Routine Description:

    This routine undoes whatever is done in ElfOpenLogFile.

Arguments:

    pLogFile points to the log file structure.

Return Value:

    NTSTATUS.

Note:


--*/
{
    PELF_LOGFILE_HEADER pLogFileHeader;
    PVOID               BaseAddress;
    ULONG               Size;

    ELF_LOG2(FILES,
             "ElfpCloseLogfile: Closing and unmapping file %ws (%ws log)\n",
             pLogFile->LogFileName->Buffer,
             pLogFile->LogModuleName->Buffer);


#ifdef CORRUPTED

    //
    // Just for debugging a log corruption problem
    //

    if (!VerifyLogIntegrity(pLogFile))
    {
        ELF_LOG1(FILES,
                 "ElfpCloseLogfile: Integrity check failed for file %ws\n",
                 pLogFile->LogFileName->Buffer);
    }

#endif // CORRUPTED


    //
    // If the dirty bit is set, update the file header before closing it.
    // Check to be sure it's not a backup file that just had the dirty
    // bit set when it was copied.
    //

    if (pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY
         &&
        !(Flags & ELF_LOG_CLOSE_BACKUP))
    {
        pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_DIRTY |
                             ELF_LOGFILE_ARCHIVE_SET  );   // Remove dirty &
                                                            // archive bits
        if(pLogFile->BaseAddress)
        {
            pLogFileHeader = (PELF_LOGFILE_HEADER) pLogFile->BaseAddress;

            pLogFileHeader->StartOffset         = pLogFile->BeginRecord;
            pLogFileHeader->EndOffset           = pLogFile->EndRecord;
            pLogFileHeader->CurrentRecordNumber = pLogFile->CurrentRecordNumber;
            pLogFileHeader->OldestRecordNumber  = pLogFile->OldestRecordNumber;
            pLogFileHeader->Flags               = pLogFile->Flags;
        }
    }

    //
    // Decrement the reference count, and if it goes to zero, unmap the file
    // and close the handle. Also force the close if fForceClosed is TRUE.
    //

    if ((--pLogFile->RefCount == 0) || (Flags & ELF_LOG_CLOSE_FORCE))
    {
        //
        // Last user has gone.
        // Close all the views and the file and section handles.  Free up
        // any extra memory we had reserved, and unlink any structures
        //
        if (pLogFile->BaseAddress)     // Unmap it if it was allocated
        {
            NtUnmapViewOfSection(NtCurrentProcess(),
                                 pLogFile->BaseAddress);
            pLogFile->BaseAddress = NULL;
        }

        if (pLogFile->SectionHandle)
        {
            NtClose(pLogFile->SectionHandle);
            pLogFile->SectionHandle = NULL;
        }

        if (pLogFile->FileHandle)
        {
            NtClose(pLogFile->FileHandle);
            pLogFile->FileHandle = NULL;
        }
    }

    return STATUS_SUCCESS;

} // ElfpCloseLogFile



NTSTATUS
RevalidateLogHeader(
    PELF_LOGFILE_HEADER pLogFileHeader,
    PLOGFILE pLogFile
    )

/*++

Routine Description:

    This routine is called if we encounter a "dirty" log file. The
    routine walks through the file until it finds a signature for a valid log
    record.  Then it walks backwards from the first record it found until it 
    finds the EOF record from the other direction.  It then walks forward thru 
	the file until it finds the EOF record, or an invalid record.
    It then rebuilds the header and writes it back to the log.  If it can't
    find any valid records, it rebuilds the header to reflect an empty log
    file.  If it finds a trashed file, it writes 256 bytes of the log out in
    an event to the system log.

Arguments:

    pLogFileHeader points to the header of the log file.
    pLogFile points to the log file structure.

Return Value:

    NTSTATUS.

Note:

    This is an expensive routine since it scans the entire file.

    It assumes that the records are on DWORD boundaries.

--*/
{
    PVOID Start, End;
    PDWORD pSignature;
    PEVENTLOGRECORD pEvent;
    PEVENTLOGRECORD FirstRecord;
    PEVENTLOGRECORD FirstPhysicalRecord;
    PEVENTLOGRECORD pLastGoodRecord = NULL;
    NTSTATUS Status;
    IO_STATUS_BLOCK IoStatusBlock;
    LARGE_INTEGER ByteOffset;
    SIZE_T Size;
    int iNumWrap = 0;

    ELF_LOG1(FILES,
             "RevalidateLogHeader: %ws log had dirty bit set -- revalidating\n",
             pLogFile->LogModuleName->Buffer);

    //
    // BUGBUG: This function is full of return statements from inside the
    //         try-except block.  They need to go away.
    //

    try
    {
        //
        // Physical start and end of log file (skipping header)
        //
        Start = (PVOID) ((PBYTE) pLogFile->BaseAddress + FILEHEADERBUFSIZE);
        End = (PVOID) ((PBYTE) pLogFile->BaseAddress + pLogFile->ActualMaxFileSize);

        //
        // First see if the log has wrapped.  The EOFRECORDSIZE is for the one
        // case where the EOF record wraps so that its final length just replaces
        // the next record's starting length
        //
        pEvent = (PEVENTLOGRECORD) Start;

        if (pEvent->Reserved != ELF_LOG_FILE_SIGNATURE
             ||
            pEvent->RecordNumber != 1
             ||
            pEvent->Length == ELFEOFRECORDSIZE)
        {
            ELF_LOG1(FILES,
                     "RevalidateLogHeader: %ws log has wrapped -- looking for "
                         "first valid record\n",
                     pLogFile->LogModuleName->Buffer);

            //
            // Log has already wrapped, go looking for the first valid record
            //
            for (pSignature = (PDWORD) Start;
                 (PVOID) pSignature < End;
                 pSignature++)
            {
                if (*pSignature == ELF_LOG_FILE_SIGNATURE)
                {
                    //
                    // Make sure it's really a record
                    //
                    pEvent = CONTAINING_RECORD(pSignature, EVENTLOGRECORD, Reserved);

                    if (!ValidFilePos(pEvent, Start, End, End, pLogFileHeader, TRUE))
                    {
                        //
                        // Nope, not really, keep trying
                        //
                        continue;
                    }

                    //
                    // This is a valid record, Remember this so you can use
                    // it later
                    //
                    FirstPhysicalRecord = pEvent;

                    ELF_LOG1(FILES,
                             "RevalidateLogHeader: First physical record in %ws log "
                                 "found at %p\n",
                             FirstPhysicalRecord);

                    //
                    // Walk backwards from here (wrapping if necessary) until
                    // you hit the EOF record or an invalid record.
                    //
                    while (pEvent
                            &&
                           ValidFilePos(pEvent, Start, End, End, pLogFileHeader, TRUE))
                    {
                        //
                        // See if it's the EOF record
                        //

                        //
                        // BUGBUG:  If (End - pEvent) is less than ELFEOFUNIQUEPART,
                        //          we never validate what should be the remainder of
                        //          the EOF record at the start of the logfile
                        //
                        if (IS_EOF(pEvent,
                                   min(ELFEOFUNIQUEPART,
                                       (ULONG_PTR) ((PBYTE) End - (PBYTE) pEvent))))
                        {
                            ELF_LOG2(FILES,
                                     "RevalidateLogHeader: Found EOF record (backwards "
                                         "scan) for log %ws at %p\n",
                                     pLogFile->LogModuleName->Buffer,
                                     pEvent);

                            break;
                        }

                        pLastGoodRecord = pEvent;

                        pEvent = NextRecordPosition (
                                     EVENTLOG_SEQUENTIAL_READ |
                                         EVENTLOG_BACKWARDS_READ,
                                     pEvent,
                                     pEvent->Length,
                                     0,
                                     0,
                                     End,
                                     Start);

                        if(pLastGoodRecord < pEvent)
                            iNumWrap++;

                        //
                        // Make sure we're not in an infinite loop
                        //
                        if (pEvent == FirstPhysicalRecord || iNumWrap > 4)
                        {
                            ELF_LOG1(FILES,
                                     "RevalidateLogHeader: Infinite loop (backwards scan) "
                                         "in %ws log -- no EOF or invalid record found\n",
                                     pLogFile->LogModuleName->Buffer);

                            return STATUS_UNSUCCESSFUL;
                        }
                    }

                    //
                    // Found the first record, now go look for the last
                    //
                    ELF_LOG2(FILES,
                             "RevalidateLogHeader: First valid record in %ws "
                                 "log is at %p\n",
                             pLogFile->LogModuleName->Buffer,
                             pLastGoodRecord);

                    FirstRecord = pLastGoodRecord;
                    break;
                }
            }

            if (pSignature == End || pLastGoodRecord == NULL)
            {
                //
                // Either there were no valid records in the file or
                // the only valid record was the EOF record (which
                // means the log is trashed anyhow).  Give up
                // and we'll set it to an empty log file.
                //
                ELF_LOG1(FILES,
                         "RevalidateLogHeader: No valid records found in %ws log\n",
                         pLogFile->LogModuleName->Buffer);

                return STATUS_UNSUCCESSFUL;
            }
        }
        else
        {
            ELF_LOG1(FILES,
                     "RevalidateLogHeader: %ws log has not wrapped -- "
                         "first record is at %p\n",
                     pLogFile->LogModuleName->Buffer);

            //
            // We haven't wrapped yet
            //
            FirstPhysicalRecord = FirstRecord = Start;
        }

        //
        // Now read forward looking for the last good record
        //
        pEvent = FirstPhysicalRecord;

        while (pEvent
                &&
               ValidFilePos(pEvent, Start, End, End, pLogFileHeader, TRUE))
        {
            //
            // See if it's the EOF record
            //
            if (IS_EOF(pEvent,
                       min(ELFEOFUNIQUEPART,
                           (ULONG_PTR) ((PBYTE) End - (PBYTE) pEvent))))
            {
                ELF_LOG2(FILES,
                         "RevalidateLogHeader: Found EOF record (forwards scan) "
                             "for log %ws at %p\n",
                         pLogFile->LogModuleName->Buffer,
                         pEvent);

                break;
            }

            pLastGoodRecord = pEvent;

            pEvent = NextRecordPosition(EVENTLOG_SEQUENTIAL_READ |
                                          EVENTLOG_FORWARDS_READ,
                                        pEvent,
                                        pEvent->Length,
                                        0,
                                        0,
                                        End,
                                        Start);

            if(pLastGoodRecord > pEvent)
                iNumWrap++;

            //
            // Make sure we're not in an infinite loop
            //
            if (pEvent == FirstPhysicalRecord || iNumWrap > 4)
            {
                ELF_LOG1(FILES,
                         "RevalidateLogHeader: Infinite loop (forwards scan) "
                             "in %ws log -- no EOF or invalid record found\n",
                         pLogFile->LogModuleName->Buffer);


                return(STATUS_UNSUCCESSFUL);
            }
        }

        //
        // Now we know the first record (FirstRecord) and the last record
        // (pLastGoodRecord) so we can create the header an EOF record and
        // write them out (EOF record gets written at pEvent)
        //
        // First the EOF record
        //
        //
        // If the EOF record was wrapped, we can't write out the entire record at
        // once.  Instead, we'll write out as much as we can and then write the
        // rest out at the beginning of the log
        //
        Size = min((PBYTE) End - (PBYTE) pEvent, ELFEOFRECORDSIZE);

        if (Size != ELFEOFRECORDSIZE)
        {
            // Make absolutely sure we have enough room to write the remainder of
            // the EOF record.  Note that this should always be the case since the
            // record was wrapped around to begin with.  To do this, make sure
            // that the number of bytes we're writing after the header is <= the
            // offset of the first record from the end of the header
            //
			
			//Refer to bug# 359188. This scenario should never happen but because of 
			//unknown reasons, it happened to occur in one of the log files. so the 
			//following check which was ASSERT in the earlier version was changed to 
			//return STATUS_UNSUCCESSFUL

            if((ELFEOFRECORDSIZE - Size) <= (ULONG)((PBYTE) FirstRecord
                                       - (PBYTE) pLogFileHeader
                                       - FILEHEADERBUFSIZE))

			{
                ELF_LOG1(FILES,
                         "RevalidateLogHeader: Overlapping EOF record "
                             "in %ws log -- No space for writing remainder of EOF record between file header and first record \n",
                         pLogFile->LogModuleName->Buffer);
				return(STATUS_UNSUCCESSFUL);        
			}

		}


		EOFRecord.BeginRecord = (ULONG) ((PBYTE) FirstRecord - (PBYTE) pLogFileHeader);
        EOFRecord.EndRecord = (ULONG) ((PBYTE) pEvent - (PBYTE) pLogFileHeader);

        EOFRecord.CurrentRecordNumber = pLastGoodRecord->RecordNumber + 1;
        EOFRecord.OldestRecordNumber  = FirstRecord->RecordNumber;

        ByteOffset = RtlConvertUlongToLargeInteger((ULONG) ((PBYTE) pEvent
                                                       - (PBYTE) pLogFileHeader));

        Status = NtWriteFile(
                    pLogFile->FileHandle,   // Filehandle
                    NULL,                   // Event
                    NULL,                   // APC routine
                    NULL,                   // APC context
                    &IoStatusBlock,         // IO_STATUS_BLOCK
                    &EOFRecord,             // Buffer
                    (ULONG) Size,           // Length
                    &ByteOffset,            // Byteoffset
                    NULL);                  // Key

        if (!NT_SUCCESS(Status))
        {
            ELF_LOG2(ERROR,
                     "RevalidateLogHeader: EOF record write for %ws log failed %#x\n",
                     pLogFile->LogModuleName->Buffer,
                     Status);

            return Status;
        }

        if (Size != ELFEOFRECORDSIZE)
        {
            PBYTE   pBuff;

            pBuff = (PBYTE) &EOFRecord + Size;
            Size = ELFEOFRECORDSIZE - Size;
            ByteOffset = RtlConvertUlongToLargeInteger(FILEHEADERBUFSIZE);

			// We have already made sure we have enough room to write the remainder of
            // the EOF record. 

            //ASSERT(Size <= (ULONG)((PBYTE) FirstRecord
            //                           - (PBYTE) pLogFileHeader
            //                           - FILEHEADERBUFSIZE));

            Status = NtWriteFile(
                        pLogFile->FileHandle,   // Filehandle
                        NULL,                   // Event
                        NULL,                   // APC routine
                        NULL,                   // APC context
                        &IoStatusBlock,         // IO_STATUS_BLOCK
                        pBuff,                  // Buffer
                        (ULONG) Size,           // Length
                        &ByteOffset,            // Byteoffset
                        NULL);                  // Key

            if (!NT_SUCCESS(Status))
            {
                ELF_LOG2(ERROR,
                         "RevalidateLogHeader: EOF record write (part 2) for "
                             "%ws log failed %#x\n",
                         pLogFile->LogModuleName->Buffer,
                         Status);

                return Status;
            }
        }

        //
        // Now the header
        //

        pLogFileHeader->StartOffset = (ULONG) ((PBYTE) FirstRecord - (PBYTE) pLogFileHeader);
        pLogFileHeader->EndOffset   = (ULONG) ((PBYTE) pEvent- (PBYTE) pLogFileHeader);

        pLogFileHeader->CurrentRecordNumber = pLastGoodRecord->RecordNumber + 1;
        pLogFileHeader->OldestRecordNumber  = FirstRecord->RecordNumber;

        pLogFileHeader->HeaderSize = pLogFileHeader->EndHeaderSize = FILEHEADERBUFSIZE;
        pLogFileHeader->Signature  = ELF_LOG_FILE_SIGNATURE;
        pLogFileHeader->Flags      = 0;

        if (pLogFileHeader->StartOffset != FILEHEADERBUFSIZE)
        {
            pLogFileHeader->Flags |= ELF_LOGFILE_HEADER_WRAP;
        }

        pLogFileHeader->MaxSize      = pLogFile->ActualMaxFileSize;
        pLogFileHeader->Retention    = pLogFile->Retention;
        pLogFileHeader->MajorVersion = ELF_VERSION_MAJOR;
        pLogFileHeader->MinorVersion = ELF_VERSION_MINOR;

        //
        // Now flush this to disk to commit it
        //
        Start = pLogFile->BaseAddress;
        Size  = FILEHEADERBUFSIZE;

        Status = NtFlushVirtualMemory(NtCurrentProcess(),
                                      &Start,
                                      &Size,
                                      &IoStatusBlock);

        if (!NT_SUCCESS(Status))
        {
            ELF_LOG2(ERROR,
                     "RevalidateLogHeader: NtFlushVirtualMemory for %ws log "
                         "header failed %#x\n",
                     pLogFile->LogModuleName->Buffer,
                     Status);
        }
    }
    except(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = STATUS_UNSUCCESSFUL;
    }

    return Status;
}


NTSTATUS
ElfOpenLogFile (
    PLOGFILE    pLogFile,
    ELF_LOG_TYPE LogType
    )

/*++

Routine Description:

    Open the log file, create it if it does not exist.
    Create a section and map a view into the log file.
    Write out the header to the file, if it is newly created.
    If "dirty", update the "start" and "end" pointers by scanning
    the file.  Set AUTOWRAP if the "start" does not start right after
    the file header.

Arguments:

    pLogFile -- pointer to the log file structure, with the relevant data
                filled in.

    CreateOptions -- options to be passed to NtCreateFile that indicate
                     whether to open an existing file, or to create it
                     if it does not exist.

Return Value:

    NTSTATUS.

Note:

    It is up to the caller to set the RefCount in the Logfile structure.

--*/
{
    NTSTATUS    Status = STATUS_SUCCESS;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    LARGE_INTEGER MaximumSizeOfSection;
    LARGE_INTEGER ByteOffset;
    PELF_LOGFILE_HEADER pLogFileHeader;
    FILE_STANDARD_INFORMATION FileStandardInfo;
    ULONG IoStatusInformation;
    ULONG FileDesiredAccess;
    ULONG SectionDesiredAccess;
    ULONG SectionPageProtection;
    ULONG CreateOptions;
    ULONG CreateDisposition;
    SIZE_T ViewSize;

    //
    // File header in a new file has the "Start" and "End" pointers the
    // same since there are no records in the file.
    //
    static ELF_LOGFILE_HEADER FileHeaderBuf = { FILEHEADERBUFSIZE, // Size
                                                ELF_LOG_FILE_SIGNATURE,
                                                ELF_VERSION_MAJOR,
                                                ELF_VERSION_MINOR,
                                                FILEHEADERBUFSIZE, // Start offset
                                                FILEHEADERBUFSIZE, // End offset
                                                1,                 // Next record #
                                                0,                 // Oldest record #
                                                0,                 // Maxsize
                                                0,                 // Flags
                                                0,                 // Retention
                                                FILEHEADERBUFSIZE  // Size
                                              };

    //
    // Set the file open and section create options based on the type of log
    // file this is.
    //
    switch (LogType)
    {
        case ElfNormalLog:

            ELF_LOG0(FILES,
                     "ElfpOpenLogfile: Opening ElfNormalLog\n");

            CreateDisposition = FILE_OPEN_IF;
            FileDesiredAccess = GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE;

            SectionDesiredAccess = SECTION_MAP_READ | SECTION_MAP_WRITE
                                       | SECTION_QUERY | SECTION_EXTEND_SIZE;

            SectionPageProtection = PAGE_READWRITE;
            CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT;
            break;

        case ElfSecurityLog:

            ELF_LOG0(FILES,
                     "ElfpOpenLogfile: Opening ElfSecurityLog\n");

            CreateDisposition = FILE_OPEN_IF;
            FileDesiredAccess = GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE;

            SectionDesiredAccess = SECTION_MAP_READ | SECTION_MAP_WRITE
                                       | SECTION_QUERY | SECTION_EXTEND_SIZE;

            SectionPageProtection = PAGE_READWRITE;
            CreateOptions = FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT;
            break;

        case ElfBackupLog:

            ELF_LOG0(FILES,
                     "ElfpOpenLogfile: Opening ElfBackupLog\n");

            CreateDisposition = FILE_OPEN;
            FileDesiredAccess = GENERIC_READ | SYNCHRONIZE;
            SectionDesiredAccess = SECTION_MAP_READ | SECTION_QUERY;
            SectionPageProtection = PAGE_READONLY;
            CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT;
            break;
    }

    ELF_LOG1(FILES,
             "ElfpOpenLogfile: Opening and mapping %ws\n",
             pLogFile->LogFileName->Buffer);

    if (pLogFile->FileHandle != NULL)
    {
        //
        // The log file is already in use. Do not reopen or remap it.
        //
        ELF_LOG0(FILES,
                 "ElfpOpenLogfile: Log file already in use by another module\n");
    }
    else
    {
        //
        // Initialize the logfile structure so that it is easier to clean
        // up.
        //
        pLogFile->ActualMaxFileSize = ELF_DEFAULT_LOG_SIZE;
        pLogFile->Flags = 0;
        pLogFile->BaseAddress = NULL;
        pLogFile->SectionHandle = NULL;

        //
        // Set up the object attributes structure for the Log File
        //
        InitializeObjectAttributes(&ObjectAttributes,
                                   pLogFile->LogFileName,
                                   OBJ_CASE_INSENSITIVE,
                                   NULL,
                                   NULL);

        //
        // Open the Log File. Create it if it does not exist and it's not
        // being opened as a backup file.  If creating, create a file of
        // the maximum size configured.
        //
        MaximumSizeOfSection = RtlConvertUlongToLargeInteger(ELF_DEFAULT_LOG_SIZE);

        Status = NtCreateFile(&pLogFile->FileHandle,
                              FileDesiredAccess,
                              &ObjectAttributes,
                              &IoStatusBlock,
                              &MaximumSizeOfSection,
                              FILE_ATTRIBUTE_NORMAL,
                              FILE_SHARE_READ,
                              CreateDisposition,
                              CreateOptions,
                              NULL,
                              0);

        if (!NT_SUCCESS(Status))
        {
            ELF_LOG2(ERROR,
                     "ElfpOpenLogfile: Open of %ws log failed %#x\n",
                     pLogFile->LogModuleName->Buffer,
                     Status);

            goto cleanup;
        }

        //
        // If the file already existed, get its size and use that as the
        // actual size of the file.
        //
        IoStatusInformation = (ULONG) IoStatusBlock.Information;

        if (!( IoStatusInformation & FILE_CREATED ))
        {
            ELF_LOG1(FILES,
                     "ElfpOpenLogfile: File %ws already exists\n",
                     pLogFile->LogFileName->Buffer);

            Status = NtQueryInformationFile(pLogFile->FileHandle,
                                            &IoStatusBlock,
                                            &FileStandardInfo,
                                            sizeof (FileStandardInfo),
                                            FileStandardInformation);

            if (!NT_SUCCESS(Status))
            {
                ELF_LOG2(ERROR,
                         "ElfpOpenLogfile: NtQueryInformationFile for %ws failed %#x\n",
                         pLogFile->LogFileName->Buffer,
                         Status);

                goto cleanup;
            }
            else
            {
                ELF_LOG3(FILES,
                         "ElfpOpenLogfile: Use existing size for %ws log: %#x:%#x\n",
                         pLogFile->LogModuleName->Buffer,
                         FileStandardInfo.EndOfFile.HighPart,
                         FileStandardInfo.EndOfFile.LowPart);

                MaximumSizeOfSection.LowPart  = FileStandardInfo.EndOfFile.LowPart;
                MaximumSizeOfSection.HighPart = FileStandardInfo.EndOfFile.HighPart;

                //
                // Make sure that the high DWORD of the file size is ZERO.
                //
                // BUGBUG:  Is this OK for 64-bit machines?
                //
                ASSERT(MaximumSizeOfSection.HighPart == 0);

                //
                // If the filesize if 0, set it to the minimum size
                //
                if (MaximumSizeOfSection.LowPart == 0)
                {
                    ELF_LOG1(FILES,
                             "ElfpOpenLogfile: File was size 0 -- setting it to %#x\n",
                             ELF_DEFAULT_LOG_SIZE);

                    MaximumSizeOfSection.LowPart = ELF_DEFAULT_LOG_SIZE;
                }

                //
                // Set actual size of file
                //
                pLogFile->ActualMaxFileSize = MaximumSizeOfSection.LowPart;

                //
                // If the size of the log file is reduced, a clear must
                // happen for this to take effect
                //
                if (pLogFile->ActualMaxFileSize > pLogFile->ConfigMaxFileSize)
                {
                    pLogFile->ConfigMaxFileSize = pLogFile->ActualMaxFileSize;
                }
            }
        }

        //
        // Create a section mapped to the Log File just opened
        //
        Status = NtCreateSection(
                    &pLogFile->SectionHandle,
                    SectionDesiredAccess,
                    NULL,
                    &MaximumSizeOfSection,
                    SectionPageProtection,
                    SEC_COMMIT,
                    pLogFile->FileHandle);

        if (!NT_SUCCESS(Status))
        {
            ELF_LOG2(ERROR,
                     "ElfpOpenLogfile: NtCreateSection for %ws failed %#x\n",
                     pLogFile->LogFileName->Buffer,
                     Status);

            goto cleanup;
        }

        //
        // Map a view of the Section into the eventlog address space
        //
        ViewSize = 0;

        Status = NtMapViewOfSection(
                        pLogFile->SectionHandle,
                        NtCurrentProcess(),
                        &pLogFile->BaseAddress,
                        0,
                        0,
                        NULL,
                        &ViewSize,
                        ViewUnmap,
                        0,
                        SectionPageProtection);

        pLogFile->ViewSize = (ULONG) ViewSize;

        if (!NT_SUCCESS(Status))
        {
            ELF_LOG2(ERROR,
                     "ElfpOpenLogfile: NtMapViewOfSection for %ws failed %#x\n",
                     pLogFile->LogFileName->Buffer,
                     Status);

            goto cleanup;
        }
        pLogFile->bFullAlertDone = FALSE;

        //
        // If the file was just created, write out the file header.
        //
        if (IoStatusInformation & FILE_CREATED)
        {
            ELF_LOG1(FILES,
                     "ElfpOpenLogfile: Created file %ws\n",
                     pLogFile->LogFileName->Buffer);

JustCreated:

            FileHeaderBuf.MaxSize   = pLogFile->ActualMaxFileSize;
            FileHeaderBuf.Flags     = 0;
            FileHeaderBuf.Retention = pLogFile->Retention;

            //
            // Copy the header into the file
            //
            ByteOffset = RtlConvertUlongToLargeInteger(0);

            Status = NtWriteFile(
                        pLogFile->FileHandle,   // Filehandle
                        NULL,                   // Event
                        NULL,                   // APC routine
                        NULL,                   // APC context
                        &IoStatusBlock,         // IO_STATUS_BLOCK
                        &FileHeaderBuf,         // Buffer
                        FILEHEADERBUFSIZE,      // Length
                        &ByteOffset,            // Byteoffset
                        NULL);                  // Key

            if (!NT_SUCCESS(Status))
            {
                ELF_LOG2(ERROR,
                         "ElfpOpenLogfile: File header write for %ws failed %#x\n",
                         pLogFile->LogFileName->Buffer,
                         Status);

                goto cleanup;
            }

            //
            // Copy the "EOF" record right after the header
            //
            ByteOffset = RtlConvertUlongToLargeInteger(FILEHEADERBUFSIZE);

            Status = NtWriteFile(
                        pLogFile->FileHandle,   // Filehandle
                        NULL,                   // Event
                        NULL,                   // APC routine
                        NULL,                   // APC context
                        &IoStatusBlock,         // IO_STATUS_BLOCK
                        &EOFRecord,             // Buffer
                        ELFEOFRECORDSIZE,       // Length
                        &ByteOffset,            // Byteoffset
                        NULL);                  // Key

            if (!NT_SUCCESS(Status))
            {
                ELF_LOG2(ERROR,
                         "ElfpOpenLogfile: EOF record write for %ws failed %#x\n",
                         pLogFile->LogFileName->Buffer,
                         Status);

                goto cleanup;
            }
        }

        //
        // Check to ensure that this is a valid log file. We look at the
        // size of the header and the signature to see if they match, as
        // well as checking the version number.
        //
        pLogFileHeader = (PELF_LOGFILE_HEADER) (pLogFile->BaseAddress);

        if ((pLogFileHeader->HeaderSize != FILEHEADERBUFSIZE)
              ||
            (pLogFileHeader->EndHeaderSize != FILEHEADERBUFSIZE)
              ||
            (pLogFileHeader->Signature  != ELF_LOG_FILE_SIGNATURE)
              ||
            (pLogFileHeader->MajorVersion != ELF_VERSION_MAJOR)
              ||
            (pLogFileHeader->MinorVersion != ELF_VERSION_MINOR))
        {
            //
            // This file is corrupt -- reset it to an empty log unless
            // it's being opened as a backup file.  If it is, fail the
            // open
            //
            ELF_LOG1(FILES,
                     "ElfpOpenLogfile: Invalid file header in %ws\n",
                     pLogFile->LogFileName->Buffer);

            if (LogType == ElfBackupLog)
            {
               Status = STATUS_EVENTLOG_FILE_CORRUPT;
               goto cleanup;
            }
            else
            {
                ElfpCreateQueuedAlert(ALERT_ELF_LogFileCorrupt,
                                      1,
                                      &pLogFile->LogModuleName->Buffer);
                //
                // Treat it like it was just created
                //
                goto JustCreated;
            }
        }
        else
        {
            //
            // If the "dirty" bit is set in the file header, then we need to
            // revalidate the BeginRecord and EndRecord fields since we did not
            // get a chance to write them out before the system was rebooted.
            // If the dirty bit is set and it's a backup file, just fail the
            // open.
            //
            if (pLogFileHeader->Flags & ELF_LOGFILE_HEADER_DIRTY)
            {
                ELF_LOG1(FILES,
                         "ElfpOpenLogfile: File %ws has dirty header\n",
                         pLogFile->LogFileName->Buffer);

                if (LogType == ElfBackupLog)
                {
                   Status = STATUS_EVENTLOG_FILE_CORRUPT;
                   goto cleanup;
                }
                else
                {
                   Status = RevalidateLogHeader (pLogFileHeader, pLogFile);
                }
            }

            if (NT_SUCCESS(Status))
            {
                //
                // Set the beginning and end record positions in our
                // data structure as well as the wrap flag if appropriate.
                //
                pLogFile->EndRecord   = pLogFileHeader->EndOffset;
                pLogFile->BeginRecord = pLogFileHeader->StartOffset;

                if (pLogFileHeader->Flags & ELF_LOGFILE_HEADER_WRAP)
                {
                    pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP;
                }

                ELF_LOG3(FILES,
                         "ElfpOpenLogfile: %ws log -- BeginRecord: %#x, EndRecord: %#x\n",
                         pLogFile->LogModuleName->Buffer,
                         pLogFile->BeginRecord,
                         pLogFile->EndRecord);
            }
            else
            {
                //
                // Couldn't validate the file, treat it like it was just
                // created (turn it into an empty file)
                //
                goto JustCreated;
            }

#ifdef CORRUPTED

            //
            // Just for debugging a log corruption problem
            //

            if (!VerifyLogIntegrity(pLogFile))
            {
                ELF_LOG1(ERROR,
                         "ElfpOpenLogfile: Integrity check failed for %ws\n",
                         pLogFile->LogFileName->Buffer);
            }

#endif // CORRUPTED

        }

        //
        // Fill in the first and last record number values in the LogFile
        // data structure.
        //
        // SS: Save the record number of the first record in this session
        // so that if the cluster service starts after the eventlog service
        // it will be able to forward the pending records for replication
        // when the cluster service registers
        //
        pLogFile->SessionStartRecordNumber = pLogFileHeader->CurrentRecordNumber;
        pLogFile->CurrentRecordNumber      = pLogFileHeader->CurrentRecordNumber;
        pLogFile->OldestRecordNumber       = pLogFileHeader->OldestRecordNumber;
    }

    return Status;

cleanup:

    //
    // Clean up anything that got allocated
    //
    if (pLogFile->ViewSize)
    {
        NtUnmapViewOfSection(NtCurrentProcess(), pLogFile->BaseAddress);
        pLogFile->BaseAddress = NULL;
    }

    if (pLogFile->SectionHandle)
    {
        NtClose(pLogFile->SectionHandle);
        pLogFile->SectionHandle = NULL;
    }

    if (pLogFile->FileHandle)
    {
        NtClose (pLogFile->FileHandle);
        pLogFile->FileHandle = NULL;
    }

    return Status;
}