Source code of Windows XP (NT5)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

837 lines
26 KiB

  1. /*****************************************************************/
  2. /** Microsoft Windows NT **/
  3. /** Copyright(c) Microsoft Corp., 1991 **/
  4. /*****************************************************************/
  5. /*
  6. * lognt.hxx
  7. * This file contains class definitions of NT event log objects.
  8. * NT_EVENT_LOG
  9. *
  10. * History:
  11. * Yi-HsinS 10/15/91 Created
  12. * terryk 12/20/91 Added WriteTextEntry
  13. * Yi-HsinS 01/15/92 Added Backup, SeekOldestLogEntry,
  14. * SeekNewestLogEntry and modified
  15. * parameters to WriteTextEntry
  16. * Yi-HsinS 02/25/92 Added helper methods to get log
  17. * descriptions from the registry
  18. * Yi-HsinS 04/25/92 Added caching for message dlls
  19. * Yi-HsinS 10/13/92 Added support for parameter message file
  20. * RaviR 02/28/95 Added support to get description &
  21. * source name for Cairo Alerts
  22. * JonN 6/22/00 WriteTextEntry no longer supported
  23. *
  24. */
  25. #ifndef _LOGNT_HXX_
  26. #define _LOGNT_HXX_
  27. #include "eventlog.hxx"
  28. #include "uatom.hxx"
  29. #include "regkey.hxx"
  30. #include "array.hxx"
  31. #include "uintlsa.hxx"
  32. //
  33. // The maximum number of libraries that are opened at any one time.
  34. //
  35. #define MAX_LIBRARY_OPENED 10
  36. //
  37. // The following is used to get the alert description and source name
  38. // for Cairo alerts.
  39. //
  40. typedef long (*PASGETALERTDESCRIPTION)(ULONG, const BYTE*, LPWSTR *);
  41. typedef long (*PASGETALERTSOURCENAME)(ULONG, const BYTE*, LPWSTR *);
  42. /*************************************************************************
  43. NAME: DLL_NAME_HANDLE_PAIR
  44. SYNOPSIS: The class stores the name and opened handle
  45. of a dll.
  46. INTERFACE : DLL_HANDLE() - Constructor
  47. Set() - Set the name and handle
  48. QueryName() - Return the full path name of the dll
  49. QueryHandle() - Return the handle of the dll
  50. PARENT: BASE
  51. USES:
  52. CAVEATS:
  53. NOTES:
  54. HISTORY:
  55. Yi-HsinS 4/25/92 Created
  56. **************************************************************************/
  57. DLL_CLASS DLL_NAME_HANDLE_PAIR: public BASE
  58. {
  59. private:
  60. // Name of the dll
  61. NLS_STR _nlsName;
  62. // Opened handle of the above dll
  63. HMODULE _handle;
  64. public:
  65. DLL_NAME_HANDLE_PAIR();
  66. DLL_NAME_HANDLE_PAIR( const TCHAR *pszName, HMODULE handle = 0 );
  67. APIERR Set( const TCHAR *pszName, HMODULE handle )
  68. { _nlsName = pszName; _handle = handle; return _nlsName.QueryError(); }
  69. NLS_STR *QueryName( VOID )
  70. { return &_nlsName; }
  71. HMODULE QueryHandle( VOID )
  72. { return _handle; }
  73. };
  74. //
  75. // An array of DLL_NAME_HANDLE_PAIR
  76. //
  77. DECL_ARRAY_OF( DLL_NAME_HANDLE_PAIR, DLL_BASED )
  78. /*************************************************************************
  79. NAME: DLL_HANDLE_CACHE_ARRAY
  80. SYNOPSIS: Wrapper class containing an array of DLL_NAME_HANDLE_PAIR.
  81. This class contains all methods in dealing with caching
  82. the opened handles of dlls.
  83. INTERFACE : DLL_HANDLE_CACHE_ARRAY() - Constructor
  84. QueryHandle() - Query the handle of the given dll
  85. QuerySize() - Query the number of elements
  86. that is allocated for the array.
  87. QueryCount() - Query the actual number of elements
  88. contained in the array.
  89. operator[]() - Return the ith element in the array
  90. Cache() - Store the dll and handle into the
  91. array.
  92. PARENT: BASE
  93. USES: ARRAY_OF( DLL_NAME_HANDLE_PAIR )
  94. CAVEATS:
  95. NOTES:
  96. HISTORY:
  97. Yi-HsinS 4/25/92 Created
  98. **************************************************************************/
  99. DLL_CLASS DLL_HANDLE_CACHE_ARRAY: public BASE
  100. {
  101. private:
  102. ARRAY_OF( DLL_NAME_HANDLE_PAIR ) _aDllNameHandle;
  103. // The next slot to fill in the dll name/handle
  104. UINT _cNext;
  105. // Flag indicating whether the array is full or not
  106. BOOL _fFull;
  107. public:
  108. DLL_HANDLE_CACHE_ARRAY( UINT cElem );
  109. HMODULE QueryHandle( const NLS_STR &nls );
  110. INT QuerySize() const
  111. { return _aDllNameHandle.QueryCount(); }
  112. INT QueryCount() const
  113. { return ( _fFull? _aDllNameHandle.QueryCount() : _cNext ); }
  114. DLL_NAME_HANDLE_PAIR &operator[]( INT iIndex ) const
  115. { return _aDllNameHandle[ iIndex ]; }
  116. APIERR Cache( const NLS_STR &nls, HMODULE handle );
  117. };
  118. /*************************************************************************
  119. NAME: SOURCE_INFO_ITEM
  120. SYNOPSIS: The class for storing the information contained in the registry
  121. of each source under the module.
  122. INTERFACE : SOURCE_INFO_ITEM() - Constructor
  123. ~SOURCE_INFO_ITEM() - Destructor
  124. Set() - Set the information contain in the item
  125. IsInitialized() - See if the all the information
  126. contained in this item is initialized
  127. or not.
  128. QuerySource() - Return the source name
  129. QueryTypeMask() - Return the type mask
  130. QueryCategoryDllName() - Return the full path name of
  131. the category dll
  132. QueryCategoryCount() - Return the number of categories used
  133. in the source.
  134. QueryCategoryList() - Return the list of categories supported
  135. in this source.
  136. SetCategoryList() - Set the category list.
  137. QueryEventsDllList() - Return the list of full path names of
  138. the events dll
  139. QueryParameterMessageDllName() - Return the dll name containing
  140. strings for language independent
  141. insertion strings
  142. PARENT: BASE
  143. USES: NLS_STR, STRLIST
  144. CAVEATS:
  145. NOTES:
  146. HISTORY:
  147. Yi-HsinS 2/25/92 Created
  148. **************************************************************************/
  149. DLL_CLASS SOURCE_INFO_ITEM : public BASE
  150. {
  151. private:
  152. // The name of the source
  153. NLS_STR _nlsSource;
  154. // Flag indicating whether the information in this item is initialized
  155. // or not
  156. BOOL _fInitialized;
  157. // The type mask supported by the source
  158. USHORT _usTypeMask;
  159. // The category dll name supported by the source
  160. NLS_STR _nlsCategoryDllName;
  161. // The number of categories in the above dll
  162. USHORT _cCategoryCount;
  163. // Pointer to a list of categories names
  164. STRLIST *_pstrlstCategory;
  165. // Pointer to a list of dlls containing descriptions
  166. STRLIST *_pstrlstEventsDll;
  167. // The name of the parameter message dll supported by the source
  168. NLS_STR _nlsParameterMessageDllName;
  169. public:
  170. SOURCE_INFO_ITEM();
  171. SOURCE_INFO_ITEM( const TCHAR *pszSource,
  172. USHORT usTypeMask = 0,
  173. const TCHAR *pszCategoryDllName = NULL,
  174. USHORT cCategoryCount = 0,
  175. STRLIST *pstrlstEventsDll = NULL,
  176. const TCHAR *pszParameterMessageDllName = NULL );
  177. ~SOURCE_INFO_ITEM();
  178. APIERR Set( USHORT usTypeMask,
  179. const TCHAR *pszCategoryDllName,
  180. USHORT cCategoryCount,
  181. STRLIST *pstrlstEventsDll,
  182. const TCHAR *pszParameterMessageDllName );
  183. BOOL IsInitialized( VOID ) const
  184. { return _fInitialized; }
  185. const NLS_STR *QuerySource( VOID ) const
  186. { return &_nlsSource; }
  187. USHORT QueryTypeMask( VOID ) const
  188. { UIASSERT( IsInitialized() ); return _usTypeMask; }
  189. const NLS_STR *QueryCategoryDllName( VOID ) const
  190. { UIASSERT( IsInitialized() ); return &_nlsCategoryDllName; }
  191. USHORT QueryCategoryCount( VOID ) const
  192. { UIASSERT( IsInitialized() ); return _cCategoryCount; }
  193. STRLIST *QueryCategoryList( VOID )
  194. { UIASSERT( IsInitialized() ); return _pstrlstCategory; }
  195. VOID SetCategoryList( STRLIST *pstrlstCategory )
  196. { _pstrlstCategory = pstrlstCategory; }
  197. STRLIST *QueryEventDllList( VOID )
  198. { UIASSERT( IsInitialized() ); return _pstrlstEventsDll; }
  199. const NLS_STR *QueryParameterMessageDllName( VOID ) const
  200. { UIASSERT( IsInitialized() ); return &_nlsParameterMessageDllName; }
  201. };
  202. /*************************************************************************
  203. NAME: SOURCE_INFO_ITEM_PTR
  204. SYNOPSIS: Item that contains a pointer to SOURCE_INFO_ITEM
  205. INTERFACE: SOURCE_INFO_ITEM_PTR() - Constructor
  206. ~SOURCE_INFO_ITEM_PTR() - Destructor
  207. operator=() - Assignment operator
  208. operator->() - Return a pointer to SOURCE_INFO_ITEM
  209. Compare() - Compare two SOURCE_INFO_ITEM_PTR to
  210. see if they contain the same source.
  211. QuerySourceItem() - Return the SOURCE_INFO_ITEM contained
  212. in the object.
  213. PARENT:
  214. USES: SOURCE_INFO_ITEM
  215. CAVEATS:
  216. NOTES:
  217. HISTORY:
  218. Yi-HsinS 2/25/92 Created
  219. **************************************************************************/
  220. DLL_CLASS SOURCE_INFO_ITEM_PTR
  221. {
  222. private:
  223. SOURCE_INFO_ITEM *_pSrcInfoItem;
  224. // If _fDestroy is TRUE, we will destroy _pSrcInfoItem when this
  225. // item gets destructed. Otherwise, we will leave it alone.
  226. BOOL _fDestroy;
  227. public:
  228. SOURCE_INFO_ITEM_PTR()
  229. : _pSrcInfoItem( NULL ),
  230. _fDestroy( TRUE ) {}
  231. SOURCE_INFO_ITEM_PTR( SOURCE_INFO_ITEM *pSrcInfoItem, BOOL fDestroy )
  232. : _pSrcInfoItem( pSrcInfoItem ),
  233. _fDestroy( fDestroy ) {}
  234. ~SOURCE_INFO_ITEM_PTR()
  235. { if ( _fDestroy )
  236. delete _pSrcInfoItem;
  237. _pSrcInfoItem = NULL;
  238. }
  239. SOURCE_INFO_ITEM_PTR &operator=( const SOURCE_INFO_ITEM_PTR &s )
  240. { _pSrcInfoItem = s._pSrcInfoItem; return *this; }
  241. SOURCE_INFO_ITEM *operator->()
  242. { return _pSrcInfoItem; }
  243. INT Compare( const SOURCE_INFO_ITEM_PTR *pSrcInfoItemPtr ) const ;
  244. SOURCE_INFO_ITEM *QuerySourceItem() const
  245. { return _pSrcInfoItem; }
  246. };
  247. //
  248. // An array of pointers to SOURCE_INFO_ITEM
  249. //
  250. DECL_ARRAY_LIST_OF( SOURCE_INFO_ITEM_PTR, DLL_BASED )
  251. /*************************************************************************
  252. NAME: SOURCE_INFO_ARRAY
  253. SYNOPSIS: Wrapper class for the array of SOURCE_INFO_ITEM. Access
  254. methods are added to get the information for the nth
  255. item in the array.
  256. INTERFACE : SOURCE_INFO_ARRAY() - Constructor
  257. QuerySource() - Return the source name of the ith item
  258. QueryTypeMask() - Return the type mask of the ith item
  259. QueryCategoryDllName() - Return the full path name of
  260. the category dll of the ith item
  261. QueryCategoryCount() - Return the number of categories
  262. of the ith item
  263. QueryCategoryList() - Return the list of categories supported
  264. by the ith source.
  265. QueryEventsDllList() - Return the list of full path names of
  266. the events dll of the ith item
  267. QueryParameterMessageDllName() - Return the dll name containing
  268. strings for language independent
  269. insertion strings of the ith item
  270. PARENT: ARRAY_LIST_OF( SOURCE_INFO_ITEM )
  271. USES:
  272. CAVEATS:
  273. NOTES:
  274. HISTORY:
  275. Yi-HsinS 8/25/92 Created
  276. **************************************************************************/
  277. DLL_CLASS SOURCE_INFO_ARRAY : public ARRAY_LIST_OF( SOURCE_INFO_ITEM_PTR )
  278. {
  279. public:
  280. SOURCE_INFO_ARRAY( UINT cElem )
  281. : ARRAY_LIST_OF(SOURCE_INFO_ITEM_PTR )( cElem )
  282. { }
  283. const NLS_STR *QuerySource( INT i ) const
  284. { return ((*this)[i])->QuerySource(); }
  285. USHORT QueryTypeMask( INT i ) const
  286. { return ((*this)[i])->QueryTypeMask(); }
  287. const NLS_STR *QueryCategoryDllName( INT i ) const
  288. { return ((*this)[i])->QueryCategoryDllName(); }
  289. USHORT QueryCategoryCount( INT i ) const
  290. { return ((*this)[i])->QueryCategoryCount(); }
  291. STRLIST *QueryCategoryList( INT i ) const
  292. { return ((*this)[i])->QueryCategoryList(); }
  293. STRLIST *QueryEventDllList( INT i ) const
  294. { return ((*this)[i])->QueryEventDllList(); }
  295. const NLS_STR *QueryParameterMessageDllName( INT i ) const
  296. { return ((*this)[i])->QueryParameterMessageDllName(); }
  297. };
  298. /*************************************************************************
  299. NAME: LOG_REGISTRY_INFO
  300. SYNOPSIS: The class for storing all the information contained in the
  301. registry under the given module (system, security...).
  302. INTERFACE: LOG_REGISTRY_INFO() - Constructor
  303. ~LOG_REGISTRY_INFO() - Destructor
  304. Init() - 2nd stage constructor
  305. SubstituteParameterID - Find all %%num in the given string
  306. with appropriate strings.
  307. MapEventIDToString() - Get the description associated with
  308. the string
  309. MapCategoryToString() - Get the string associated with
  310. the string
  311. GetSrcSupportedTypeMask() - Get the type mask supported by
  312. the given source
  313. GetSrcSupportedCategoryList() - Get all categories supported by
  314. the given source
  315. GetSourceList() - Get the sources supported under
  316. the given module
  317. PARENT: BASE
  318. USES: NLS_STR, STRLIST, DLL_HANDLE_CACHE_ARRAY, REG_KEY,
  319. SOURCE_INFO_ARRAY
  320. CAVEATS:
  321. NOTES:
  322. HISTORY:
  323. Yi-HsinS 2/25/92 Created
  324. **************************************************************************/
  325. DLL_CLASS LOG_REGISTRY_INFO : public BASE
  326. {
  327. private:
  328. //
  329. // The server that we are reading the registry from
  330. //
  331. NLS_STR _nlsServer;
  332. //
  333. // The module in the registry
  334. //
  335. NLS_STR _nlsModule;
  336. //
  337. // If the server points to a remote machine,
  338. // then this will contain the path to %SystemRoot%.
  339. // Else this will contain a NULL string which will not be used.
  340. //
  341. NLS_STR _nlsRemoteSystemRoot;
  342. //
  343. // The array to cache the handles used by the eventlog to get the
  344. // description of each log entry.
  345. //
  346. DLL_HANDLE_CACHE_ARRAY _aDllHandleCache;
  347. //
  348. // Pointer to an array of SOURCE_INFO_ITEM
  349. //
  350. SOURCE_INFO_ARRAY *_paSourceInfo;
  351. //
  352. // The index of the primary module in the array pointed by _paSourceInfo
  353. //
  354. INT _iPrimarySource;
  355. //
  356. // Pointer to a strlst containing all sources under the module
  357. //
  358. STRLIST *_pstrlstSource;
  359. //
  360. // Pointer to the registry key of module
  361. //
  362. REG_KEY *_pRegKeyFocusModule;
  363. //
  364. // Get the registry key of module on the server
  365. //
  366. APIERR GetRegKeyModule( const TCHAR *pszServer,
  367. REG_KEY **ppRegKeyModule );
  368. //
  369. // Get the handle of the given dll
  370. //
  371. APIERR GetLibHandle( const TCHAR *pszLibName, HMODULE *pHandle );
  372. //
  373. // Expand %SystemRoot% that is contained in pszPath
  374. //
  375. APIERR ExpandSystemRoot( const TCHAR *pszPath, NLS_STR *pnls );
  376. //
  377. // Get %SystemRoot% from the remote registry. This is used only
  378. // if we are reading the registry from the remote machine.
  379. //
  380. APIERR GetRemoteSystemRoot( NLS_STR *pnls );
  381. //
  382. // Initialize the SOURCE_INFO_ITEM at (*_paSourceInfo)[index]
  383. //
  384. APIERR InitSource( INT index );
  385. //
  386. // Initialize the category list at (*_paSourceInfo)[index]
  387. //
  388. APIERR InitCategoryList( INT index );
  389. //
  390. // Get the source name at (*_paSourceInfo)[index]
  391. //
  392. INT QuerySourceIndex( const TCHAR *pszSource );
  393. //
  394. // Returns TRUE if the primary source exists in the registry
  395. //
  396. BOOL PrimarySourceExist( VOID )
  397. { return _iPrimarySource >= 0; }
  398. //
  399. // Returns TRUE if the index is the same as the primary source index
  400. //
  401. BOOL IsPrimarySource( INT index )
  402. { return index == _iPrimarySource; }
  403. //
  404. // Get the string associated with the id in the dll
  405. //
  406. APIERR RetrieveMessage( HMODULE handle,
  407. ULONG nID,
  408. NLS_STR *pnls );
  409. //
  410. // Get the string associated with nMessageID in the source
  411. //
  412. APIERR MapParameterToString( const TCHAR *pszSource,
  413. ULONG nMessageID,
  414. NLS_STR *pnls );
  415. public:
  416. LOG_REGISTRY_INFO( const NLS_STR &nlsServer,
  417. const NLS_STR &nlsModule );
  418. ~LOG_REGISTRY_INFO();
  419. APIERR Init( VOID );
  420. APIERR SubstituteParameterID( const TCHAR *pszSource,
  421. NLS_STR *pnls );
  422. APIERR MapEventIDToString ( const TCHAR *pszSource,
  423. ULONG ulEventID,
  424. NLS_STR *pnls );
  425. APIERR MapCategoryToString ( const TCHAR *pszSource,
  426. USHORT usCategory,
  427. NLS_STR *pnls );
  428. APIERR GetSrcSupportedTypeMask( const TCHAR *pszSource,
  429. USHORT *pusTypeMask );
  430. APIERR GetSrcSupportedCategoryList( const TCHAR *pszSource,
  431. STRLIST **ppstrlstCategory );
  432. STRLIST *GetSourceList( VOID )
  433. { return _pstrlstSource; }
  434. };
  435. /*************************************************************************
  436. NAME: NT_EVENT_LOG
  437. SYNOPSIS: The class for NT Event Log
  438. INTERFACE:
  439. protected:
  440. I_Next() - Helper method for reading the log file
  441. I_Open() - Helper method for opening the handle
  442. to the event log
  443. I_Close()- Helper method for closing the handle
  444. to the event log
  445. CreateCurrentRawEntry() - Create a RAW_LOG_ENTRY for the current
  446. log entry. This is used when filtering log files.
  447. SetPos() - Set the position for the next read.
  448. QueryCurrentEntryCategory() -
  449. Get the category of the current log entry
  450. QueryCurrentEntryTypeString() -
  451. Retrieve the type of the current log entry
  452. QueryCurrentEntryUser() -
  453. Get the user of the current log entry
  454. NextString() - Iterator for returning the strings in the
  455. current log entry.
  456. public:
  457. NT_EVENT_LOG() - Constructor
  458. ~NT_EVENT_LOG() - Destructor
  459. Clear() - Clear the event log
  460. Backup() - Back up the event log without clearing the log file
  461. Reset() - Reset to the beginning or end of log depending
  462. on direction
  463. QueryPos() - Get the position of the current event log entry
  464. Direction is not important on NT.
  465. SeekOldestLogEntry() - Get the oldest log entry in the log
  466. SeekNewestLogEntry() - Get the newest log entry in the log
  467. QueryNumberOfEntries() - Get the number of entries in the log
  468. CreateCurrentFormatEntry() - Create a FORMATTED_LOG_ENTRY for
  469. the current log entry.
  470. WriteTextEntry() - Write the current log entry to a text file
  471. JonN 6/22/00 WriteTextEntry no longer supported
  472. QueryCurrentEntryData() -
  473. Retrieve the raw data of the current log entry
  474. QueryCurrentEntryDesc() -
  475. Get the description of the current log entry
  476. QueryCurrentEntryTime() -
  477. Get the time of the current log entry
  478. IsBackup() - True if we want to open a backup log file
  479. QuerySourceList() - Return the sources supported by the module
  480. QuerySrcSupportedTypeMask() - Query the type mask supported
  481. by the given source
  482. QuerySrcSupportedCategoryList() - Query the category list
  483. supported by the given source
  484. PARENT: EVENT_LOG
  485. USES:
  486. CAVEATS:
  487. NOTES:
  488. HISTORY:
  489. Yi-HsinS 10/15/91 Created
  490. **************************************************************************/
  491. DLL_CLASS NT_EVENT_LOG : public EVENT_LOG
  492. {
  493. private:
  494. //
  495. // Handle to the NT event log
  496. //
  497. HANDLE _handle;
  498. //
  499. // Buffer containing a whole amount of event log entries returned
  500. // by a net API call.
  501. //
  502. BUFFER _buf;
  503. //
  504. // Points to the current log entry inside the buffer _buf
  505. //
  506. EVENTLOGRECORD *_pEL;
  507. //
  508. // the offset(bytes) in the buffer in which the next log entry starts
  509. //
  510. ULONG _cbOffset;
  511. //
  512. // the number of bytes returned from the last read
  513. //
  514. ULONG _cbReturned;
  515. //
  516. // the minimum number of bytes needed for the next read
  517. //
  518. ULONG _cbMinBytesNeeded;
  519. //
  520. // The index of the next string to be retrieved by NextString()
  521. //
  522. UINT _iStrings;
  523. //
  524. // The log number to read in the case of seek read
  525. //
  526. ULONG _ulRecSeek;
  527. //
  528. // TRUE if we want to open a backup file
  529. //
  530. BOOL _fBackup;
  531. //
  532. // Registry Information needed to get the description of log entries
  533. //
  534. LOG_REGISTRY_INFO _logRegistryInfo;
  535. //
  536. // The following for translating SIDS to readable names
  537. //
  538. LSA_POLICY _lsaPolicy;
  539. LSA_TRANSLATED_NAME_MEM _lsatnm;
  540. LSA_REF_DOMAIN_MEM _lsardm;
  541. NLS_STR _nlsAccountDomain;
  542. UINT _cCountUsers;
  543. //
  544. // The following is used to get the alert description and source name
  545. // for Cairo alerts.
  546. //
  547. HINSTANCE _hinstanceSysmgmt;
  548. PASGETALERTDESCRIPTION _pAsGetAlertDescription;
  549. PASGETALERTSOURCENAME _pAsGetAlertSourceName;
  550. protected:
  551. virtual APIERR I_Next( BOOL *pfContinue,
  552. ULONG ulBufferSize = BIG_BUF_DEFAULT_SIZE );
  553. virtual APIERR I_Open( VOID );
  554. virtual APIERR I_Close( VOID );
  555. virtual APIERR CreateCurrentRawEntry( RAW_LOG_ENTRY *pRawLogEntry );
  556. virtual VOID SetPos( const LOG_ENTRY_NUMBER &logEntryNum, BOOL fForceRead );
  557. APIERR QueryCurrentEntryCategory( NLS_STR *pnlsCategory );
  558. APIERR QueryCurrentEntryTypeString( NLS_STR *pnlsType );
  559. APIERR QueryCurrentEntryUser( NLS_STR *pnlsUser );
  560. //
  561. // Iterator to return the next string in the current log.
  562. // Returns FALSE if some error occurs or if there are no more strings left.
  563. // Need to QueryLastError() to distinguish between the two cases.
  564. //
  565. APIERR NextString( BOOL *pfContinue, NLS_STR **ppnlsString );
  566. //
  567. // The following method is used to get the proc address of alert functions
  568. // AsGetAlertdescription and AsGetAlertSourceName
  569. //
  570. APIERR GetProcAddressOfAlertFuctions( VOID );
  571. public:
  572. //
  573. // Constructor : takes a server name,
  574. // an optional direction which defaults to EVLOG_FWD,
  575. // a module name needed for NT Event Log,
  576. // and a module name needed for reading the registry.
  577. // If pszModule and pszRegistryModule don't point to the
  578. // same place, then we are reading a backup event log.
  579. //
  580. NT_EVENT_LOG( const TCHAR *pszServer,
  581. EVLOG_DIRECTION evdir = EVLOG_FWD,
  582. const TCHAR *pszModule = NULL,
  583. const TCHAR *pszRegistryModule = NULL );
  584. virtual ~NT_EVENT_LOG();
  585. //
  586. // See comments in EVENT_LOG
  587. //
  588. virtual APIERR Clear( const TCHAR *pszBackupFile = NULL );
  589. virtual APIERR Backup( const TCHAR *pszBackupFile );
  590. virtual VOID Reset( VOID );
  591. virtual APIERR QueryPos( LOG_ENTRY_NUMBER *plogEntryNum );
  592. virtual APIERR SeekOldestLogEntry( VOID );
  593. virtual APIERR SeekNewestLogEntry( VOID );
  594. virtual APIERR QueryNumberOfEntries( ULONG *pcEntries );
  595. virtual APIERR CreateCurrentFormatEntry( FORMATTED_LOG_ENTRY
  596. **ppFmtLogEntry );
  597. // JonN 6/22/00 WriteTextEntry no longer supported
  598. virtual APIERR WriteTextEntry( ULONG ulFileHandle, INTL_PROFILE &intlprof,
  599. TCHAR chSeparator );
  600. virtual ULONG QueryCurrentEntryData( BYTE **ppbDataOut );
  601. virtual APIERR QueryCurrentEntryDesc( NLS_STR *pnlsDesc );
  602. virtual ULONG QueryCurrentEntryTime( VOID );
  603. BOOL IsBackup( VOID )
  604. { return _fBackup; }
  605. virtual STRLIST *QuerySourceList( VOID );
  606. virtual APIERR QuerySrcSupportedTypeMask( const NLS_STR &nlsSource,
  607. USHORT *pusTypeMask );
  608. virtual APIERR QuerySrcSupportedCategoryList( const NLS_STR &nlsSource,
  609. STRLIST **ppstrlstCategory );
  610. };
  611. #endif