|
|
/*****************************************************************/ /** Microsoft Windows NT **/ /** Copyright(c) Microsoft Corp., 1991 **/ /*****************************************************************/
/*
* lognt.hxx * This file contains class definitions of NT event log objects. * NT_EVENT_LOG * * History: * Yi-HsinS 10/15/91 Created * terryk 12/20/91 Added WriteTextEntry * Yi-HsinS 01/15/92 Added Backup, SeekOldestLogEntry, * SeekNewestLogEntry and modified * parameters to WriteTextEntry * Yi-HsinS 02/25/92 Added helper methods to get log * descriptions from the registry * Yi-HsinS 04/25/92 Added caching for message dlls * Yi-HsinS 10/13/92 Added support for parameter message file * RaviR 02/28/95 Added support to get description & * source name for Cairo Alerts * JonN 6/22/00 WriteTextEntry no longer supported * */
#ifndef _LOGNT_HXX_
#define _LOGNT_HXX_
#include "eventlog.hxx"
#include "uatom.hxx"
#include "regkey.hxx"
#include "array.hxx"
#include "uintlsa.hxx"
//
// The maximum number of libraries that are opened at any one time.
//
#define MAX_LIBRARY_OPENED 10
//
// The following is used to get the alert description and source name
// for Cairo alerts.
//
typedef long (*PASGETALERTDESCRIPTION)(ULONG, const BYTE*, LPWSTR *); typedef long (*PASGETALERTSOURCENAME)(ULONG, const BYTE*, LPWSTR *);
/*************************************************************************
NAME: DLL_NAME_HANDLE_PAIR
SYNOPSIS: The class stores the name and opened handle of a dll.
INTERFACE : DLL_HANDLE() - Constructor Set() - Set the name and handle QueryName() - Return the full path name of the dll QueryHandle() - Return the handle of the dll
PARENT: BASE
USES:
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 4/25/92 Created
**************************************************************************/
DLL_CLASS DLL_NAME_HANDLE_PAIR: public BASE { private: // Name of the dll
NLS_STR _nlsName;
// Opened handle of the above dll
HMODULE _handle;
public: DLL_NAME_HANDLE_PAIR(); DLL_NAME_HANDLE_PAIR( const TCHAR *pszName, HMODULE handle = 0 );
APIERR Set( const TCHAR *pszName, HMODULE handle ) { _nlsName = pszName; _handle = handle; return _nlsName.QueryError(); }
NLS_STR *QueryName( VOID ) { return &_nlsName; }
HMODULE QueryHandle( VOID ) { return _handle; }
};
//
// An array of DLL_NAME_HANDLE_PAIR
//
DECL_ARRAY_OF( DLL_NAME_HANDLE_PAIR, DLL_BASED )
/*************************************************************************
NAME: DLL_HANDLE_CACHE_ARRAY
SYNOPSIS: Wrapper class containing an array of DLL_NAME_HANDLE_PAIR. This class contains all methods in dealing with caching the opened handles of dlls.
INTERFACE : DLL_HANDLE_CACHE_ARRAY() - Constructor QueryHandle() - Query the handle of the given dll QuerySize() - Query the number of elements that is allocated for the array. QueryCount() - Query the actual number of elements contained in the array. operator[]() - Return the ith element in the array Cache() - Store the dll and handle into the array.
PARENT: BASE
USES: ARRAY_OF( DLL_NAME_HANDLE_PAIR )
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 4/25/92 Created
**************************************************************************/
DLL_CLASS DLL_HANDLE_CACHE_ARRAY: public BASE { private: ARRAY_OF( DLL_NAME_HANDLE_PAIR ) _aDllNameHandle;
// The next slot to fill in the dll name/handle
UINT _cNext;
// Flag indicating whether the array is full or not
BOOL _fFull;
public: DLL_HANDLE_CACHE_ARRAY( UINT cElem );
HMODULE QueryHandle( const NLS_STR &nls );
INT QuerySize() const { return _aDllNameHandle.QueryCount(); }
INT QueryCount() const { return ( _fFull? _aDllNameHandle.QueryCount() : _cNext ); }
DLL_NAME_HANDLE_PAIR &operator[]( INT iIndex ) const { return _aDllNameHandle[ iIndex ]; }
APIERR Cache( const NLS_STR &nls, HMODULE handle );
};
/*************************************************************************
NAME: SOURCE_INFO_ITEM
SYNOPSIS: The class for storing the information contained in the registry of each source under the module.
INTERFACE : SOURCE_INFO_ITEM() - Constructor ~SOURCE_INFO_ITEM() - Destructor
Set() - Set the information contain in the item
IsInitialized() - See if the all the information contained in this item is initialized or not.
QuerySource() - Return the source name QueryTypeMask() - Return the type mask QueryCategoryDllName() - Return the full path name of the category dll QueryCategoryCount() - Return the number of categories used in the source. QueryCategoryList() - Return the list of categories supported in this source. SetCategoryList() - Set the category list. QueryEventsDllList() - Return the list of full path names of the events dll
QueryParameterMessageDllName() - Return the dll name containing strings for language independent insertion strings
PARENT: BASE
USES: NLS_STR, STRLIST
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 2/25/92 Created
**************************************************************************/
DLL_CLASS SOURCE_INFO_ITEM : public BASE { private: // The name of the source
NLS_STR _nlsSource;
// Flag indicating whether the information in this item is initialized
// or not
BOOL _fInitialized;
// The type mask supported by the source
USHORT _usTypeMask;
// The category dll name supported by the source
NLS_STR _nlsCategoryDllName;
// The number of categories in the above dll
USHORT _cCategoryCount;
// Pointer to a list of categories names
STRLIST *_pstrlstCategory;
// Pointer to a list of dlls containing descriptions
STRLIST *_pstrlstEventsDll;
// The name of the parameter message dll supported by the source
NLS_STR _nlsParameterMessageDllName;
public: SOURCE_INFO_ITEM();
SOURCE_INFO_ITEM( const TCHAR *pszSource, USHORT usTypeMask = 0, const TCHAR *pszCategoryDllName = NULL, USHORT cCategoryCount = 0, STRLIST *pstrlstEventsDll = NULL, const TCHAR *pszParameterMessageDllName = NULL );
~SOURCE_INFO_ITEM();
APIERR Set( USHORT usTypeMask, const TCHAR *pszCategoryDllName, USHORT cCategoryCount, STRLIST *pstrlstEventsDll, const TCHAR *pszParameterMessageDllName );
BOOL IsInitialized( VOID ) const { return _fInitialized; }
const NLS_STR *QuerySource( VOID ) const { return &_nlsSource; }
USHORT QueryTypeMask( VOID ) const { UIASSERT( IsInitialized() ); return _usTypeMask; }
const NLS_STR *QueryCategoryDllName( VOID ) const { UIASSERT( IsInitialized() ); return &_nlsCategoryDllName; }
USHORT QueryCategoryCount( VOID ) const { UIASSERT( IsInitialized() ); return _cCategoryCount; }
STRLIST *QueryCategoryList( VOID ) { UIASSERT( IsInitialized() ); return _pstrlstCategory; }
VOID SetCategoryList( STRLIST *pstrlstCategory ) { _pstrlstCategory = pstrlstCategory; }
STRLIST *QueryEventDllList( VOID ) { UIASSERT( IsInitialized() ); return _pstrlstEventsDll; }
const NLS_STR *QueryParameterMessageDllName( VOID ) const { UIASSERT( IsInitialized() ); return &_nlsParameterMessageDllName; } };
/*************************************************************************
NAME: SOURCE_INFO_ITEM_PTR
SYNOPSIS: Item that contains a pointer to SOURCE_INFO_ITEM
INTERFACE: SOURCE_INFO_ITEM_PTR() - Constructor ~SOURCE_INFO_ITEM_PTR() - Destructor
operator=() - Assignment operator operator->() - Return a pointer to SOURCE_INFO_ITEM
Compare() - Compare two SOURCE_INFO_ITEM_PTR to see if they contain the same source.
QuerySourceItem() - Return the SOURCE_INFO_ITEM contained in the object.
PARENT:
USES: SOURCE_INFO_ITEM
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 2/25/92 Created
**************************************************************************/
DLL_CLASS SOURCE_INFO_ITEM_PTR { private: SOURCE_INFO_ITEM *_pSrcInfoItem;
// If _fDestroy is TRUE, we will destroy _pSrcInfoItem when this
// item gets destructed. Otherwise, we will leave it alone.
BOOL _fDestroy;
public: SOURCE_INFO_ITEM_PTR() : _pSrcInfoItem( NULL ), _fDestroy( TRUE ) {}
SOURCE_INFO_ITEM_PTR( SOURCE_INFO_ITEM *pSrcInfoItem, BOOL fDestroy ) : _pSrcInfoItem( pSrcInfoItem ), _fDestroy( fDestroy ) {}
~SOURCE_INFO_ITEM_PTR() { if ( _fDestroy ) delete _pSrcInfoItem; _pSrcInfoItem = NULL; }
SOURCE_INFO_ITEM_PTR &operator=( const SOURCE_INFO_ITEM_PTR &s ) { _pSrcInfoItem = s._pSrcInfoItem; return *this; }
SOURCE_INFO_ITEM *operator->() { return _pSrcInfoItem; }
INT Compare( const SOURCE_INFO_ITEM_PTR *pSrcInfoItemPtr ) const ;
SOURCE_INFO_ITEM *QuerySourceItem() const { return _pSrcInfoItem; }
};
//
// An array of pointers to SOURCE_INFO_ITEM
//
DECL_ARRAY_LIST_OF( SOURCE_INFO_ITEM_PTR, DLL_BASED )
/*************************************************************************
NAME: SOURCE_INFO_ARRAY
SYNOPSIS: Wrapper class for the array of SOURCE_INFO_ITEM. Access methods are added to get the information for the nth item in the array.
INTERFACE : SOURCE_INFO_ARRAY() - Constructor
QuerySource() - Return the source name of the ith item QueryTypeMask() - Return the type mask of the ith item QueryCategoryDllName() - Return the full path name of the category dll of the ith item QueryCategoryCount() - Return the number of categories of the ith item QueryCategoryList() - Return the list of categories supported by the ith source. QueryEventsDllList() - Return the list of full path names of the events dll of the ith item
QueryParameterMessageDllName() - Return the dll name containing strings for language independent insertion strings of the ith item
PARENT: ARRAY_LIST_OF( SOURCE_INFO_ITEM )
USES:
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 8/25/92 Created
**************************************************************************/
DLL_CLASS SOURCE_INFO_ARRAY : public ARRAY_LIST_OF( SOURCE_INFO_ITEM_PTR ) { public: SOURCE_INFO_ARRAY( UINT cElem ) : ARRAY_LIST_OF(SOURCE_INFO_ITEM_PTR )( cElem ) { }
const NLS_STR *QuerySource( INT i ) const { return ((*this)[i])->QuerySource(); }
USHORT QueryTypeMask( INT i ) const { return ((*this)[i])->QueryTypeMask(); }
const NLS_STR *QueryCategoryDllName( INT i ) const { return ((*this)[i])->QueryCategoryDllName(); }
USHORT QueryCategoryCount( INT i ) const { return ((*this)[i])->QueryCategoryCount(); }
STRLIST *QueryCategoryList( INT i ) const { return ((*this)[i])->QueryCategoryList(); }
STRLIST *QueryEventDllList( INT i ) const { return ((*this)[i])->QueryEventDllList(); }
const NLS_STR *QueryParameterMessageDllName( INT i ) const { return ((*this)[i])->QueryParameterMessageDllName(); } };
/*************************************************************************
NAME: LOG_REGISTRY_INFO
SYNOPSIS: The class for storing all the information contained in the registry under the given module (system, security...).
INTERFACE: LOG_REGISTRY_INFO() - Constructor ~LOG_REGISTRY_INFO() - Destructor
Init() - 2nd stage constructor
SubstituteParameterID - Find all %%num in the given string with appropriate strings.
MapEventIDToString() - Get the description associated with the string MapCategoryToString() - Get the string associated with the string
GetSrcSupportedTypeMask() - Get the type mask supported by the given source GetSrcSupportedCategoryList() - Get all categories supported by the given source GetSourceList() - Get the sources supported under the given module
PARENT: BASE
USES: NLS_STR, STRLIST, DLL_HANDLE_CACHE_ARRAY, REG_KEY, SOURCE_INFO_ARRAY
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 2/25/92 Created
**************************************************************************/
DLL_CLASS LOG_REGISTRY_INFO : public BASE { private: //
// The server that we are reading the registry from
//
NLS_STR _nlsServer;
//
// The module in the registry
//
NLS_STR _nlsModule;
//
// If the server points to a remote machine,
// then this will contain the path to %SystemRoot%.
// Else this will contain a NULL string which will not be used.
//
NLS_STR _nlsRemoteSystemRoot;
//
// The array to cache the handles used by the eventlog to get the
// description of each log entry.
//
DLL_HANDLE_CACHE_ARRAY _aDllHandleCache;
//
// Pointer to an array of SOURCE_INFO_ITEM
//
SOURCE_INFO_ARRAY *_paSourceInfo;
//
// The index of the primary module in the array pointed by _paSourceInfo
//
INT _iPrimarySource;
//
// Pointer to a strlst containing all sources under the module
//
STRLIST *_pstrlstSource;
//
// Pointer to the registry key of module
//
REG_KEY *_pRegKeyFocusModule;
//
// Get the registry key of module on the server
//
APIERR GetRegKeyModule( const TCHAR *pszServer, REG_KEY **ppRegKeyModule );
//
// Get the handle of the given dll
//
APIERR GetLibHandle( const TCHAR *pszLibName, HMODULE *pHandle );
//
// Expand %SystemRoot% that is contained in pszPath
//
APIERR ExpandSystemRoot( const TCHAR *pszPath, NLS_STR *pnls );
//
// Get %SystemRoot% from the remote registry. This is used only
// if we are reading the registry from the remote machine.
//
APIERR GetRemoteSystemRoot( NLS_STR *pnls );
//
// Initialize the SOURCE_INFO_ITEM at (*_paSourceInfo)[index]
//
APIERR InitSource( INT index );
//
// Initialize the category list at (*_paSourceInfo)[index]
//
APIERR InitCategoryList( INT index );
//
// Get the source name at (*_paSourceInfo)[index]
//
INT QuerySourceIndex( const TCHAR *pszSource );
//
// Returns TRUE if the primary source exists in the registry
//
BOOL PrimarySourceExist( VOID ) { return _iPrimarySource >= 0; }
//
// Returns TRUE if the index is the same as the primary source index
//
BOOL IsPrimarySource( INT index ) { return index == _iPrimarySource; }
//
// Get the string associated with the id in the dll
//
APIERR RetrieveMessage( HMODULE handle, ULONG nID, NLS_STR *pnls );
//
// Get the string associated with nMessageID in the source
//
APIERR MapParameterToString( const TCHAR *pszSource, ULONG nMessageID, NLS_STR *pnls );
public: LOG_REGISTRY_INFO( const NLS_STR &nlsServer, const NLS_STR &nlsModule );
~LOG_REGISTRY_INFO();
APIERR Init( VOID );
APIERR SubstituteParameterID( const TCHAR *pszSource, NLS_STR *pnls );
APIERR MapEventIDToString ( const TCHAR *pszSource, ULONG ulEventID, NLS_STR *pnls );
APIERR MapCategoryToString ( const TCHAR *pszSource, USHORT usCategory, NLS_STR *pnls );
APIERR GetSrcSupportedTypeMask( const TCHAR *pszSource, USHORT *pusTypeMask );
APIERR GetSrcSupportedCategoryList( const TCHAR *pszSource, STRLIST **ppstrlstCategory );
STRLIST *GetSourceList( VOID ) { return _pstrlstSource; }
};
/*************************************************************************
NAME: NT_EVENT_LOG
SYNOPSIS: The class for NT Event Log
INTERFACE: protected: I_Next() - Helper method for reading the log file I_Open() - Helper method for opening the handle to the event log I_Close()- Helper method for closing the handle to the event log
CreateCurrentRawEntry() - Create a RAW_LOG_ENTRY for the current log entry. This is used when filtering log files. SetPos() - Set the position for the next read. QueryCurrentEntryCategory() - Get the category of the current log entry QueryCurrentEntryTypeString() - Retrieve the type of the current log entry QueryCurrentEntryUser() - Get the user of the current log entry
NextString() - Iterator for returning the strings in the current log entry.
public: NT_EVENT_LOG() - Constructor ~NT_EVENT_LOG() - Destructor
Clear() - Clear the event log Backup() - Back up the event log without clearing the log file Reset() - Reset to the beginning or end of log depending on direction
QueryPos() - Get the position of the current event log entry Direction is not important on NT.
SeekOldestLogEntry() - Get the oldest log entry in the log SeekNewestLogEntry() - Get the newest log entry in the log QueryNumberOfEntries() - Get the number of entries in the log
CreateCurrentFormatEntry() - Create a FORMATTED_LOG_ENTRY for the current log entry.
WriteTextEntry() - Write the current log entry to a text file JonN 6/22/00 WriteTextEntry no longer supported
QueryCurrentEntryData() - Retrieve the raw data of the current log entry QueryCurrentEntryDesc() - Get the description of the current log entry QueryCurrentEntryTime() - Get the time of the current log entry
IsBackup() - True if we want to open a backup log file
QuerySourceList() - Return the sources supported by the module
QuerySrcSupportedTypeMask() - Query the type mask supported by the given source QuerySrcSupportedCategoryList() - Query the category list supported by the given source
PARENT: EVENT_LOG
USES:
CAVEATS:
NOTES:
HISTORY: Yi-HsinS 10/15/91 Created
**************************************************************************/
DLL_CLASS NT_EVENT_LOG : public EVENT_LOG { private: //
// Handle to the NT event log
//
HANDLE _handle;
//
// Buffer containing a whole amount of event log entries returned
// by a net API call.
//
BUFFER _buf;
//
// Points to the current log entry inside the buffer _buf
//
EVENTLOGRECORD *_pEL;
//
// the offset(bytes) in the buffer in which the next log entry starts
//
ULONG _cbOffset;
//
// the number of bytes returned from the last read
//
ULONG _cbReturned;
//
// the minimum number of bytes needed for the next read
//
ULONG _cbMinBytesNeeded;
//
// The index of the next string to be retrieved by NextString()
//
UINT _iStrings;
//
// The log number to read in the case of seek read
//
ULONG _ulRecSeek;
//
// TRUE if we want to open a backup file
//
BOOL _fBackup;
//
// Registry Information needed to get the description of log entries
//
LOG_REGISTRY_INFO _logRegistryInfo;
//
// The following for translating SIDS to readable names
//
LSA_POLICY _lsaPolicy; LSA_TRANSLATED_NAME_MEM _lsatnm; LSA_REF_DOMAIN_MEM _lsardm; NLS_STR _nlsAccountDomain; UINT _cCountUsers;
//
// The following is used to get the alert description and source name
// for Cairo alerts.
//
HINSTANCE _hinstanceSysmgmt; PASGETALERTDESCRIPTION _pAsGetAlertDescription; PASGETALERTSOURCENAME _pAsGetAlertSourceName;
protected: virtual APIERR I_Next( BOOL *pfContinue, ULONG ulBufferSize = BIG_BUF_DEFAULT_SIZE ); virtual APIERR I_Open( VOID ); virtual APIERR I_Close( VOID );
virtual APIERR CreateCurrentRawEntry( RAW_LOG_ENTRY *pRawLogEntry ); virtual VOID SetPos( const LOG_ENTRY_NUMBER &logEntryNum, BOOL fForceRead );
APIERR QueryCurrentEntryCategory( NLS_STR *pnlsCategory ); APIERR QueryCurrentEntryTypeString( NLS_STR *pnlsType ); APIERR QueryCurrentEntryUser( NLS_STR *pnlsUser );
//
// Iterator to return the next string in the current log.
// Returns FALSE if some error occurs or if there are no more strings left.
// Need to QueryLastError() to distinguish between the two cases.
//
APIERR NextString( BOOL *pfContinue, NLS_STR **ppnlsString );
//
// The following method is used to get the proc address of alert functions
// AsGetAlertdescription and AsGetAlertSourceName
//
APIERR GetProcAddressOfAlertFuctions( VOID );
public: //
// Constructor : takes a server name,
// an optional direction which defaults to EVLOG_FWD,
// a module name needed for NT Event Log,
// and a module name needed for reading the registry.
// If pszModule and pszRegistryModule don't point to the
// same place, then we are reading a backup event log.
//
NT_EVENT_LOG( const TCHAR *pszServer, EVLOG_DIRECTION evdir = EVLOG_FWD, const TCHAR *pszModule = NULL, const TCHAR *pszRegistryModule = NULL );
virtual ~NT_EVENT_LOG();
//
// See comments in EVENT_LOG
//
virtual APIERR Clear( const TCHAR *pszBackupFile = NULL ); virtual APIERR Backup( const TCHAR *pszBackupFile ); virtual VOID Reset( VOID );
virtual APIERR QueryPos( LOG_ENTRY_NUMBER *plogEntryNum ); virtual APIERR SeekOldestLogEntry( VOID ); virtual APIERR SeekNewestLogEntry( VOID ); virtual APIERR QueryNumberOfEntries( ULONG *pcEntries );
virtual APIERR CreateCurrentFormatEntry( FORMATTED_LOG_ENTRY **ppFmtLogEntry );
// JonN 6/22/00 WriteTextEntry no longer supported
virtual APIERR WriteTextEntry( ULONG ulFileHandle, INTL_PROFILE &intlprof, TCHAR chSeparator );
virtual ULONG QueryCurrentEntryData( BYTE **ppbDataOut ); virtual APIERR QueryCurrentEntryDesc( NLS_STR *pnlsDesc ); virtual ULONG QueryCurrentEntryTime( VOID );
BOOL IsBackup( VOID ) { return _fBackup; }
virtual STRLIST *QuerySourceList( VOID );
virtual APIERR QuerySrcSupportedTypeMask( const NLS_STR &nlsSource, USHORT *pusTypeMask );
virtual APIERR QuerySrcSupportedCategoryList( const NLS_STR &nlsSource, STRLIST **ppstrlstCategory ); };
#endif
|