- Update structs and flags to correct names based on documentation.

svn path=/trunk/; revision=38327
This commit is contained in:
Michael Martin 2008-12-24 12:14:30 +00:00
parent 5759ff871c
commit 21c30014ed
4 changed files with 89 additions and 91 deletions

View file

@ -271,24 +271,24 @@ VOID SystemTimeToEventTime(SYSTEMTIME * pSystemTime, DWORD * pEventTime)
*pEventTime = (Time.ll - u1970.ll) / 10000000;
}
VOID PRINT_HEADER(PFILE_HEADER header)
VOID PRINT_HEADER(PEVENTLOGHEADER header)
{
DPRINT("SizeOfHeader = %d\n", header->SizeOfHeader);
DPRINT("HeaderSize = %d\n", header->HeaderSize);
DPRINT("Signature = 0x%x\n", header->Signature);
DPRINT("MajorVersion = %d\n", header->MajorVersion);
DPRINT("MinorVersion = %d\n", header->MinorVersion);
DPRINT("FirstRecordOffset = %d\n", header->FirstRecordOffset);
DPRINT("EofOffset = 0x%x\n", header->EofOffset);
DPRINT("NextRecord = %d\n", header->NextRecord);
DPRINT("OldestRecord = %d\n", header->OldestRecord);
DPRINT("unknown1 = 0x%x\n", header->unknown1);
DPRINT("unknown2 = 0x%x\n", header->unknown2);
DPRINT("SizeOfHeader2 = %d\n", header->SizeOfHeader2);
DPRINT("StartOffset = %d\n", header->StartOffset);
DPRINT("EndOffset = 0x%x\n", header->EndOffset);
DPRINT("CurrentRecordNumber = %d\n", header->CurrentRecordNumber);
DPRINT("OldestRecordNumber = %d\n", header->OldestRecordNumber);
DPRINT("MaxSize = 0x%x\n", header->MaxSize);
DPRINT("Retention = 0x%x\n", header->Retention);
DPRINT("EndHeaderSize = %d\n", header->EndHeaderSize);
DPRINT("Flags: ");
if (header->Flags & LOGFILE_FLAG1) DPRINT("LOGFILE_FLAG1 ");
if (header->Flags & LOGFILE_FLAG2) DPRINT("| LOGFILE_FLAG2 ");
if (header->Flags & LOGFILE_FLAG3) DPRINT("| LOGFILE_FLAG3 ");
if (header->Flags & LOGFILE_FLAG4) DPRINT("| LOGFILE_FLAG4");
if (header->Flags & ELF_LOGFILE_HEADER_DIRTY) DPRINT("ELF_LOGFILE_HEADER_DIRTY");
if (header->Flags & ELF_LOGFILE_HEADER_WRAP) DPRINT("| ELF_LOGFILE_HEADER_WRAP ");
if (header->Flags & ELF_LOGGFILE_LOGFULL_WRITTEN) DPRINT("| ELF_LOGGFILE_LOGFULL_WRITTEN ");
if (header->Flags & ELF_LOGFILE_ARCHIVE_SET) DPRINT("| ELF_LOGFILE_ARCHIVE_SET ");
DPRINT("\n");
}

View file

@ -36,43 +36,41 @@ typedef struct _IO_ERROR_LPC
#define LOGFILE_SIGNATURE 0x654c664c
/*
* FIXME
* Flags used in logfile header
*/
#define LOGFILE_FLAG1 1
#define LOGFILE_FLAG2 2
#define LOGFILE_FLAG3 4
#define LOGFILE_FLAG4 8
#define ELF_LOGFILE_HEADER_DIRTY 1
#define ELF_LOGFILE_HEADER_WRAP 2
#define ELF_LOGGFILE_LOGFULL_WRITTEN 4
#define ELF_LOGFILE_ARCHIVE_SET 8
typedef struct
{
DWORD SizeOfHeader;
DWORD Signature;
DWORD MajorVersion;
DWORD MinorVersion;
DWORD FirstRecordOffset;
DWORD EofOffset;
DWORD NextRecord;
DWORD OldestRecord;
DWORD unknown1;
DWORD Flags;
DWORD unknown2;
DWORD SizeOfHeader2;
} FILE_HEADER, *PFILE_HEADER;
/* FIXME: MSDN reads that the following two structs are in winnt.h. Are they? */
typedef struct _EVENTLOGHEADER {
ULONG HeaderSize;
ULONG Signature;
ULONG MajorVersion;
ULONG MinorVersion;
ULONG StartOffset;
ULONG EndOffset;
ULONG CurrentRecordNumber;
ULONG OldestRecordNumber;
ULONG MaxSize;
ULONG Flags;
ULONG Retention;
ULONG EndHeaderSize;
} EVENTLOGHEADER, *PEVENTLOGHEADER;
typedef struct
{
DWORD Size1;
DWORD Ones; // Must be 0x11111111
DWORD Twos; // Must be 0x22222222
DWORD Threes; // Must be 0x33333333
DWORD Fours; // Must be 0x44444444
DWORD StartOffset;
DWORD EndOffset;
DWORD NextRecordNumber;
DWORD OldestRecordNumber;
DWORD Size2;
} EOF_RECORD, *PEOF_RECORD;
typedef struct _EVENTLOGEOF {
ULONG RecordSizeBeginning;
ULONG Ones;
ULONG Twos;
ULONG Threes;
ULONG Fours;
ULONG BeginRecord;
ULONG EndRecord;
ULONG CurrentRecordNumber;
ULONG OldestRecordNumber;
ULONG RecordSizeEnd;
} EVENTLOGEOF, *PEVENTLOGEOF;
typedef struct
{
@ -83,7 +81,7 @@ typedef struct
typedef struct
{
HANDLE hFile;
FILE_HEADER Header;
EVENTLOGHEADER Header;
WCHAR *LogName;
WCHAR *FileName;
CRITICAL_SECTION cs;
@ -165,7 +163,7 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
/* eventlog.c */
extern HANDLE MyHeap;
VOID PRINT_HEADER(PFILE_HEADER header);
VOID PRINT_HEADER(PEVENTLOGHEADER header);
VOID PRINT_RECORD(PEVENTLOGRECORD pRec);

View file

@ -20,24 +20,24 @@ static CRITICAL_SECTION LogFileListCs;
BOOL LogfInitializeNew(PLOGFILE LogFile)
{
DWORD dwWritten;
EOF_RECORD EofRec;
EVENTLOGEOF EofRec;
ZeroMemory(&LogFile->Header, sizeof(FILE_HEADER));
ZeroMemory(&LogFile->Header, sizeof(EVENTLOGHEADER));
SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN);
SetEndOfFile(LogFile->hFile);
LogFile->Header.SizeOfHeader = sizeof(FILE_HEADER);
LogFile->Header.SizeOfHeader2 = sizeof(FILE_HEADER);
LogFile->Header.FirstRecordOffset = sizeof(FILE_HEADER);
LogFile->Header.EofOffset = sizeof(FILE_HEADER);
LogFile->Header.HeaderSize = sizeof(EVENTLOGHEADER);
LogFile->Header.EndHeaderSize = sizeof(EVENTLOGHEADER);
LogFile->Header.StartOffset = sizeof(EVENTLOGHEADER);
LogFile->Header.EndOffset = sizeof(EVENTLOGHEADER);
LogFile->Header.MajorVersion = MAJORVER;
LogFile->Header.MinorVersion = MINORVER;
LogFile->Header.NextRecord = 1;
LogFile->Header.CurrentRecordNumber = 1;
LogFile->Header.Signature = LOGFILE_SIGNATURE;
if (!WriteFile(LogFile->hFile,
&LogFile->Header,
sizeof(FILE_HEADER),
sizeof(EVENTLOGHEADER),
&dwWritten,
NULL))
{
@ -49,16 +49,16 @@ BOOL LogfInitializeNew(PLOGFILE LogFile)
EofRec.Twos = 0x22222222;
EofRec.Threes = 0x33333333;
EofRec.Fours = 0x44444444;
EofRec.Size1 = sizeof(EOF_RECORD);
EofRec.Size2 = sizeof(EOF_RECORD);
EofRec.NextRecordNumber = LogFile->Header.NextRecord;
EofRec.OldestRecordNumber = LogFile->Header.OldestRecord;
EofRec.StartOffset = LogFile->Header.FirstRecordOffset;
EofRec.EndOffset = LogFile->Header.EofOffset;
EofRec.RecordSizeBeginning = sizeof(EVENTLOGEOF);
EofRec.RecordSizeEnd = sizeof(EVENTLOGEOF);
EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
EofRec.OldestRecordNumber = LogFile->Header.OldestRecordNumber;
EofRec.BeginRecord = LogFile->Header.StartOffset;
EofRec.EndRecord = LogFile->Header.EndOffset;
if (!WriteFile(LogFile->hFile,
&EofRec,
sizeof(EOF_RECORD),
sizeof(EVENTLOGEOF),
&dwWritten,
NULL))
{
@ -92,7 +92,7 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
if (!ReadFile(LogFile->hFile,
&LogFile->Header,
sizeof(FILE_HEADER),
sizeof(EVENTLOGHEADER),
&dwRead,
NULL))
{
@ -100,14 +100,14 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
return FALSE;
}
if (dwRead != sizeof(FILE_HEADER))
if (dwRead != sizeof(EVENTLOGHEADER))
{
DPRINT("EventLog: Invalid file %S.\n", LogFile->FileName);
return LogfInitializeNew(LogFile);
}
if (LogFile->Header.SizeOfHeader != sizeof(FILE_HEADER) ||
LogFile->Header.SizeOfHeader2 != sizeof(FILE_HEADER))
if (LogFile->Header.HeaderSize != sizeof(EVENTLOGHEADER) ||
LogFile->Header.EndHeaderSize != sizeof(EVENTLOGHEADER))
{
DPRINT("EventLog: Invalid header size in %S.\n", LogFile->FileName);
return LogfInitializeNew(LogFile);
@ -120,10 +120,10 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
return LogfInitializeNew(LogFile);
}
if (LogFile->Header.EofOffset > GetFileSize(LogFile->hFile, NULL) + 1)
if (LogFile->Header.EndOffset > GetFileSize(LogFile->hFile, NULL) + 1)
{
DPRINT("EventLog: Invalid eof offset %x in %S.\n",
LogFile->Header.EofOffset, LogFile->FileName);
LogFile->Header.EndOffset, LogFile->FileName);
return LogfInitializeNew(LogFile);
}
@ -204,7 +204,7 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
if (*pdwRecSize2 != dwRecSize)
{
DPRINT1("Invalid size2 of record %d (%x) in %S\n",
DPRINT1("Invalid RecordSizeEnd of record %d (%x) in %S\n",
dwRecordsNumber, *pdwRecSize2, LogFile->LogName);
HeapFree(MyHeap, 0, RecBuf);
break;
@ -224,8 +224,8 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
HeapFree(MyHeap, 0, RecBuf);
} // for(;;)
LogFile->Header.NextRecord = dwRecordsNumber + 1;
LogFile->Header.OldestRecord = dwRecordsNumber ? 1 : 0; // FIXME
LogFile->Header.CurrentRecordNumber = dwRecordsNumber + 1;
LogFile->Header.OldestRecordNumber = dwRecordsNumber ? 1 : 0; // FIXME
if (!SetFilePointer(LogFile->hFile, 0, NULL, FILE_CURRENT) ==
INVALID_SET_FILE_POINTER)
@ -236,7 +236,7 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
if (!WriteFile(LogFile->hFile,
&LogFile->Header,
sizeof(FILE_HEADER),
sizeof(EVENTLOGHEADER),
&dwRead,
NULL))
{
@ -648,7 +648,7 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
{
DWORD dwWritten;
SYSTEMTIME st;
EOF_RECORD EofRec;
EVENTLOGEOF EofRec;
if (!Buffer)
return FALSE;
@ -659,7 +659,7 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
EnterCriticalSection(&LogFile->cs);
if (SetFilePointer(LogFile->hFile,
LogFile->Header.EofOffset,
LogFile->Header.EndOffset,
NULL,
FILE_BEGIN) == INVALID_SET_FILE_POINTER)
{
@ -676,33 +676,33 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
}
if (!LogfAddOffsetInformation(LogFile,
LogFile->Header.NextRecord,
LogFile->Header.EofOffset))
LogFile->Header.CurrentRecordNumber,
LogFile->Header.EndOffset))
{
LeaveCriticalSection(&LogFile->cs);
return FALSE;
}
LogFile->Header.NextRecord++;
LogFile->Header.EofOffset += dwWritten;
LogFile->Header.CurrentRecordNumber++;
LogFile->Header.EndOffset += dwWritten;
if (LogFile->Header.OldestRecord == 0)
LogFile->Header.OldestRecord = 1;
if (LogFile->Header.OldestRecordNumber == 0)
LogFile->Header.OldestRecordNumber = 1;
EofRec.Ones = 0x11111111;
EofRec.Twos = 0x22222222;
EofRec.Threes = 0x33333333;
EofRec.Fours = 0x44444444;
EofRec.Size1 = sizeof(EOF_RECORD);
EofRec.Size2 = sizeof(EOF_RECORD);
EofRec.NextRecordNumber = LogFile->Header.NextRecord;
EofRec.OldestRecordNumber = LogFile->Header.OldestRecord;
EofRec.StartOffset = LogFile->Header.FirstRecordOffset;
EofRec.EndOffset = LogFile->Header.EofOffset;
EofRec.RecordSizeBeginning = sizeof(EVENTLOGEOF);
EofRec.RecordSizeEnd = sizeof(EVENTLOGEOF);
EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber;
EofRec.OldestRecordNumber = LogFile->Header.OldestRecordNumber;
EofRec.BeginRecord = LogFile->Header.StartOffset;
EofRec.EndRecord = LogFile->Header.EndOffset;
if (!WriteFile(LogFile->hFile,
&EofRec,
sizeof(EOF_RECORD),
sizeof(EVENTLOGEOF),
&dwWritten,
NULL))
{
@ -721,7 +721,7 @@ BOOL LogfWriteData(PLOGFILE LogFile, DWORD BufSize, PBYTE Buffer)
if (!WriteFile(LogFile->hFile,
&LogFile->Header,
sizeof(FILE_HEADER),
sizeof(EVENTLOGHEADER),
&dwWritten,
NULL))
{
@ -757,7 +757,7 @@ ULONG LogfOffsetByNumber(PLOGFILE LogFile, DWORD RecordNumber)
DWORD LogfGetOldestRecord(PLOGFILE LogFile)
{
return LogFile->Header.OldestRecord;
return LogFile->Header.OldestRecordNumber;
}
BOOL LogfAddOffsetInformation(PLOGFILE LogFile, ULONG ulNumber, ULONG ulOffset)

View file

@ -143,7 +143,7 @@ NTSTATUS ProcessPortMessage(VOID)
{
DPRINT("Received datagram\n");
Message = (PIO_ERROR_LOG_MESSAGE) & Request.Message;
ulRecNum = SystemLog ? SystemLog->Header.NextRecord : 0;
ulRecNum = SystemLog ? SystemLog->Header.CurrentRecordNumber : 0;
pRec = (PEVENTLOGRECORD) LogfAllocAndBuildNewRecord(&dwRecSize,
ulRecNum, Message->Type, Message->EntryData.EventCategory,