[EVENTLOG]

- Add event sources "EventLog" and "Service Control Manager" to the registry.
- Implement an internal event reporting function and report the successful start of the event logging service.

svn path=/trunk/; revision=51529
This commit is contained in:
Eric Kohl 2011-05-01 13:35:51 +00:00
parent 18ea9e1c9d
commit 957e387479
4 changed files with 64 additions and 0 deletions

View file

@ -168,6 +168,10 @@ ServiceMain(DWORD argc,
{
DPRINT("Service started\n");
UpdateServiceStatus(SERVICE_RUNNING);
LogfReportEvent(EVENTLOG_INFORMATION_TYPE,
0,
EVENT_EventlogStarted);
}
DPRINT("ServiceMain() done\n");

View file

@ -13,6 +13,7 @@
#define WIN32_NO_STATUS
#include <windows.h>
#include <netevent.h>
#include <lpctypes.h>
#include <lpcfuncs.h>
#include <rtlfuncs.h>
@ -177,6 +178,11 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
DWORD dwDataSize,
LPVOID lpRawData);
VOID
LogfReportEvent(WORD wType,
WORD wCategory,
DWORD dwEventId);
/* eventlog.c */
extern HANDLE MyHeap;

View file

@ -1049,3 +1049,53 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
*lpRecSize = dwRecSize;
return Buffer;
}
VOID
LogfReportEvent(WORD wType,
WORD wCategory,
DWORD dwEventId)
{
WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
DWORD dwComputerNameLength = MAX_COMPUTERNAME_LENGTH + 1;
PEVENTSOURCE pEventSource = NULL;
PBYTE logBuffer;
DWORD lastRec;
DWORD recSize;
DWORD dwError;
if (!GetComputerNameW(szComputerName, &dwComputerNameLength))
{
szComputerName[0] = 0;
}
pEventSource = GetEventSourceByName(L"EventLog");
if (pEventSource == NULL)
{
return;
}
lastRec = LogfGetCurrentRecord(pEventSource->LogFile);
logBuffer = LogfAllocAndBuildNewRecord(&recSize,
lastRec,
wType,
wCategory,
dwEventId,
pEventSource->szName,
(LPCWSTR)szComputerName,
0,
NULL,
0, //wNumStrings,
NULL, //lpStrings,
0, //dwDataSize,
NULL); //lpRawData);
dwError = LogfWriteData(pEventSource->LogFile, recSize, logBuffer);
if (!dwError)
{
DPRINT1("ERROR WRITING TO EventLog %S\n", pEventSource->LogFile->FileName);
}
LogfFreeRecord(logBuffer);
}

View file

@ -1148,10 +1148,14 @@ HKLM,"SYSTEM\CurrentControlSet\Services\EventLog","Type",0x00010001,0x00000010
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Application",,0x00000010
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Application","File",0x00020000,"%SystemRoot%\system32\config\AppEvent.Evt"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Application\Service Control Manager","EventMessageFile",0x00020000,"%SystemRoot%\system32\netevent.dll"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Application\Service Control Manager","TypesSupported",0x00010001,0x00000007
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Security",,0x00000010
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Security","File",0x00020000,"%SystemRoot%\system32\config\SecEvent.Evt"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System",,0x00000010
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System","File",0x00020000,"%SystemRoot%\system32\config\SysEvent.Evt"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\EventLog","EventMessageFile",0x00020000,"%SystemRoot%\system32\netevent.dll"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\EventLog","TypesSupported",0x00010001,0x00000007
; Floppy driver
HKLM,"SYSTEM\CurrentControlSet\Services\Floppy","ErrorControl",0x00010001,0x00000000