1 /**
2  * This file has no copyright assigned and is placed in the Public Domain.
3  * This file is part of the mingw-w64 runtime package.
4  * No warranty is given; refer to the file DISCLAIMER.PD within this package.
5  */
6 #ifndef _INC_WINEVT
7 #define _INC_WINEVT
8 #if (_WIN32_WINNT >= 0x0600)
9 
10 #ifdef __cplusplus
11 extern "C" {
12 #endif
13 
14 typedef enum _EVT_CHANNEL_CLOCK_TYPE {
15   EvtChannelClockTypeSystemTime   = 0,
16   EvtChannelClockTypeQPC          = 1
17 } EVT_CHANNEL_CLOCK_TYPE;
18 
19 typedef enum _EVT_CHANNEL_CONFIG_PROPERTY_ID {
20   EvtChannelConfigEnabled                 = 0,
21   EvtChannelConfigIsolation               = 1,
22   EvtChannelConfigType                    = 2,
23   EvtChannelConfigOwningPublisher         = 3,
24   EvtChannelConfigClassicEventlog         = 4,
25   EvtChannelConfigAccess                  = 5,
26   EvtChannelLoggingConfigRetention        = 6,
27   EvtChannelLoggingConfigAutoBackup       = 7,
28   EvtChannelLoggingConfigMaxSize          = 8,
29   EvtChannelLoggingConfigLogFilePath      = 9,
30   EvtChannelPublishingConfigLevel         = 10,
31   EvtChannelPublishingConfigKeywords      = 11,
32   EvtChannelPublishingConfigControlGuid   = 12,
33   EvtChannelPublishingConfigBufferSize    = 13,
34   EvtChannelPublishingConfigMinBuffers    = 14,
35   EvtChannelPublishingConfigMaxBuffers    = 15,
36   EvtChannelPublishingConfigLatency       = 16,
37   EvtChannelPublishingConfigClockType     = 17,
38   EvtChannelPublishingConfigSidType       = 18,
39   EvtChannelPublisherList                 = 19,
40   EvtChannelPublishingConfigFileMax       = 20,
41   EvtChannelConfigPropertyIdEND           = 21
42 } EVT_CHANNEL_CONFIG_PROPERTY_ID;
43 
44 typedef enum _EVT_CHANNEL_ISOLATION_TYPE {
45   EvtChannelIsolationTypeApplication   = 0,
46   EvtChannelIsolationTypeSystem        = 1,
47   EvtChannelIsolationTypeCustom        = 2
48 } EVT_CHANNEL_ISOLATION_TYPE;
49 
50 typedef enum _EVT_CHANNEL_REFERENCE_FLAGS {
51   EvtChannelReferenceImported   = 0x1
52 } EVT_CHANNEL_REFERENCE_FLAGS;
53 
54 typedef enum _EVT_CHANNEL_SID_TYPE {
55   EvtChannelSidTypeNone         = 0,
56   EvtChannelSidTypePublishing   = 1
57 } EVT_CHANNEL_SID_TYPE;
58 
59 typedef enum _EVT_CHANNEL_TYPE {
60   EvtChannelTypeAdmin         = 0,
61   EvtChannelTypeOperational   = 1,
62   EvtChannelTypeAnalytic      = 2,
63   EvtChannelTypeDebug         = 3
64 } EVT_CHANNEL_TYPE;
65 
66 typedef enum _EVT_EVENT_METADATA_PROPERTY_ID {
67   EventMetadataEventID            = 0,
68   EventMetadataEventVersion       = 1,
69   EventMetadataEventChannel       = 2,
70   EventMetadataEventLevel         = 3,
71   EventMetadataEventOpcode        = 4,
72   EventMetadataEventTask          = 5,
73   EventMetadataEventKeyword       = 6,
74   EventMetadataEventMessageID     = 7,
75   EventMetadataEventTemplate      = 8,
76   EvtEventMetadataPropertyIdEND   = 9
77 } EVT_EVENT_METADATA_PROPERTY_ID;
78 
79 typedef enum _EVT_EVENT_PROPERTY_ID {
80   EvtEventQueryIDs        = 0,
81   EvtEventPath            = 1,
82   EvtEventPropertyIdEND   = 2
83 } EVT_EVENT_PROPERTY_ID;
84 
85 typedef enum _EVT_EXPORTLOG_FLAGS {
86   EvtExportLogChannelPath           = 0x1,
87   EvtExportLogFilePath              = 0x2,
88   EvtExportLogTolerateQueryErrors   = 0x1000
89 } EVT_EXPORTLOG_FLAGS;
90 
91 typedef enum _EVT_FORMAT_MESSAGE_FLAGS {
92   EvtFormatMessageEvent      = 1,
93   EvtFormatMessageLevel      = 2,
94   EvtFormatMessageTask       = 3,
95   EvtFormatMessageOpcode     = 4,
96   EvtFormatMessageKeyword    = 5,
97   EvtFormatMessageChannel    = 6,
98   EvtFormatMessageProvider   = 7,
99   EvtFormatMessageId         = 8,
100   EvtFormatMessageXml        = 9
101 } EVT_FORMAT_MESSAGE_FLAGS;
102 
103 typedef enum _EVT_LOG_PROPERTY_ID {
104   EvtLogCreationTime         = 0,
105   EvtLogLastAccessTime       = 1,
106   EvtLogLastWriteTime        = 2,
107   EvtLogFileSize             = 3,
108   EvtLogAttributes           = 4,
109   EvtLogNumberOfLogRecords   = 5,
110   EvtLogOldestRecordNumber   = 6,
111   EvtLogFull                 = 7
112 } EVT_LOG_PROPERTY_ID;
113 
114 typedef enum _EVT_LOGIN_CLASS {
115   EvtRpcLogin   = 1
116 } EVT_LOGIN_CLASS;
117 
118 typedef enum _EVT_OPEN_LOG_FLAGS {
119   EvtOpenChannelPath   = 0x1,
120   EvtOpenFilePath      = 0x2
121 } EVT_OPEN_LOG_FLAGS;
122 
123 typedef enum _EVT_PUBLISHER_METADATA_PROPERTY_ID {
124   EvtPublisherMetadataPublisherGuid               = 0,
125   EvtPublisherMetadataResourceFilePath,
126   EvtPublisherMetadataParameterFilePath,
127   EvtPublisherMetadataMessageFilePath,
128   EvtPublisherMetadataHelpLink,
129   EvtPublisherMetadataPublisherMessageID,
130   EvtPublisherMetadataChannelReferences,
131   EvtPublisherMetadataChannelReferencePath,
132   EvtPublisherMetadataChannelReferenceIndex,
133   EvtPublisherMetadataChannelReferenceID,
134   EvtPublisherMetadataChannelReferenceFlags,
135   EvtPublisherMetadataChannelReferenceMessageID,
136   EvtPublisherMetadataLevels,
137   EvtPublisherMetadataLevelName,
138   EvtPublisherMetadataLevelValue,
139   EvtPublisherMetadataLevelMessageID,
140   EvtPublisherMetadataTasks,
141   EvtPublisherMetadataTaskName,
142   EvtPublisherMetadataTaskEventGuid,
143   EvtPublisherMetadataTaskValue,
144   EvtPublisherMetadataTaskMessageID,
145   EvtPublisherMetadataOpcodes,
146   EvtPublisherMetadataOpcodeName,
147   EvtPublisherMetadataOpcodeValue,
148   EvtPublisherMetadataOpcodeMessageID,
149   EvtPublisherMetadataKeywords,
150   EvtPublisherMetadataKeywordName,
151   EvtPublisherMetadataKeywordValue,
152   EvtPublisherMetadataKeywordMessageID,
153   EvtPublisherMetadataPropertyIdEND
154 } EVT_PUBLISHER_METADATA_PROPERTY_ID;
155 
156 typedef enum _EVT_QUERY_FLAGS {
157   EvtQueryChannelPath           = 0x1,
158   EvtQueryFilePath              = 0x2,
159   EvtQueryForwardDirection      = 0x100,
160   EvtQueryReverseDirection      = 0x200,
161   EvtQueryTolerateQueryErrors   = 0x1000
162 } EVT_QUERY_FLAGS;
163 
164 typedef enum _EVT_QUERY_PROPERTY_ID {
165   EvtQueryNames           = 0,
166   EvtQueryStatuses        = 1,
167   EvtQueryPropertyIdEND   = 2
168 } EVT_QUERY_PROPERTY_ID;
169 
170 typedef enum _EVT_RENDER_CONTEXT_FLAGS {
171   EvtRenderContextValues   = 0,
172   EvtRenderContextSystem   = 1,
173   EvtRenderContextUser     = 2
174 } EVT_RENDER_CONTEXT_FLAGS;
175 
176 typedef enum _EVT_RENDER_FLAGS {
177   EvtRenderEventValues   = 0,
178   EvtRenderEventXml      = 1,
179   EvtRenderBookmark      = 2
180 } EVT_RENDER_FLAGS;
181 
182 typedef struct _EVT_RPC_LOGIN {
183   LPWSTR Server;
184   LPWSTR User;
185   LPWSTR Domain;
186   LPWSTR Password;
187   DWORD  Flags;
188 } EVT_RPC_LOGIN;
189 
190 typedef enum _EVT_RPC_LOGIN_FLAGS {
191   EvtRpcLoginAuthDefault     = 0,
192   EvtRpcLoginAuthNegotiate   = 1,
193   EvtRpcLoginAuthKerberos    = 2,
194   EvtRpcLoginAuthNTLM        = 3
195 } EVT_RPC_LOGIN_FLAGS;
196 
197 typedef enum _EVT_SEEK_FLAGS {
198   EvtSeekRelativeToFirst      = 1,
199   EvtSeekRelativeToLast       = 2,
200   EvtSeekRelativeToCurrent    = 3,
201   EvtSeekRelativeToBookmark   = 4,
202   EvtSeekOriginMask           = 7,
203   EvtSeekStrict               = 0x10000
204 } EVT_SEEK_FLAGS;
205 
206 typedef enum _EVT_SUBSCRIBE_FLAGS {
207   EvtSubscribeToFutureEvents        = 1,
208   EvtSubscribeStartAtOldestRecord   = 2,
209   EvtSubscribeStartAfterBookmark    = 3,
210   EvtSubscribeOriginMask            = 0x3,
211   EvtSubscribeTolerateQueryErrors   = 0x1000,
212   EvtSubscribeStrict                = 0x10000
213 } EVT_SUBSCRIBE_FLAGS;
214 
215 typedef enum _EVT_SUBSCRIBE_NOTIFY_ACTION {
216   EvtSubscribeActionError     = 0,
217   EvtSubscribeActionDeliver   = 1
218 } EVT_SUBSCRIBE_NOTIFY_ACTION;
219 
220 typedef enum _EVT_SYSTEM_PROPERTY_ID {
221   EvtSystemProviderName        = 0,
222   EvtSystemProviderGuid,
223   EvtSystemEventID,
224   EvtSystemQualifiers,
225   EvtSystemLevel,
226   EvtSystemTask,
227   EvtSystemOpcode,
228   EvtSystemKeywords,
229   EvtSystemTimeCreated,
230   EvtSystemEventRecordId,
231   EvtSystemActivityID,
232   EvtSystemRelatedActivityID,
233   EvtSystemProcessID,
234   EvtSystemThreadID,
235   EvtSystemChannel,
236   EvtSystemComputer,
237   EvtSystemUserID,
238   EvtSystemVersion,
239   EvtSystemPropertyIdEND
240 } EVT_SYSTEM_PROPERTY_ID;
241 
242 typedef enum _EVT_VARIANT_TYPE {
243   EvtVarTypeNull         = 0,
244   EvtVarTypeString       = 1,
245   EvtVarTypeAnsiString   = 2,
246   EvtVarTypeSByte        = 3,
247   EvtVarTypeByte         = 4,
248   EvtVarTypeInt16        = 5,
249   EvtVarTypeUInt16       = 6,
250   EvtVarTypeInt32        = 7,
251   EvtVarTypeUInt32       = 8,
252   EvtVarTypeInt64        = 9,
253   EvtVarTypeUInt64       = 10,
254   EvtVarTypeSingle       = 11,
255   EvtVarTypeDouble       = 12,
256   EvtVarTypeBoolean      = 13,
257   EvtVarTypeBinary       = 14,
258   EvtVarTypeGuid         = 15,
259   EvtVarTypeSizeT        = 16,
260   EvtVarTypeFileTime     = 17,
261   EvtVarTypeSysTime      = 18,
262   EvtVarTypeSid          = 19,
263   EvtVarTypeHexInt32     = 20,
264   EvtVarTypeHexInt64     = 21,
265   EvtVarTypeEvtHandle    = 32,
266   EvtVarTypeEvtXml       = 35
267 } EVT_VARIANT_TYPE;
268 
269 typedef HANDLE EVT_HANDLE;
270 typedef HANDLE EVT_OBJECT_ARRAY_PROPERTY_HANDLE;
271 
272 typedef struct _EVT_VARIANT {
273   __C89_NAMELESS union {
274     WINBOOL    BooleanVal;
275     INT8       SByteVal;
276     INT16      Int16Val;
277     INT32      Int32Val;
278     INT64      Int64Val;
279     UINT8      ByteVal;
280     UINT16     UInt16Val;
281     UINT32     UInt32Val;
282     UINT64     UInt64Val;
283     float      SingleVal;
284     double     DoubleVal;
285     ULONGLONG  FileTimeVal;
286     SYSTEMTIME *SysTimeVal;
287     GUID       *GuidVal;
288     LPCWSTR    StringVal;
289     LPCSTR     AnsiStringVal;
290     PBYTE      BinaryVal;
291     PSID       SidVal;
292     size_t     SizeTVal;
293     EVT_HANDLE EvtHandleVal;
294     BOOL       *BooleanArr;
295     INT8       *SByteArr;
296     INT16      *Int16Arr;
297     INT32      *Int32Arr;
298     INT64      *Int64Arr;
299     UINT8      *ByteArr;
300     UINT16     *UInt16Arr;
301     UINT32     *UInt32Arr;
302     UINT64     *UInt64Arr;
303     float      *SingleArr;
304     double     *DoubleArr;
305     FILETIME   *FileTimeArr;
306     SYSTEMTIME *SysTimeArr;
307     GUID       *GuidArr;
308     LPWSTR     *StringArr;
309     LPSTR      *AnsiStringArr;
310     PSID       *SidArr;
311     size_t     *SizeTArr;
312     LPCWSTR    XmlVal;
313     LPCWSTR*   XmlValArr;
314   };
315   DWORD Count;
316   DWORD Type;
317 } EVT_VARIANT, *PEVT_VARIANT;
318 
319 typedef DWORD ( WINAPI *EVT_SUBSCRIBE_CALLBACK )(
320     EVT_SUBSCRIBE_NOTIFY_ACTION Action,
321     PVOID UserContext,
322     EVT_HANDLE Event
323 );
324 
325 WINBOOL WINAPI EvtArchiveExportedLog(
326   EVT_HANDLE Session,
327   LPCWSTR LogFilePath,
328   LCID Locale,
329   DWORD Flags
330 );
331 
332 WINBOOL WINAPI EvtCancel(
333   EVT_HANDLE Object
334 );
335 
336 WINBOOL WINAPI EvtClearLog(
337   EVT_HANDLE Session,
338   LPCWSTR ChannelPath,
339   LPCWSTR TargetFilePath,
340   DWORD Flags
341 );
342 
343 WINBOOL WINAPI EvtClose(
344   EVT_HANDLE Object
345 );
346 
347 EVT_HANDLE WINAPI EvtCreateBookmark(
348   LPCWSTR BookmarkXml
349 );
350 
351 EVT_HANDLE WINAPI EvtCreateRenderContext(
352   DWORD ValuePathsCount,
353   LPCWSTR *ValuePaths,
354   DWORD Flags
355 );
356 
357 WINBOOL WINAPI EvtExportLog(
358   EVT_HANDLE Session,
359   LPCWSTR Path,
360   LPCWSTR Query,
361   LPCWSTR TargetFilePath,
362   DWORD Flags
363 );
364 
365 WINBOOL WINAPI EvtFormatMessage(
366   EVT_HANDLE PublisherMetadata,
367   EVT_HANDLE Event,
368   DWORD MessageId,
369   DWORD ValueCount,
370   PEVT_VARIANT Values,
371   DWORD Flags,
372   DWORD BufferSize,
373   LPWSTR Buffer,
374   PDWORD BufferUsed
375 );
376 
377 WINBOOL WINAPI EvtGetChannelConfigProperty(
378   EVT_HANDLE ChannelConfig,
379   EVT_CHANNEL_CONFIG_PROPERTY_ID PropertyId,
380   DWORD Flags,
381   DWORD PropertyValueBufferSize,
382   PEVT_VARIANT PropertyValueBuffer,
383   PDWORD PropertyValueBufferUsed
384 );
385 
386 WINBOOL WINAPI EvtGetEventInfo(
387   EVT_HANDLE Event,
388   EVT_EVENT_PROPERTY_ID PropertyId,
389   DWORD PropertyValueBufferSize,
390   PEVT_VARIANT PropertyValueBuffer,
391   PDWORD PropertyValueBufferUsed
392 );
393 
394 WINBOOL WINAPI EvtGetEventMetadataProperty(
395   EVT_HANDLE EventMetadata,
396   EVT_EVENT_METADATA_PROPERTY_ID PropertyId,
397   DWORD Flags,
398   DWORD EventMetadataPropertyBufferSize,
399   PEVT_VARIANT EventMetadataPropertyBuffer,
400   PDWORD EventMetadataPropertyBufferUsed
401 );
402 
403 DWORD WINAPI EvtGetExtendedStatus(
404   DWORD BufferSize,
405   LPWSTR Buffer,
406   PDWORD BufferUsed
407 );
408 
409 WINBOOL WINAPI EvtGetLogInfo(
410   EVT_HANDLE Log,
411   EVT_LOG_PROPERTY_ID PropertyId,
412   DWORD PropertyValueBufferSize,
413   PEVT_VARIANT PropertyValueBuffer,
414   PDWORD PropertyValueBufferUsed
415 );
416 
417 WINBOOL WINAPI EvtGetObjectArrayProperty(
418   EVT_OBJECT_ARRAY_PROPERTY_HANDLE ObjectArray,
419   DWORD PropertyId,
420   DWORD ArrayIndex,
421   DWORD Flags,
422   DWORD PropertyValueBufferSize,
423   PEVT_VARIANT PropertyValueBuffer,
424   PDWORD PropertyValueBufferUsed
425 );
426 
427 WINBOOL WINAPI EvtGetObjectArraySize(
428   EVT_OBJECT_ARRAY_PROPERTY_HANDLE ObjectArray,
429   PDWORD ObjectArraySize
430 );
431 
432 WINBOOL WINAPI EvtGetPublisherMetadataProperty(
433   EVT_HANDLE PublisherMetadata,
434   EVT_PUBLISHER_METADATA_PROPERTY_ID PropertyId,
435   DWORD Flags,
436   DWORD PublisherMetadataPropertyBufferSize,
437   PEVT_VARIANT PublisherMetadataPropertyBuffer,
438   PDWORD PublisherMetadataPropertyBufferUsed
439 );
440 
441 WINBOOL WINAPI EvtGetQueryInfo(
442   EVT_HANDLE QueryOrSubscription,
443   EVT_QUERY_PROPERTY_ID PropertyId,
444   DWORD PropertyValueBufferSize,
445   PEVT_VARIANT PropertyValueBuffer,
446   PDWORD PropertyValueBufferUsed
447 );
448 
449 WINBOOL WINAPI EvtNext(
450   EVT_HANDLE ResultSet,
451   DWORD EventArraySize,
452   EVT_HANDLE* EventArray,
453   DWORD Timeout,
454   DWORD Flags,
455   PDWORD Returned
456 );
457 
458 WINBOOL WINAPI EvtNextChannelPath(
459   EVT_HANDLE ChannelEnum,
460   DWORD ChannelPathBufferSize,
461   LPWSTR ChannelPathBuffer,
462   PDWORD ChannelPathBufferUsed
463 );
464 
465 EVT_HANDLE WINAPI EvtNextEventMetadata(
466   EVT_HANDLE EventMetadataEnum,
467   DWORD Flags
468 );
469 
470 WINBOOL WINAPI EvtNextPublisherId(
471   EVT_HANDLE PublisherEnum,
472   DWORD PublisherIdBufferSize,
473   LPWSTR PublisherIdBuffer,
474   PDWORD PublisherIdBufferUsed
475 );
476 
477 EVT_HANDLE WINAPI EvtOpenChannelConfig(
478   EVT_HANDLE Session,
479   LPCWSTR ChannelPath,
480   DWORD Flags
481 );
482 
483 EVT_HANDLE WINAPI EvtOpenChannelEnum(
484   EVT_HANDLE Session,
485   DWORD Flags
486 );
487 
488 EVT_HANDLE WINAPI EvtOpenEventMetadataEnum(
489   EVT_HANDLE PublisherMetadata,
490   DWORD Flags
491 );
492 
493 EVT_HANDLE WINAPI EvtOpenLog(
494   EVT_HANDLE Session,
495   LPCWSTR Path,
496   DWORD Flags
497 );
498 
499 EVT_HANDLE WINAPI EvtOpenPublisherEnum(
500   EVT_HANDLE Session,
501   DWORD Flags
502 );
503 
504 EVT_HANDLE WINAPI EvtOpenPublisherMetadata(
505   EVT_HANDLE Session,
506   LPCWSTR PublisherIdentity,
507   LPCWSTR LogFilePath,
508   LCID Locale,
509   DWORD Flags
510 );
511 
512 EVT_HANDLE WINAPI EvtOpenSession(
513   EVT_LOGIN_CLASS LoginClass,
514   PVOID Login,
515   DWORD Timeout,
516   DWORD Flags
517 );
518 
519 EVT_HANDLE WINAPI EvtQuery(
520   EVT_HANDLE Session,
521   LPCWSTR Path,
522   LPCWSTR Query,
523   DWORD Flags
524 );
525 
526 WINBOOL WINAPI EvtRender(
527   EVT_HANDLE Context,
528   EVT_HANDLE Fragment,
529   DWORD Flags,
530   DWORD BufferSize,
531   PVOID Buffer,
532   PDWORD BufferUsed,
533   PDWORD PropertyCount
534 );
535 
536 WINBOOL WINAPI EvtSaveChannelConfig(
537   EVT_HANDLE ChannelConfig,
538   DWORD Flags
539 );
540 
541 WINBOOL WINAPI EvtSeek(
542   EVT_HANDLE ResultSet,
543   LONGLONG Position,
544   EVT_HANDLE Bookmark,
545   DWORD Timeout,
546   DWORD Flags
547 );
548 
549 WINBOOL WINAPI EvtSetChannelConfigProperty(
550   EVT_HANDLE ChannelConfig,
551   EVT_CHANNEL_CONFIG_PROPERTY_ID PropertyId,
552   DWORD Flags,
553   PEVT_VARIANT PropertyValue
554 );
555 
556 EVT_HANDLE WINAPI EvtSubscribe(
557   EVT_HANDLE Session,
558   HANDLE SignalEvent,
559   LPCWSTR ChannelPath,
560   LPCWSTR Query,
561   EVT_HANDLE Bookmark,
562   PVOID context,
563   EVT_SUBSCRIBE_CALLBACK Callback,
564   DWORD Flags
565 );
566 
567 WINBOOL WINAPI EvtUpdateBookmark(
568   EVT_HANDLE Bookmark,
569   EVT_HANDLE Event
570 );
571 
572 #ifdef __cplusplus
573 }
574 #endif
575 #endif /*(_WIN32_WINNT >= 0x0600)*/
576 #endif /*_INC_TDH*/
577