2006-09-18 23:02:06 +04:00
#include "idl_types.h"
/*
eventlog interface definition
*/
2008-01-17 15:56:47 +03:00
2006-11-07 02:20:35 +03:00
import "lsa.idl", "security.idl";
2006-09-18 23:02:06 +04:00
[ uuid("82273fdc-e32a-18c3-3f78-827929dc23ea"),
version(0.0),
2006-09-20 02:14:34 +04:00
helpstring("Event Logger")
2006-09-18 23:02:06 +04:00
] interface eventlog
{
2008-11-20 15:29:44 +03:00
typedef [bitmap32bit] bitmap {
2006-09-18 23:02:06 +04:00
EVENTLOG_SEQUENTIAL_READ = 0x0001,
EVENTLOG_SEEK_READ = 0x0002,
EVENTLOG_FORWARDS_READ = 0x0004,
EVENTLOG_BACKWARDS_READ = 0x0008
} eventlogReadFlags;
2009-01-13 15:14:36 +03:00
typedef [public] enum {
2006-09-18 23:02:06 +04:00
EVENTLOG_SUCCESS = 0x0000,
EVENTLOG_ERROR_TYPE = 0x0001,
EVENTLOG_WARNING_TYPE = 0x0002,
EVENTLOG_INFORMATION_TYPE = 0x0004,
EVENTLOG_AUDIT_SUCCESS = 0x0008,
EVENTLOG_AUDIT_FAILURE = 0x0010
} eventlogEventTypes;
typedef struct {
uint16 unknown0;
uint16 unknown1;
} eventlog_OpenUnknown0;
2009-01-15 17:32:18 +03:00
/* compat structure for samba3 on-disc eventlog format,
this is *NOT* used on the wire. - gd */
typedef [flag(NDR_NOALIGN|NDR_PAHEX),public] struct {
uint32 size;
[charset(DOS),value("eLfL")] uint8 reserved[4];
uint32 record_number;
time_t time_generated;
time_t time_written;
uint32 event_id;
eventlogEventTypes event_type;
[range(0,256)] uint16 num_of_strings;
uint16 event_category;
uint16 reserved_flags;
uint32 closing_record_number;
uint32 stringoffset;
[value(sid.length)] uint32 sid_length;
uint32 sid_offset;
[value(data.length)] uint32 data_length;
uint32 data_offset;
[value(2*strlen_m_term(source_name))] uint32 source_name_len;
nstring source_name;
[value(2*strlen_m_term(computer_name))] uint32 computer_name_len;
nstring computer_name;
uint32 sid_padding;
DATA_BLOB sid;
[value(2*ndr_size_string_array(strings, num_of_strings, STR_NULLTERM))] uint32 strings_len;
nstring strings[num_of_strings];
DATA_BLOB data;
uint32 padding;
} eventlog_Record_tdb;
2009-01-23 16:58:27 +03:00
typedef [v1_enum] enum {
ELF_LOGFILE_HEADER_DIRTY = 0x0001,
ELF_LOGFILE_HEADER_WRAP = 0x0002,
ELF_LOGFILE_LOGFULL_WRITTEN = 0x0004,
ELF_LOGFILE_ARCHIVE_SET = 0x0008
} EVENTLOG_HEADER_FLAGS;
typedef [public] struct {
[value(0x30)] uint32 HeaderSize;
[charset(DOS),value("LfLe")] uint8 Signature[4];
[value(1)] uint32 MajorVersion;
[value(1)] uint32 MinorVersion;
uint32 StartOffset;
uint32 EndOffset;
uint32 CurrentRecordNumber;
uint32 OldestRecordNumber;
uint32 MaxSize;
EVENTLOG_HEADER_FLAGS Flags;
uint32 Retention;
[value(0x30)] uint32 EndHeaderSize;
} EVENTLOGHEADER;
typedef [public,gensize] struct {
uint32 Length;
[charset(DOS),value("LfLe")] uint8 Reserved[4];
uint32 RecordNumber;
time_t TimeGenerated;
time_t TimeWritten;
uint32 EventID;
eventlogEventTypes EventType;
uint16 NumStrings;
uint16 EventCategory;
uint16 ReservedFlags;
uint32 ClosingRecordNumber;
2009-02-04 14:59:47 +03:00
[value(56+2*(strlen_m_term(SourceName)+strlen_m_term(Computername))+UserSidLength)] uint32 StringOffset;
2009-01-23 16:58:27 +03:00
[value(ndr_size_dom_sid0(&UserSid, ndr->flags))] uint32 UserSidLength;
2009-02-04 14:59:47 +03:00
[value(56+2*(strlen_m_term(SourceName)+strlen_m_term(Computername)))] uint32 UserSidOffset;
2009-01-23 16:58:27 +03:00
uint32 DataLength;
2009-02-04 14:59:47 +03:00
[value(56+2*(strlen_m_term(SourceName)+strlen_m_term(Computername))+UserSidLength+(2*ndr_size_string_array(Strings, NumStrings, STR_NULLTERM)))] uint32 DataOffset;
2009-01-23 16:58:27 +03:00
nstring SourceName;
nstring Computername;
[flag(NDR_ALIGN4),subcontext(0),subcontext_size(UserSidLength)] dom_sid0 UserSid;
nstring Strings[NumStrings];
[flag(NDR_PAHEX)] uint8 Data[DataLength];
astring Pad;
[value(Length)] uint32 Length2;
} EVENTLOGRECORD;
typedef [public] struct {
[value(0x28)] uint32 RecordSizeBeginning;
[value(0x11111111)] uint32 One;
[value(0x22222222)] uint32 Two;
[value(0x33333333)] uint32 Three;
[value(0x44444444)] uint32 Four;
uint32 BeginRecord;
uint32 EndRecord;
uint32 CurrentRecordNumber;
uint32 OldestRecordNumber;
[value(0x28)] uint32 RecordSizeEnd;
} EVENTLOGEOF;
/* the following is true for a non-wrapped evt file (e.g. backups
* generated and viewed with eventvwr) */
typedef [public] struct {
EVENTLOGHEADER hdr;
EVENTLOGRECORD records[hdr.CurrentRecordNumber-hdr.OldestRecordNumber];
EVENTLOGEOF eof;
} EVENTLOG_EVT_FILE;
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x00 */
NTSTATUS eventlog_ClearEventLogW(
[in] policy_handle *handle,
2008-02-04 12:14:08 +03:00
[in,unique] lsa_String *backupfile
2006-09-18 23:02:06 +04:00
);
/******************/
/* Function: 0x01 */
2009-01-21 00:06:01 +03:00
NTSTATUS eventlog_BackupEventLogW(
[in] policy_handle *handle,
[in,ref] lsa_String *backup_filename
);
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x02 */
NTSTATUS eventlog_CloseEventLog(
[in,out] policy_handle *handle
);
/******************/
/* Function: 0x03 */
2009-01-20 22:00:02 +03:00
NTSTATUS eventlog_DeregisterEventSource(
[in,out] policy_handle *handle
);
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x04 */
NTSTATUS eventlog_GetNumRecords(
[in] policy_handle *handle,
2009-01-12 15:45:04 +03:00
[out,ref] uint32 *number
2006-09-18 23:02:06 +04:00
);
/******************/
/* Function: 0x05 */
2008-02-04 12:42:33 +03:00
NTSTATUS eventlog_GetOldestRecord(
[in] policy_handle *handle,
[out,ref] uint32 *oldest_entry
);
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x06 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_ChangeNotify();
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x07 */
NTSTATUS eventlog_OpenEventLogW(
[in,unique] eventlog_OpenUnknown0 *unknown0,
2008-02-04 13:07:41 +03:00
[in,ref] lsa_String *logname,
[in,ref] lsa_String *servername,
2008-11-20 15:29:44 +03:00
[in] uint32 major_version,
[in] uint32 minor_version,
2006-09-18 23:02:06 +04:00
[out] policy_handle *handle
);
/******************/
/* Function: 0x08 */
2009-01-20 21:58:17 +03:00
NTSTATUS eventlog_RegisterEventSourceW(
[in,unique] eventlog_OpenUnknown0 *unknown0,
[in,ref] lsa_String *module_name,
[in,ref] lsa_String *reg_module_name,
[in] uint32 major_version,
[in] uint32 minor_version,
[out] policy_handle *log_handle
);
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x09 */
2009-01-21 00:18:53 +03:00
NTSTATUS eventlog_OpenBackupEventLogW(
[in,unique] eventlog_OpenUnknown0 *unknown0,
[in,ref] lsa_String *backup_logname,
[in] uint32 major_version,
[in] uint32 minor_version,
[out] policy_handle *handle
);
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x0a */
NTSTATUS eventlog_ReadEventLogW(
[in] policy_handle *handle,
2008-11-20 15:29:44 +03:00
[in] eventlogReadFlags flags,
2006-09-18 23:02:06 +04:00
[in] uint32 offset,
2008-02-04 13:27:22 +03:00
[in] [range(0,0x7FFFF)] uint32 number_of_bytes,
[out,ref,size_is(number_of_bytes)] uint8 *data,
[out,ref] uint32 *sent_size,
[out,ref] uint32 *real_size
2006-09-18 23:02:06 +04:00
);
/*****************/
/* Function 0x0b */
2009-01-20 20:32:01 +03:00
NTSTATUS eventlog_ReportEventW(
[in] policy_handle *handle,
[in] time_t timestamp,
[in] eventlogEventTypes event_type,
[in] uint16 event_category,
[in] uint32 event_id,
[in] [range(0,256)] uint16 num_of_strings,
[in] [range(0,0x3FFFF)] uint32 data_size,
[in,ref] lsa_String *servername,
[in,unique] dom_sid *user_sid,
[in,unique] [size_is(num_of_strings)] lsa_String **strings,
[in,unique] [size_is(data_size)] uint8 *data,
[in] uint16 flags,
[in,out,unique] uint32 *record_number,
[in,out,unique] time_t *time_written
);
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x0c */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_ClearEventLogA();
2006-09-18 23:02:06 +04:00
/******************/
/* Function: 0x0d */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_BackupEventLogA();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x0e */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_OpenEventLogA();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x0f */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_RegisterEventSourceA();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x10 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_OpenBackupEventLogA();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x11 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_ReadEventLogA();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x12 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_ReportEventA();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x13 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_RegisterClusterSvc();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x14 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_DeregisterClusterSvc();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x15 */
2008-09-17 17:43:04 +04:00
[todo] NTSTATUS eventlog_WriteClusterEvents();
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x16 */
2009-01-20 20:56:34 +03:00
2009-04-08 22:33:58 +04:00
typedef [public] struct {
2009-01-20 20:56:34 +03:00
boolean32 full;
} EVENTLOG_FULL_INFORMATION;
2009-02-20 16:18:06 +03:00
NTSTATUS eventlog_GetLogInformation(
2009-01-20 20:56:34 +03:00
[in] policy_handle *handle,
[in] uint32 level,
[out,ref] [size_is(buf_size)] uint8 *buffer,
[in] [range(0,1024)] uint32 buf_size,
[out,ref] uint32 *bytes_needed
);
2006-09-18 23:02:06 +04:00
/*****************/
/* Function 0x17 */
NTSTATUS eventlog_FlushEventLog(
[in] policy_handle *handle
2009-01-20 21:20:26 +03:00
);
/*****************/
/* Function 0x18 */
NTSTATUS eventlog_ReportEventAndSourceW(
[in] policy_handle *handle,
[in] time_t timestamp,
[in] eventlogEventTypes event_type,
[in] uint16 event_category,
[in] uint32 event_id,
[in,ref] lsa_String *sourcename,
[in] [range(0,256)] uint16 num_of_strings,
[in] [range(0,0x3FFFF)] uint32 data_size,
[in,ref] lsa_String *servername,
[in,unique] dom_sid *user_sid,
[in,unique] [size_is(num_of_strings)] lsa_String **strings,
[in,unique] [size_is(data_size)] uint8 *data,
[in] uint16 flags,
[in,out,unique] uint32 *record_number,
[in,out,unique] time_t *time_written
);
2006-09-18 23:02:06 +04:00
}
