source/include/rpc_eventlog.h

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 #ifndef _RPC_EVENTLOG_H         /* _RPC_EVENTLOG_H */
  22 #define _RPC_EVENTLOG_H
  23
  24 /* opcodes */
  25
  26 #define EVENTLOG_CLEAREVENTLOG          0x00
  27 #define EVENTLOG_CLOSEEVENTLOG          0x02
  28 #define EVENTLOG_GETNUMRECORDS          0x04
  29 #define EVENTLOG_GETOLDESTENTRY         0x05
  30 #define EVENTLOG_OPENEVENTLOG           0x07
  31 #define EVENTLOG_READEVENTLOG           0x0a
  32
  33 /* Eventlog read flags */
  34
  35 #define EVENTLOG_SEQUENTIAL_READ      0x0001
  36 #define EVENTLOG_SEEK_READ            0x0002
  37 #define EVENTLOG_FORWARDS_READ        0x0004
  38 #define EVENTLOG_BACKWARDS_READ       0x0008
  39
  40 /* Event types */
  41
  42 #define EVENTLOG_SUCCESS              0x0000
  43 #define EVENTLOG_ERROR_TYPE           0x0001
  44 #define EVENTLOG_WARNING_TYPE         0x0002
  45 #define EVENTLOG_INFORMATION_TYPE     0x0004
  46 #define EVENTLOG_AUDIT_SUCCESS        0x0008
  47 #define EVENTLOG_AUDIT_FAILURE        0x0010
  48
  49 /* Defines for TDB keys */
  50 #define  EVT_OLDEST_ENTRY  "INFO/oldest_entry"
  51 #define  EVT_NEXT_RECORD   "INFO/next_record"
  52 #define  EVT_VERSION       "INFO/version"
  53 #define  EVT_MAXSIZE       "INFO/maxsize"
  54 #define  EVT_RETENTION     "INFO/retention"
  55
  56 #define ELOG_APPL       "Application"
  57 #define ELOG_SYS        "System"
  58 #define ELOG_SEC        "Security"
  59
  60 typedef struct elog_tdb {
  61         struct elog_tdb *prev, *next;
  62         char *name;
  63         TDB_CONTEXT *tdb;
  64         int ref_count;
  65 } ELOG_TDB;
  66
  67 #define ELOG_TDB_CTX(x) ((x)->tdb)
  68
  69
  70 #define  EVENTLOG_DATABASE_VERSION_V1    1
  71
  72 /***********************************/
  73
  74 typedef struct {
  75         uint16 unknown1;
  76         uint16 unknown2;
  77 } EVENTLOG_OPEN_UNKNOWN0;
  78
  79 typedef struct {
  80         EVENTLOG_OPEN_UNKNOWN0 *unknown0;
  81         UNISTR4 logname;
  82         UNISTR4 servername;
  83         uint32 unknown1;
  84         uint32 unknown2;
  85 } EVENTLOG_Q_OPEN_EVENTLOG;
  86
  87 typedef struct {
  88         POLICY_HND handle;
  89         NTSTATUS status;
  90 } EVENTLOG_R_OPEN_EVENTLOG;
  91
  92
  93 /***********************************/
  94
  95 typedef struct {
  96         POLICY_HND handle;
  97 } EVENTLOG_Q_CLOSE_EVENTLOG;
  98
  99 typedef struct {
 100         POLICY_HND handle;
 101         NTSTATUS status;
 102 } EVENTLOG_R_CLOSE_EVENTLOG;
 103
 104
 105 /***********************************/
 106
 107 typedef struct {
 108         POLICY_HND handle;
 109 } EVENTLOG_Q_GET_NUM_RECORDS;
 110
 111 typedef struct {
 112         uint32 num_records;
 113         NTSTATUS status;
 114 } EVENTLOG_R_GET_NUM_RECORDS;
 115
 116
 117 /***********************************/
 118
 119 typedef struct {
 120         POLICY_HND handle;
 121 } EVENTLOG_Q_GET_OLDEST_ENTRY;
 122
 123 typedef struct {
 124         uint32 oldest_entry;
 125         NTSTATUS status;
 126 } EVENTLOG_R_GET_OLDEST_ENTRY;
 127
 128
 129 /***********************************/
 130
 131 typedef struct
 132 {
 133         POLICY_HND handle;
 134         uint32 flags;
 135         uint32 offset;
 136         uint32 max_read_size;
 137 } EVENTLOG_Q_READ_EVENTLOG;
 138
 139 typedef struct {
 140         uint32 length;
 141         uint32 reserved1;
 142         uint32 record_number;
 143         uint32 time_generated;
 144         uint32 time_written;
 145         uint32 event_id;
 146         uint16 event_type;
 147         uint16 num_strings;
 148         uint16 event_category;
 149         uint16 reserved2;
 150         uint32 closing_record_number;
 151         uint32 string_offset;
 152         uint32 user_sid_length;
 153         uint32 user_sid_offset;
 154         uint32 data_length;
 155         uint32 data_offset;
 156 } Eventlog_record;
 157
 158 typedef struct {
 159         uint32 source_name_len;
 160         wpstring source_name;
 161         uint32 computer_name_len;
 162         wpstring computer_name;
 163         uint32 sid_padding;
 164         wpstring sid;
 165         uint32 strings_len;
 166         wpstring strings;
 167         uint32 user_data_len;
 168         pstring user_data;
 169         uint32 data_padding;
 170 } Eventlog_data_record;
 171
 172 typedef struct eventlog_entry {
 173         Eventlog_record record;
 174         Eventlog_data_record data_record;
 175         uint8 *data;
 176         uint8 *end_of_data_padding;
 177         struct eventlog_entry *next;
 178 } Eventlog_entry;
 179
 180 typedef struct {
 181         uint32 num_bytes_in_resp;
 182         uint32 bytes_in_next_record;
 183         uint32 num_records;
 184         Eventlog_entry *entry;
 185         uint8 *end_of_entries_padding;
 186         uint32 sent_size;
 187         uint32 real_size;
 188         NTSTATUS status;
 189 } EVENTLOG_R_READ_EVENTLOG;
 190
 191
 192 /***********************************/
 193
 194 typedef struct {
 195         POLICY_HND handle;
 196         UNISTR4 backupfile;
 197 } EVENTLOG_Q_CLEAR_EVENTLOG;
 198
 199 typedef struct {
 200         NTSTATUS status;
 201 } EVENTLOG_R_CLEAR_EVENTLOG;
 202
 203 #endif /* _RPC_EVENTLOG_H */