source/include/rpc_eventlog.h

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 #ifndef _RPC_EVENTLOG_H         /* _RPC_EVENTLOG_H */
  22 #define _RPC_EVENTLOG_H
  23
  24 /* opcodes */
  25
  26 #define EVENTLOG_CLEAREVENTLOG          0x00
  27 #define EVENTLOG_CLOSEEVENTLOG          0x02
  28 #define EVENTLOG_GETNUMRECORDS          0x04
  29 #define EVENTLOG_GETOLDESTENTRY         0x05
  30 #define EVENTLOG_OPENEVENTLOG           0x07
  31 #define EVENTLOG_READEVENTLOG           0x0a
  32
  33 /* Eventlog read flags */
  34
  35 #define EVENTLOG_SEQUENTIAL_READ      0x0001
  36 #define EVENTLOG_SEEK_READ            0x0002
  37 #define EVENTLOG_FORWARDS_READ        0x0004
  38 #define EVENTLOG_BACKWARDS_READ       0x0008
  39
  40 /* Event types */
  41
  42 #define EVENTLOG_SUCCESS              0x0000
  43 #define EVENTLOG_ERROR_TYPE           0x0001
  44 #define EVENTLOG_WARNING_TYPE         0x0002
  45 #define EVENTLOG_INFORMATION_TYPE     0x0004
  46 #define EVENTLOG_AUDIT_SUCCESS        0x0008
  47 #define EVENTLOG_AUDIT_FAILURE        0x0010
  48
  49
  50 typedef struct eventlog_q_open_eventlog
  51 {
  52         uint32 unknown1;
  53         uint16 unknown2;
  54         uint16 unknown3;
  55         uint16 sourcename_length;
  56         uint16 sourcename_size;
  57         uint32 sourcename_ptr;
  58         UNISTR2 sourcename;
  59         uint32 servername_ptr;
  60         UNISTR2 servername;
  61 }
  62 EVENTLOG_Q_OPEN_EVENTLOG;
  63
  64 typedef struct eventlog_r_open_eventlog
  65 {
  66         POLICY_HND handle;
  67         WERROR status;
  68 }
  69 EVENTLOG_R_OPEN_EVENTLOG;
  70
  71 typedef struct eventlog_q_close_eventlog
  72 {
  73         POLICY_HND handle;
  74 }
  75 EVENTLOG_Q_CLOSE_EVENTLOG;
  76
  77 typedef struct eventlog_r_close_eventlog
  78 {
  79         POLICY_HND handle;
  80         WERROR status;
  81 }
  82 EVENTLOG_R_CLOSE_EVENTLOG;
  83
  84 typedef struct eventlog_q_get_num_records
  85 {
  86         POLICY_HND handle;
  87 }
  88 EVENTLOG_Q_GET_NUM_RECORDS;
  89
  90 typedef struct eventlog_r_get_num_records
  91 {
  92         uint32 num_records;
  93         WERROR status;
  94 }
  95 EVENTLOG_R_GET_NUM_RECORDS;
  96
  97 typedef struct eventlog_q_get_oldest_entry
  98 {
  99         POLICY_HND handle;
 100 }
 101 EVENTLOG_Q_GET_OLDEST_ENTRY;
 102
 103 typedef struct eventlog_r_get_oldest_entry
 104 {
 105         uint32 oldest_entry;
 106         WERROR status;
 107 }
 108 EVENTLOG_R_GET_OLDEST_ENTRY;
 109
 110 typedef struct eventlog_q_read_eventlog
 111 {
 112         POLICY_HND handle;
 113         uint32 flags;
 114         uint32 offset;
 115         uint32 max_read_size;
 116 }
 117 EVENTLOG_Q_READ_EVENTLOG;
 118
 119 typedef struct eventlog_record
 120 {
 121         uint32 length;
 122         uint32 reserved1;
 123         uint32 record_number;
 124         uint32 time_generated;
 125         uint32 time_written;
 126         uint32 event_id;
 127         uint16 event_type;
 128         uint16 num_strings;
 129         uint16 event_category;
 130         uint16 reserved2;
 131         uint32 closing_record_number;
 132         uint32 string_offset;
 133         uint32 user_sid_length;
 134         uint32 user_sid_offset;
 135         uint32 data_length;
 136         uint32 data_offset;
 137 } Eventlog_record;
 138
 139 typedef struct eventlog_data_record
 140 {
 141         uint32 source_name_len;
 142         wpstring source_name;
 143         uint32 computer_name_len;
 144         wpstring computer_name;
 145         uint32 sid_padding;
 146         wpstring sid;
 147         uint32 strings_len;
 148         wpstring strings;
 149         uint32 user_data_len;
 150         pstring user_data;
 151         uint32 data_padding;
 152 } Eventlog_data_record;
 153
 154 typedef struct eventlog_entry
 155 {
 156         Eventlog_record record;
 157         Eventlog_data_record data_record;
 158         uint8 *data;
 159         uint8 *end_of_data_padding;
 160         struct eventlog_entry *next;
 161 } Eventlog_entry;
 162
 163 typedef struct eventlog_r_read_eventlog
 164 {
 165         uint32 num_bytes_in_resp;
 166         uint32 bytes_in_next_record;
 167         uint32 num_records;
 168         Eventlog_entry *entry;
 169         uint8 *end_of_entries_padding;
 170         uint32 sent_size;
 171         uint32 real_size;
 172         WERROR status;
 173 }
 174 EVENTLOG_R_READ_EVENTLOG;
 175
 176 typedef struct eventlog_q_clear_eventlog
 177 {
 178         POLICY_HND handle;
 179         uint32 unknown1;
 180         uint16 backup_file_length;
 181         uint16 backup_file_size;
 182         uint32 backup_file_ptr;
 183         UNISTR2 backup_file;
 184 }
 185 EVENTLOG_Q_CLEAR_EVENTLOG;
 186
 187 typedef struct eventlog_r_clear_eventlog
 188 {
 189         WERROR status;
 190 }
 191 EVENTLOG_R_CLEAR_EVENTLOG;
 192
 193 #endif /* _RPC_EVENTLOG_H */