Revert

[mono-project.git] / mcs / class / System / System.Diagnostics / Win32EventLog.cs

//
// System.Diagnostics.Win32EventLog.cs
//
// Author:
//      Gert Driesen <driesen@users.sourceforge.net>
//
// Copyright (C) 2006 Novell, Inc (http://www.novell.com)
//
//
// Permission is hereby granted, free of charge, to any person obtaining
// a copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to
// permit persons to whom the Software is furnished to do so, subject to
// the following conditions:
// 
// The above copyright notice and this permission notice shall be
// included in all copies or substantial portions of the Software.
// 
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
//

using System;
using System.Collections;
using System.ComponentModel;
using System.Diagnostics;
using System.Globalization;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;

using Microsoft.Win32;

namespace System.Diagnostics
{
        internal class Win32EventLog : EventLogImpl
        {
                private const int MESSAGE_NOT_FOUND = 317;
                private ManualResetEvent _notifyResetEvent;
                private IntPtr _readHandle;
                private Thread _notifyThread;
                private int _lastEntryWritten;
                private bool _notifying;

                public Win32EventLog (EventLog coreEventLog)
                        : base (coreEventLog)
                {
                }

                public override void BeginInit ()
                {
                }

                public override void Clear ()
                {
                        int ret = PInvoke.ClearEventLog (ReadHandle, null);
                        if (ret != 1)
                                throw new Win32Exception (Marshal.GetLastWin32Error ());
                }

                public override void Close ()
                {
                        if (_readHandle != IntPtr.Zero) {
                                CloseEventLog (_readHandle);
                                _readHandle = IntPtr.Zero;
                        }
                }

                public override void CreateEventSource (EventSourceCreationData sourceData)
                {
                        using (RegistryKey eventLogKey = GetEventLogKey (sourceData.MachineName, true)) {
                                if (eventLogKey == null)
                                        throw new InvalidOperationException ("EventLog registry key is missing.");

                                bool logKeyCreated = false;
                                RegistryKey logKey = null;
                                try {
                                        logKey = eventLogKey.OpenSubKey (sourceData.LogName, true);
                                        if (logKey == null) {
                                                ValidateCustomerLogName (sourceData.LogName, 
                                                        sourceData.MachineName);

                                                logKey = eventLogKey.CreateSubKey (sourceData.LogName);
                                                logKey.SetValue ("Sources", new string [] { sourceData.LogName,
                                                        sourceData.Source });
                                                UpdateLogRegistry (logKey);

                                                using (RegistryKey sourceKey = logKey.CreateSubKey (sourceData.LogName)) {
                                                        UpdateSourceRegistry (sourceKey, sourceData);
                                                }

                                                logKeyCreated = true;
                                        }

                                        if (sourceData.LogName != sourceData.Source) {
                                                if (!logKeyCreated) {
                                                        string [] sources = (string []) logKey.GetValue ("Sources");
                                                        if (sources == null) {
                                                                logKey.SetValue ("Sources", new string [] { sourceData.LogName,
                                                                        sourceData.Source });
                                                        } else {
                                                                bool found = false;
                                                                for (int i = 0; i < sources.Length; i++) {
                                                                        if (sources [i] == sourceData.Source) {
                                                                                found = true;
                                                                                break;
                                                                        }
                                                                }
                                                                if (!found) {
                                                                        string [] newSources = new string [sources.Length + 1];
                                                                        Array.Copy (sources, 0, newSources, 0, sources.Length);
                                                                        newSources [sources.Length] = sourceData.Source;
                                                                        logKey.SetValue ("Sources", newSources);
                                                                }
                                                        }
                                                }
                                                using (RegistryKey sourceKey = logKey.CreateSubKey (sourceData.Source)) {
                                                        UpdateSourceRegistry (sourceKey, sourceData);
                                                }
                                        }
                                } finally {
                                        if (logKey != null)
                                                logKey.Close ();
                                }
                        }
                }

                public override void Delete (string logName, string machineName)
                {
                        using (RegistryKey eventLogKey = GetEventLogKey (machineName, true)) {
                                if (eventLogKey == null)
                                        throw new InvalidOperationException ("The event log key does not exist.");

                                using (RegistryKey logKey = eventLogKey.OpenSubKey (logName, false)) {
                                        if (logKey == null)
                                                throw new InvalidOperationException (string.Format (
                                                        CultureInfo.InvariantCulture, "Event Log '{0}'"
                                                        + " does not exist on computer '{1}'.", logName,
                                                        machineName));

                                        // remove all eventlog entries for specified log
                                        CoreEventLog.Clear ();

                                        // remove file holding event log entries
                                        string file = (string) logKey.GetValue ("File");
                                        if (file != null) {
                                                try {
                                                        File.Delete (file);
                                                } catch (Exception) {
                                                        // .NET seems to ignore failures here
                                                }
                                        }
                                }

                                eventLogKey.DeleteSubKeyTree (logName);
                        }
                }

                public override void DeleteEventSource (string source, string machineName)
                {
                        using (RegistryKey logKey = FindLogKeyBySource (source, machineName, true)) {
                                if (logKey == null) {
                                        throw new ArgumentException (string.Format (
                                                CultureInfo.InvariantCulture, "The source '{0}' is not"
                                                + " registered on computer '{1}'.", source, machineName));
                                }

                                logKey.DeleteSubKeyTree (source);

                                string [] sources = (string []) logKey.GetValue ("Sources");
                                if (sources != null) {
                                        ArrayList temp = new ArrayList ();
                                        for (int i = 0; i < sources.Length; i++)
                                                if (sources [i] != source)
                                                        temp.Add (sources [i]);
                                        string [] newSources = new string [temp.Count];
                                        temp.CopyTo (newSources, 0);
                                        logKey.SetValue ("Sources", newSources);
                                }
                        }
                }

                public override void Dispose (bool disposing)
                {
                        Close ();
                }

                public override void EndInit ()
                {
                }

                public override bool Exists (string logName, string machineName)
                {
                        using (RegistryKey logKey = FindLogKeyByName (logName, machineName, false)) {
                                return (logKey != null);
                        }
                }

                [MonoTODO] // ParameterResourceFile ??
                protected override string FormatMessage (string source, uint messageID, string [] replacementStrings)
                {
                        string formattedMessage = null;

                        string [] msgResDlls = GetMessageResourceDlls (source, "EventMessageFile");
                        for (int i = 0; i < msgResDlls.Length; i++) {
                                formattedMessage = FetchMessage (msgResDlls [i],
                                        messageID, replacementStrings);
                                if (formattedMessage != null)
                                        break;
                        }

                        return formattedMessage != null ? formattedMessage : string.Join (
                                ", ", replacementStrings);
                }

                private string FormatCategory (string source, int category)
                {
                        string formattedCategory = null;

                        string [] msgResDlls = GetMessageResourceDlls (source, "CategoryMessageFile");
                        for (int i = 0; i < msgResDlls.Length; i++) {
                                formattedCategory = FetchMessage (msgResDlls [i],
                                        (uint) category, new string [0]);
                                if (formattedCategory != null)
                                        break;
                        }

                        return formattedCategory != null ? formattedCategory : "(" +
                                category.ToString (CultureInfo.InvariantCulture) + ")";
                }

                protected override int GetEntryCount ()
                {
                        int entryCount = 0;
                        int retVal = PInvoke.GetNumberOfEventLogRecords (ReadHandle, ref entryCount);
                        if (retVal != 1)
                                throw new Win32Exception (Marshal.GetLastWin32Error ());
                        return entryCount;
                }

                protected override EventLogEntry GetEntry (int index)
                {
                        // http://msdn.microsoft.com/library/en-us/eventlog/base/readeventlog.asp
                        // http://msdn.microsoft.com/library/en-us/eventlog/base/eventlogrecord_str.asp
                        // http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

                        index += OldestEventLogEntry;

                        int bytesRead = 0;
                        int minBufferNeeded = 0;
                        byte [] buffer = new byte [0x7ffff]; // according to MSDN this is the max size of the buffer

                        ReadEventLog (index, buffer, ref bytesRead, ref minBufferNeeded);

                        MemoryStream ms = new MemoryStream (buffer);
                        BinaryReader br = new BinaryReader (ms);

                        // skip first 8 bytes
                        br.ReadBytes (8);

                        int recordNumber = br.ReadInt32 (); // 8

                        int timeGeneratedSeconds = br.ReadInt32 (); // 12
                        int timeWrittenSeconds = br.ReadInt32 (); // 16
                        uint instanceID = br.ReadUInt32 ();
                        int eventID = EventLog.GetEventID (instanceID);
                        short eventType = br.ReadInt16 (); // 24
                        short numStrings = br.ReadInt16 (); ; // 26
                        short categoryNumber = br.ReadInt16 (); ; // 28
                        // skip reservedFlags
                        br.ReadInt16 (); // 30
                        // skip closingRecordNumber
                        br.ReadInt32 (); // 32
                        int stringOffset = br.ReadInt32 (); // 36
                        int userSidLength = br.ReadInt32 (); // 40
                        int userSidOffset = br.ReadInt32 (); // 44
                        int dataLength = br.ReadInt32 (); // 48
                        int dataOffset = br.ReadInt32 (); // 52

                        DateTime timeGenerated = new DateTime (1970, 1, 1).AddSeconds (
                                timeGeneratedSeconds);

                        DateTime timeWritten = new DateTime (1970, 1, 1).AddSeconds (
                                timeWrittenSeconds);

                        StringBuilder sb = new StringBuilder ();
                        while (br.PeekChar () != '\0')
                                sb.Append (br.ReadChar ());
                        br.ReadChar (); // skip the null-char

                        string sourceName = sb.ToString ();

                        sb.Length = 0;
                        while (br.PeekChar () != '\0')
                                sb.Append (br.ReadChar ());
                        br.ReadChar (); // skip the null-char
                        string machineName = sb.ToString ();

                        sb.Length = 0;
                        while (br.PeekChar () != '\0')
                                sb.Append (br.ReadChar ());
                        br.ReadChar (); // skip the null-char

                        string userName = null;
                        if (userSidLength != 0) {
                                // TODO: lazy init ?
                                ms.Position = userSidOffset;
                                byte [] sid = br.ReadBytes (userSidLength);
                                userName = LookupAccountSid (machineName, sid);
                        }

                        ms.Position = stringOffset;
                        string [] replacementStrings = new string [numStrings];
                        for (int i = 0; i < numStrings; i++) {
                                sb.Length = 0;
                                while (br.PeekChar () != '\0')
                                        sb.Append (br.ReadChar ());
                                br.ReadChar (); // skip the null-char
                                replacementStrings [i] = sb.ToString ();
                        }

                        byte [] data = new byte [dataLength];
                        ms.Position = dataOffset;
                        br.Read (data, 0, dataLength);

                        // TODO: lazy fetch ??
                        string message = this.FormatMessage (sourceName, instanceID, replacementStrings);
                        string category = FormatCategory (sourceName, categoryNumber);

                        return new EventLogEntry (category, (short) categoryNumber, recordNumber,
                                eventID, sourceName, message, userName, machineName,
                                (EventLogEntryType) eventType, timeGenerated, timeWritten,
                                data, replacementStrings, instanceID);
                }

                [MonoTODO]
                protected override string GetLogDisplayName ()
                {
                        return CoreEventLog.Log;
                }

                protected override string [] GetLogNames (string machineName)
                {
                        using (RegistryKey eventLogKey = GetEventLogKey (machineName, true)) {
                                if (eventLogKey == null)
                                        return new string [0];

                                return eventLogKey.GetSubKeyNames ();
                        }
                }

                public override string LogNameFromSourceName (string source, string machineName)
                {
                        using (RegistryKey logKey = FindLogKeyBySource (source, machineName, false)) {
                                if (logKey == null)
                                        return string.Empty;

                                return GetLogName (logKey);
                        }
                }

                public override bool SourceExists (string source, string machineName)
                {
                        RegistryKey logKey = FindLogKeyBySource (source, machineName, false);
                        if (logKey != null) {
                                logKey.Close ();
                                return true;
                        }
                        return false;
                }

                public override void WriteEntry (string [] replacementStrings, EventLogEntryType type, uint instanceID, short category, byte [] rawData)
                {
                        IntPtr hEventLog = RegisterEventSource ();
                        try {
                                int ret = PInvoke.ReportEvent (hEventLog, (ushort) type,
                                        (ushort) category, instanceID, IntPtr.Zero,
                                        (ushort) replacementStrings.Length,
                                        (uint) rawData.Length, replacementStrings, rawData);
                                if (ret != 1) {
                                        throw new Win32Exception (Marshal.GetLastWin32Error ());
                                }
                        } finally {
                                DeregisterEventSource (hEventLog);
                        }
                }

                private static void UpdateLogRegistry (RegistryKey logKey)
                {
                        // TODO: write other Log values:
                        // - MaxSize
                        // - Retention
                        // - AutoBackupLogFiles

                        if (logKey.GetValue ("File") == null) {
                                string logName = GetLogName (logKey);
                                string file;
                                if (logName.Length > 8) {
                                        file = logName.Substring (0, 8) + ".evt";
                                } else {
                                        file = logName + ".evt";
                                }
                                string configPath = Path.Combine (Environment.GetFolderPath (
                                        Environment.SpecialFolder.System), "config");
                                logKey.SetValue ("File", Path.Combine (configPath, file));
                        }
                }

                private static void UpdateSourceRegistry (RegistryKey sourceKey, EventSourceCreationData data)
                {
                        if (data.CategoryCount > 0)
                                sourceKey.SetValue ("CategoryCount", data.CategoryCount);

                        if (data.CategoryResourceFile != null && data.CategoryResourceFile.Length > 0)
                                sourceKey.SetValue ("CategoryMessageFile", data.CategoryResourceFile);

                        if (data.MessageResourceFile != null && data.MessageResourceFile.Length > 0) {
                                sourceKey.SetValue ("EventMessageFile", data.MessageResourceFile);
                        } else {
                                // FIXME: write default once we have approval for shipping EventLogMessages.dll
                        }

                        if (data.ParameterResourceFile != null && data.ParameterResourceFile.Length > 0)
                                sourceKey.SetValue ("ParameterMessageFile", data.ParameterResourceFile);
                }

                private static string GetLogName (RegistryKey logKey)
                {
                        string logName = logKey.Name;
                        return logName.Substring (logName.LastIndexOf ("\\") + 1);
                }

                private void ReadEventLog (int index, byte [] buffer, ref int bytesRead, ref int minBufferNeeded)
                {
                        const int max_retries = 3;

                        // if the eventlog file changed since the handle was
                        // obtained, then we need to re-try multiple times
                        for (int i = 0; i < max_retries; i++) {
                                int ret = PInvoke.ReadEventLog (ReadHandle, 
                                        ReadFlags.Seek | ReadFlags.ForwardsRead,
                                        index, buffer, buffer.Length, ref bytesRead,
                                        ref minBufferNeeded);
                                if (ret != 1) {
                                        int error = Marshal.GetLastWin32Error ();
                                        if (i < (max_retries - 1)) {
                                                CoreEventLog.Reset ();
                                        } else {
                                                throw new Win32Exception (error);
                                        }
                                }
                        }
                }


                [MonoTODO ("Support remote machines")]
                private static RegistryKey GetEventLogKey (string machineName, bool writable)
                {
                        return Registry.LocalMachine.OpenSubKey (@"SYSTEM\CurrentControlSet\Services\EventLog", writable);
                }

                private static RegistryKey FindSourceKeyByName (string source, string machineName, bool writable)
                {
                        if (source == null || source.Length == 0)
                                return null;

                        RegistryKey eventLogKey = null;
                        try {
                                eventLogKey = GetEventLogKey (machineName, writable);
                                if (eventLogKey == null)
                                        return null;

                                string [] subKeys = eventLogKey.GetSubKeyNames ();
                                for (int i = 0; i < subKeys.Length; i++) {
                                        using (RegistryKey logKey = eventLogKey.OpenSubKey (subKeys [i], writable)) {
                                                if (logKey == null)
                                                        break;

                                                RegistryKey sourceKey = logKey.OpenSubKey (source, writable);
                                                if (sourceKey != null)
                                                        return sourceKey;
                                        }
                                }
                                return null;
                        } finally {
                                if (eventLogKey != null)
                                        eventLogKey.Close ();
                        }
                }

                private static RegistryKey FindLogKeyByName (string logName, string machineName, bool writable)
                {
                        using (RegistryKey eventLogKey = GetEventLogKey (machineName, writable)) {
                                if (eventLogKey == null) {
                                        return null;
                                }

                                return eventLogKey.OpenSubKey (logName, writable);
                        }
                }

                private static RegistryKey FindLogKeyBySource (string source, string machineName, bool writable)
                {
                        if (source == null || source.Length == 0)
                                return null;

                        RegistryKey eventLogKey = null;
                        try {
                                eventLogKey = GetEventLogKey (machineName, writable);
                                if (eventLogKey == null)
                                        return null;

                                string [] subKeys = eventLogKey.GetSubKeyNames ();
                                for (int i = 0; i < subKeys.Length; i++) {
                                        RegistryKey sourceKey = null;
                                        try {
                                                RegistryKey logKey = eventLogKey.OpenSubKey (subKeys [i], writable);
                                                if (logKey != null) {
                                                        sourceKey = logKey.OpenSubKey (source, writable);
                                                        if (sourceKey != null)
                                                                return logKey;
                                                }
                                        } finally {
                                                if (sourceKey != null)
                                                        sourceKey.Close ();
                                        }
                                }
                                return null;
                        } finally {
                                if (eventLogKey != null)
                                        eventLogKey.Close ();
                        }
                }

                private int OldestEventLogEntry {
                        get {
                                int oldestEventLogEntry = 0;
                                int ret = PInvoke.GetOldestEventLogRecord (ReadHandle, ref oldestEventLogEntry);
                                if (ret != 1) {
                                        throw new Win32Exception (Marshal.GetLastWin32Error ());
                                }
                                return oldestEventLogEntry;
                        }
                }

                private void CloseEventLog (IntPtr hEventLog)
                {
                        int ret = PInvoke.CloseEventLog (hEventLog);
                        if (ret != 1) {
                                throw new Win32Exception (Marshal.GetLastWin32Error ());
                        }
                }

                private void DeregisterEventSource (IntPtr hEventLog)
                {
                        int ret = PInvoke.DeregisterEventSource (hEventLog);
                        if (ret != 1) {
                                throw new Win32Exception (Marshal.GetLastWin32Error ());
                        }
                }

                private static string LookupAccountSid (string machineName, byte [] sid)
                {
                        // http://www.pinvoke.net/default.aspx/advapi32/LookupAccountSid.html
                        // http://msdn.microsoft.com/library/en-us/secauthz/security/lookupaccountsid.asp

                        StringBuilder name = new StringBuilder ();
                        uint cchName = (uint) name.Capacity;
                        StringBuilder referencedDomainName = new StringBuilder ();
                        uint cchReferencedDomainName = (uint) referencedDomainName.Capacity;
                        SidNameUse sidUse;

                        string accountName = null;

                        while (accountName == null) {
                                bool retOk = PInvoke.LookupAccountSid (machineName, sid, name, ref cchName,
                                        referencedDomainName, ref cchReferencedDomainName,
                                        out sidUse);
                                if (!retOk) {
                                        int err = Marshal.GetLastWin32Error ();
                                        if (err == PInvoke.ERROR_INSUFFICIENT_BUFFER) {
                                                name.EnsureCapacity ((int) cchName);
                                                referencedDomainName.EnsureCapacity ((int) cchReferencedDomainName);
                                        } else {
                                                // TODO: write warning ?
                                                accountName = string.Empty;
                                        }
                                } else {
                                        accountName = string.Format ("{0}\\{1}", referencedDomainName.ToString (),
                                                name.ToString ());
                                }
                        }
                        return accountName;
                }

                private static string FetchMessage (string msgDll, uint messageID, string [] replacementStrings)
                {
                        // http://msdn.microsoft.com/library/en-us/debug/base/formatmessage.asp
                        // http://msdn.microsoft.com/msdnmag/issues/02/08/CQA/
                        // http://msdn.microsoft.com/netframework/programming/netcf/cffaq/default.aspx

                        IntPtr msgDllHandle = PInvoke.LoadLibraryEx (msgDll, IntPtr.Zero,
                                LoadFlags.LibraryAsDataFile);
                        if (msgDllHandle == IntPtr.Zero)
                                // TODO: write warning
                                return null;

                        IntPtr lpMsgBuf = IntPtr.Zero;
                        IntPtr [] arguments = new IntPtr [replacementStrings.Length];

                        try {
                                for (int i = 0; i < replacementStrings.Length; i++) {
                                        arguments [i] = Marshal.StringToHGlobalAuto (
                                                replacementStrings [i]);
                                }

                                int ret = PInvoke.FormatMessage (FormatMessageFlags.ArgumentArray |
                                        FormatMessageFlags.FromHModule | FormatMessageFlags.AllocateBuffer,
                                        msgDllHandle, messageID, 0, ref lpMsgBuf, 0, arguments);
                                if (ret != 0) {
                                        string sRet = Marshal.PtrToStringAuto (lpMsgBuf);
                                        lpMsgBuf = PInvoke.LocalFree (lpMsgBuf);
                                        // remove trailing whitespace (CRLF)
                                        return sRet.TrimEnd (null);
                                } else {
                                        int err = Marshal.GetLastWin32Error ();
                                        if (err == MESSAGE_NOT_FOUND) {
                                                // do not consider this a failure (or even warning) as
                                                // multiple message resource DLLs may have been configured
                                                // and as such we just need to try the next library if
                                                // the current one does not contain a message for this
                                                // ID
                                        } else {
                                                // TODO: report warning
                                        }
                                }
                        } finally {
                                // release unmanaged memory allocated for replacement strings
                                for (int i = 0; i < arguments.Length; i++) {
                                        IntPtr argument = arguments [i];
                                        if (argument != IntPtr.Zero)
                                                Marshal.FreeHGlobal (argument);
                                }

                                PInvoke.FreeLibrary (msgDllHandle);
                        }
                        return null;
                }

                private string [] GetMessageResourceDlls (string source, string valueName)
                {
                        // Some event sources (such as Userenv) have multiple message
                        // resource DLLs, delimited by a semicolon.

                        RegistryKey sourceKey = FindSourceKeyByName (source,
                                CoreEventLog.MachineName, false);
                        if (sourceKey != null) {
                                string value = sourceKey.GetValue (valueName) as string;
                                if (value != null) {
                                        string [] msgResDlls = value.Split (';');
                                        return msgResDlls;
                                }
                        }
                        return new string [0];
                }

                private IntPtr ReadHandle {
                        get {
                                if (_readHandle != IntPtr.Zero)
                                        return _readHandle;

                                string logName = CoreEventLog.GetLogName ();
                                _readHandle = PInvoke.OpenEventLog (CoreEventLog.MachineName,
                                        logName);
                                if (_readHandle == IntPtr.Zero)
                                        throw new InvalidOperationException (string.Format (
                                                CultureInfo.InvariantCulture, "Event Log '{0}' on computer"
                                                + " '{1}' cannot be opened.", logName, CoreEventLog.MachineName),
                                                new Win32Exception ());
                                return _readHandle;
                        }
                }

                private IntPtr RegisterEventSource ()
                {
                        IntPtr hEventLog = PInvoke.RegisterEventSource (
                                CoreEventLog.MachineName, CoreEventLog.Source);
                        if (hEventLog == IntPtr.Zero) {
                                throw new InvalidOperationException (string.Format (
                                        CultureInfo.InvariantCulture, "Event source '{0}' on computer"
                                        + " '{1}' cannot be opened.", CoreEventLog.Source,
                                        CoreEventLog.MachineName), new Win32Exception ());
                        }
                        return hEventLog;
                }

                public override void DisableNotification ()
                {
                        if (_notifyResetEvent != null) {
                                _notifyResetEvent.Close ();
                                _notifyResetEvent = null;
                        }

                        if (_notifyThread != null) {
                                if (_notifyThread.ThreadState == System.Threading.ThreadState.Running)
                                        _notifyThread.Abort ();
                                _notifyThread = null;
                        }
                }

                public override void EnableNotification ()
                {
                        _notifyResetEvent = new ManualResetEvent (false);
                        _lastEntryWritten = OldestEventLogEntry + EntryCount;
                        if (PInvoke.NotifyChangeEventLog (ReadHandle, _notifyResetEvent.Handle) == 0)
                                throw new InvalidOperationException (string.Format (
                                        CultureInfo.InvariantCulture, "Unable to receive notifications"
                                        + " for log '{0}' on computer '{1}'.", CoreEventLog.GetLogName (),
                                        CoreEventLog.MachineName), new Win32Exception ());
                        _notifyThread = new Thread (new ThreadStart (NotifyEventThread));
                        _notifyThread.IsBackground = true;
                        _notifyThread.Start ();
                }

                private void NotifyEventThread ()
                {
                        while (true) {
                                _notifyResetEvent.WaitOne ();
                                lock (this) {
                                        // after a clear, we something get notified
                                        // twice for the same entry
                                        if (_notifying)
                                                return;
                                        _notifying = true;
                                }

                                try {
                                        int oldest_entry = OldestEventLogEntry;
                                        if (_lastEntryWritten < oldest_entry)
                                                _lastEntryWritten = oldest_entry;
                                        int current_entry = _lastEntryWritten - oldest_entry;
                                        int last_entry = EntryCount + oldest_entry;
                                        for (int i = current_entry; i < (last_entry - 1); i++) {
                                                EventLogEntry entry = GetEntry (i);
                                                CoreEventLog.OnEntryWritten (entry);
                                        }
                                        _lastEntryWritten = last_entry;
                                } finally {
                                        lock (this)
                                                _notifying = false;
                                }
                        }
                }

#if NET_2_0
                public override OverflowAction OverflowAction {
                        get { throw new NotImplementedException (); }
                }

                public override int MinimumRetentionDays {
                        get { throw new NotImplementedException (); }
                }

                public override long MaximumKilobytes {
                        get { throw new NotImplementedException (); }
                        set { throw new NotImplementedException (); }
                }

                public override void ModifyOverflowPolicy (OverflowAction action, int retentionDays)
                {
                        throw new NotImplementedException ();
                }

                public override void RegisterDisplayName (string resourceFile, long resourceId)
                {
                        throw new NotImplementedException ();
                }
#endif

                private class PInvoke
                {
                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern int ClearEventLog (IntPtr hEventLog, string lpBackupFileName);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern int CloseEventLog (IntPtr hEventLog);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern int DeregisterEventSource (IntPtr hEventLog);

                        [DllImport ("kernel32.dll", CharSet=CharSet.Auto, SetLastError=true)]
                        public static extern int FormatMessage (FormatMessageFlags dwFlags, IntPtr lpSource, uint dwMessageId, int dwLanguageId, ref IntPtr lpBuffer, int nSize, IntPtr [] arguments);

                        [DllImport ("kernel32.dll", SetLastError=true)]
                        public static extern bool FreeLibrary (IntPtr hModule);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern int GetNumberOfEventLogRecords (IntPtr hEventLog, ref int NumberOfRecords);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern int GetOldestEventLogRecord (IntPtr hEventLog, ref int OldestRecord);

                        [DllImport ("kernel32.dll", SetLastError=true)]
                        public static extern IntPtr LoadLibraryEx (string lpFileName, IntPtr hFile, LoadFlags dwFlags);

                        [DllImport ("kernel32.dll", SetLastError=true)]
                        public static extern IntPtr LocalFree (IntPtr hMem);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern bool LookupAccountSid (
                                string lpSystemName,
                                [MarshalAs (UnmanagedType.LPArray)] byte [] Sid,
                                StringBuilder lpName,
                                ref uint cchName,
                                StringBuilder ReferencedDomainName,
                                ref uint cchReferencedDomainName,
                                out SidNameUse peUse);

                        [DllImport ("Advapi32.dll", SetLastError = true)]
                        public static extern int NotifyChangeEventLog (IntPtr hEventLog, IntPtr hEvent);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern IntPtr OpenEventLog (string machineName, string logName);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern IntPtr RegisterEventSource (string machineName, string sourceName);

                        [DllImport ("Advapi32.dll", SetLastError=true)]
                        public static extern int ReportEvent (IntPtr hHandle, ushort wType,
                                ushort wCategory, uint dwEventID, IntPtr sid, ushort wNumStrings,
                                uint dwDataSize, string [] lpStrings, byte [] lpRawData);

                        [DllImport ("advapi32.dll", SetLastError=true)]
                        public static extern int ReadEventLog (IntPtr hEventLog, ReadFlags dwReadFlags, int dwRecordOffset, byte [] buffer, int nNumberOfBytesToRead, ref int pnBytesRead, ref int pnMinNumberOfBytesNeeded);

                        public const int ERROR_INSUFFICIENT_BUFFER = 122;
                        public const int ERROR_EVENTLOG_FILE_CHANGED = 1503;
                }

                private enum ReadFlags
                {
                        Sequential = 0x001,
                        Seek = 0x002,
                        ForwardsRead = 0x004,
                        BackwardsRead = 0x008
                }

                private enum LoadFlags: uint
                {
                        LibraryAsDataFile = 0x002
                }

                [Flags]
                private enum FormatMessageFlags
                {
                        AllocateBuffer = 0x100,
                        IgnoreInserts = 0x200,
                        FromHModule = 0x0800,
                        FromSystem = 0x1000,
                        ArgumentArray = 0x2000
                }

                private enum SidNameUse
                {
                        User = 1,
                        Group,
                        Domain,
                        lias,
                        WellKnownGroup,
                        DeletedAccount,
                        Invalid,
                        Unknown,
                        Computer
                }
        }
}

// http://msdn.microsoft.com/library/en-us/eventlog/base/eventlogrecord_str.asp:
//
// struct EVENTLOGRECORD {
//      int Length;
//      int Reserved;
//      int RecordNumber;
//      int TimeGenerated;
//      int TimeWritten;
//      int EventID;
//      short EventType;
//      short NumStrings;
//      short EventCategory;
//      short ReservedFlags;
//      int ClosingRecordNumber;
//      int StringOffset;
//      int UserSidLength;
//      int UserSidOffset;
//      int DataLength;
//      int DataOffset;
// }
//
// http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html