dlls/advapi32/tests/eventlog.c

   1 /*
   2  * Unit tests for Event Logging functions
   3  *
   4  * Copyright (c) 2009 Paul Vriens
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #include <stdarg.h>
  22
  23 #include "windef.h"
  24 #include "winbase.h"
  25 #include "winerror.h"
  26 #include "winnt.h"
  27
  28 #include "wine/test.h"
  29
  30 static BOOL (WINAPI *pGetEventLogInformation)(HANDLE,DWORD,LPVOID,DWORD,LPDWORD);
  31
  32 static void init_function_pointers(void)
  33 {
  34     HMODULE hadvapi32 = GetModuleHandleA("advapi32.dll");
  35
  36     pGetEventLogInformation = (void*)GetProcAddress(hadvapi32, "GetEventLogInformation");
  37 }
  38
  39 static void create_backup(const char *filename)
  40 {
  41     HANDLE handle;
  42
  43     DeleteFileA(filename);
  44     handle = OpenEventLogA(NULL, "Application");
  45     BackupEventLogA(handle, filename);
  46     CloseEventLog(handle);
  47
  48     todo_wine
  49     ok(GetFileAttributesA(filename) != INVALID_FILE_ATTRIBUTES, "Expected a backup file\n");
  50 }
  51
  52 static void test_open_close(void)
  53 {
  54     HANDLE handle;
  55     BOOL ret;
  56
  57     SetLastError(0xdeadbeef);
  58     ret = CloseEventLog(NULL);
  59     ok(!ret, "Expected failure\n");
  60     ok(GetLastError() == ERROR_INVALID_HANDLE ||
  61        GetLastError() == ERROR_NOACCESS, /* W2K */
  62        "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
  63
  64     SetLastError(0xdeadbeef);
  65     handle = OpenEventLogA(NULL, NULL);
  66     ok(handle == NULL, "Didn't expect a handle\n");
  67     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
  68
  69     SetLastError(0xdeadbeef);
  70     handle = OpenEventLogA("IDontExist", NULL);
  71     ok(handle == NULL, "Didn't expect a handle\n");
  72     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
  73
  74     SetLastError(0xdeadbeef);
  75     handle = OpenEventLogA("IDontExist", "deadbeef");
  76     ok(handle == NULL, "Didn't expect a handle\n");
  77     ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
  78        GetLastError() == RPC_S_INVALID_NET_ADDR, /* Some Vista and Win7 */
  79        "Expected RPC_S_SERVER_UNAVAILABLE, got %d\n", GetLastError());
  80
  81     /* This one opens the Application log */
  82     handle = OpenEventLogA(NULL, "deadbeef");
  83     ok(handle != NULL, "Expected a handle\n");
  84     ret = CloseEventLog(handle);
  85     ok(ret, "Expected success\n");
  86     /* Close a second time */
  87     SetLastError(0xdeadbeef);
  88     ret = CloseEventLog(handle);
  89     todo_wine
  90     {
  91     ok(!ret, "Expected failure\n");
  92     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
  93     }
  94
  95     /* Empty servername should be read as local server */
  96     handle = OpenEventLogA("", "Application");
  97     ok(handle != NULL, "Expected a handle\n");
  98     CloseEventLog(handle);
  99
 100     handle = OpenEventLogA(NULL, "Application");
 101     ok(handle != NULL, "Expected a handle\n");
 102     CloseEventLog(handle);
 103 }
 104
 105 static void test_info(void)
 106 {
 107     HANDLE handle;
 108     BOOL ret;
 109     DWORD needed;
 110     EVENTLOG_FULL_INFORMATION efi;
 111
 112     if (!pGetEventLogInformation)
 113     {
 114         /* NT4 */
 115         win_skip("GetEventLogInformation is not available\n");
 116         return;
 117     }
 118     SetLastError(0xdeadbeef);
 119     ret = pGetEventLogInformation(NULL, 1, NULL, 0, NULL);
 120     ok(!ret, "Expected failure\n");
 121     ok(GetLastError() == ERROR_INVALID_LEVEL, "Expected ERROR_INVALID_LEVEL, got %d\n", GetLastError());
 122
 123     SetLastError(0xdeadbeef);
 124     ret = pGetEventLogInformation(NULL, EVENTLOG_FULL_INFO, NULL, 0, NULL);
 125     ok(!ret, "Expected failure\n");
 126     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 127
 128     handle = OpenEventLogA(NULL, "Application");
 129
 130     SetLastError(0xdeadbeef);
 131     ret = pGetEventLogInformation(handle, EVENTLOG_FULL_INFO, NULL, 0, NULL);
 132     ok(!ret, "Expected failure\n");
 133     ok(GetLastError() == RPC_X_NULL_REF_POINTER, "Expected RPC_X_NULL_REF_POINTER, got %d\n", GetLastError());
 134
 135     SetLastError(0xdeadbeef);
 136     ret = pGetEventLogInformation(handle, EVENTLOG_FULL_INFO, NULL, 0, &needed);
 137     ok(!ret, "Expected failure\n");
 138     ok(GetLastError() == RPC_X_NULL_REF_POINTER, "Expected RPC_X_NULL_REF_POINTER, got %d\n", GetLastError());
 139
 140     SetLastError(0xdeadbeef);
 141     ret = pGetEventLogInformation(handle, EVENTLOG_FULL_INFO, (LPVOID)&efi, 0, NULL);
 142     ok(!ret, "Expected failure\n");
 143     ok(GetLastError() == RPC_X_NULL_REF_POINTER, "Expected RPC_X_NULL_REF_POINTER, got %d\n", GetLastError());
 144
 145     SetLastError(0xdeadbeef);
 146     needed = 0xdeadbeef;
 147     efi.dwFull = 0xdeadbeef;
 148     ret = pGetEventLogInformation(handle, EVENTLOG_FULL_INFO, (LPVOID)&efi, 0, &needed);
 149     ok(!ret, "Expected failure\n");
 150     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
 151     ok(needed == sizeof(EVENTLOG_FULL_INFORMATION), "Expected sizeof(EVENTLOG_FULL_INFORMATION), got %d\n", needed);
 152     ok(efi.dwFull == 0xdeadbeef, "Expected no change to the dwFull member\n");
 153
 154     /* Not that we care, but on success last error is set to ERROR_IO_PENDING */
 155     efi.dwFull = 0xdeadbeef;
 156     needed *= 2;
 157     ret = pGetEventLogInformation(handle, EVENTLOG_FULL_INFO, (LPVOID)&efi, needed, &needed);
 158     ok(ret, "Expected success\n");
 159     ok(needed == sizeof(EVENTLOG_FULL_INFORMATION), "Expected sizeof(EVENTLOG_FULL_INFORMATION), got %d\n", needed);
 160     ok(efi.dwFull == 0 || efi.dwFull == 1, "Expected 0 (not full) or 1 (full), got %d\n", efi.dwFull);
 161
 162     CloseEventLog(handle);
 163 }
 164
 165 static void test_count(void)
 166 {
 167     HANDLE handle;
 168     BOOL ret;
 169     DWORD count;
 170     const char backup[] = "backup.evt";
 171
 172     SetLastError(0xdeadbeef);
 173     ret = GetNumberOfEventLogRecords(NULL, NULL);
 174     ok(!ret, "Expected failure\n");
 175     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 176
 177     SetLastError(0xdeadbeef);
 178     count = 0xdeadbeef;
 179     ret = GetNumberOfEventLogRecords(NULL, &count);
 180     ok(!ret, "Expected failure\n");
 181     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 182     ok(count == 0xdeadbeef, "Expected count to stay unchanged\n");
 183
 184     handle = OpenEventLogA(NULL, "Application");
 185
 186     SetLastError(0xdeadbeef);
 187     ret = GetNumberOfEventLogRecords(handle, NULL);
 188     ok(!ret, "Expected failure\n");
 189     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 190
 191     count = 0xdeadbeef;
 192     ret = GetNumberOfEventLogRecords(handle, &count);
 193     ok(ret, "Expected success\n");
 194     ok(count != 0xdeadbeef, "Expected the number of records\n");
 195
 196     CloseEventLog(handle);
 197
 198     /* Make a backup eventlog to work with */
 199     create_backup(backup);
 200
 201     handle = OpenBackupEventLogA(NULL, backup);
 202     todo_wine
 203     ok(handle != NULL, "Expected a handle\n");
 204
 205     /* Does GetNumberOfEventLogRecords work with backup eventlogs? */
 206     count = 0xdeadbeef;
 207     ret = GetNumberOfEventLogRecords(handle, &count);
 208     todo_wine
 209     {
 210     ok(ret, "Expected success\n");
 211     ok(count != 0xdeadbeef, "Expected the number of records\n");
 212     }
 213
 214     CloseEventLog(handle);
 215     DeleteFileA(backup);
 216 }
 217
 218 static void test_oldest(void)
 219 {
 220     HANDLE handle;
 221     BOOL ret;
 222     DWORD oldest;
 223     const char backup[] = "backup.evt";
 224
 225     SetLastError(0xdeadbeef);
 226     ret = GetOldestEventLogRecord(NULL, NULL);
 227     ok(!ret, "Expected failure\n");
 228     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 229
 230     SetLastError(0xdeadbeef);
 231     oldest = 0xdeadbeef;
 232     ret = GetOldestEventLogRecord(NULL, &oldest);
 233     ok(!ret, "Expected failure\n");
 234     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 235     ok(oldest == 0xdeadbeef, "Expected oldest to stay unchanged\n");
 236
 237     handle = OpenEventLogA(NULL, "Application");
 238
 239     SetLastError(0xdeadbeef);
 240     ret = GetOldestEventLogRecord(handle, NULL);
 241     ok(!ret, "Expected failure\n");
 242     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 243
 244     oldest = 0xdeadbeef;
 245     ret = GetOldestEventLogRecord(handle, &oldest);
 246     ok(ret, "Expected success\n");
 247     ok(oldest != 0xdeadbeef, "Expected the number of the oldest record\n");
 248
 249     CloseEventLog(handle);
 250
 251     /* Make a backup eventlog to work with */
 252     create_backup(backup);
 253
 254     handle = OpenBackupEventLogA(NULL, backup);
 255     todo_wine
 256     ok(handle != NULL, "Expected a handle\n");
 257
 258     /* Does GetOldestEventLogRecord work with backup eventlogs? */
 259     oldest = 0xdeadbeef;
 260     ret = GetOldestEventLogRecord(handle, &oldest);
 261     todo_wine
 262     {
 263     ok(ret, "Expected success\n");
 264     ok(oldest != 0xdeadbeef, "Expected the number of the oldest record\n");
 265     }
 266
 267     CloseEventLog(handle);
 268     DeleteFileA(backup);
 269 }
 270
 271 static void test_backup(void)
 272 {
 273     HANDLE handle;
 274     BOOL ret;
 275     const char backup[] = "backup.evt";
 276     const char backup2[] = "backup2.evt";
 277
 278     SetLastError(0xdeadbeef);
 279     ret = BackupEventLogA(NULL, NULL);
 280     ok(!ret, "Expected failure\n");
 281     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 282
 283     SetLastError(0xdeadbeef);
 284     ret = BackupEventLogA(NULL, backup);
 285     ok(!ret, "Expected failure\n");
 286     ok(GetFileAttributesA(backup) == INVALID_FILE_ATTRIBUTES, "Expected no backup file\n");
 287
 288     handle = OpenEventLogA(NULL, "Application");
 289
 290     SetLastError(0xdeadbeef);
 291     ret = BackupEventLogA(handle, NULL);
 292     ok(!ret, "Expected failure\n");
 293     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 294
 295     ret = BackupEventLogA(handle, backup);
 296     ok(ret, "Expected success\n");
 297     todo_wine
 298     ok(GetFileAttributesA(backup) != INVALID_FILE_ATTRIBUTES, "Expected a backup file\n");
 299
 300     /* Try to overwrite */
 301     SetLastError(0xdeadbeef);
 302     ret = BackupEventLogA(handle, backup);
 303     todo_wine
 304     {
 305     ok(!ret, "Expected failure\n");
 306     ok(GetLastError() == ERROR_ALREADY_EXISTS, "Expected ERROR_ALREADY_EXISTS, got %d\n", GetLastError());
 307     }
 308
 309     CloseEventLog(handle);
 310
 311     /* Can we make a backup of a backup? */
 312     handle = OpenBackupEventLogA(NULL, backup);
 313     todo_wine
 314     ok(handle != NULL, "Expected a handle\n");
 315
 316     ret = BackupEventLogA(handle, backup2);
 317     todo_wine
 318     {
 319     ok(ret, "Expected success\n");
 320     ok(GetFileAttributesA(backup2) != INVALID_FILE_ATTRIBUTES, "Expected a backup file\n");
 321     }
 322
 323     CloseEventLog(handle);
 324     DeleteFileA(backup);
 325     DeleteFileA(backup2);
 326 }
 327
 328 static void test_read(void)
 329 {
 330     HANDLE handle;
 331     BOOL ret;
 332     DWORD count, toread, read, needed;
 333     void *buf;
 334
 335     SetLastError(0xdeadbeef);
 336     ret = ReadEventLogA(NULL, 0, 0, NULL, 0, NULL, NULL);
 337     ok(!ret, "Expected failure\n");
 338     todo_wine
 339     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 340
 341     read = 0xdeadbeef;
 342     SetLastError(0xdeadbeef);
 343     ret = ReadEventLogA(NULL, 0, 0, NULL, 0, &read, NULL);
 344     ok(!ret, "Expected failure\n");
 345     ok(read == 0xdeadbeef, "Expected 'read' parameter to remain unchanged\n");
 346     todo_wine
 347     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 348
 349     needed = 0xdeadbeef;
 350     SetLastError(0xdeadbeef);
 351     ret = ReadEventLogA(NULL, 0, 0, NULL, 0, NULL, &needed);
 352     ok(!ret, "Expected failure\n");
 353     ok(needed == 0xdeadbeef, "Expected 'needed' parameter to remain unchanged\n");
 354     todo_wine
 355     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 356
 357     /* 'read' and 'needed' are only filled when the needed buffer size is passed back or when the call succeeds */
 358     SetLastError(0xdeadbeef);
 359     ret = ReadEventLogA(NULL, 0, 0, NULL, 0, &read, &needed);
 360     ok(!ret, "Expected failure\n");
 361     todo_wine
 362     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 363
 364     SetLastError(0xdeadbeef);
 365     ret = ReadEventLogA(NULL, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, 0, NULL, 0, NULL, NULL);
 366     ok(!ret, "Expected failure\n");
 367     todo_wine
 368     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 369
 370     SetLastError(0xdeadbeef);
 371     ret = ReadEventLogA(NULL, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, 0, NULL, 0, &read, &needed);
 372     ok(!ret, "Expected failure\n");
 373     todo_wine
 374     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 375
 376     buf = NULL;
 377     SetLastError(0xdeadbeef);
 378     ret = ReadEventLogA(NULL, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ,
 379                         0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 380     ok(!ret, "Expected failure\n");
 381     todo_wine
 382     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 383
 384     buf = HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD));
 385     SetLastError(0xdeadbeef);
 386     ret = ReadEventLogA(NULL, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ,
 387                         0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 388     ok(!ret, "Expected failure\n");
 389     todo_wine
 390     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 391     HeapFree(GetProcessHeap(), 0, buf);
 392
 393     handle = OpenEventLogA(NULL, "Application");
 394
 395     /* Show that we need the proper dwFlags with a (for the rest) proper call */
 396     buf = HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD));
 397
 398     SetLastError(0xdeadbeef);
 399     ret = ReadEventLogA(handle, 0, 0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 400     ok(!ret, "Expected failure\n");
 401     todo_wine
 402     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 403
 404     SetLastError(0xdeadbeef);
 405     ret = ReadEventLogA(handle, EVENTLOG_SEQUENTIAL_READ, 0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 406     ok(!ret, "Expected failure\n");
 407     todo_wine
 408     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 409
 410     SetLastError(0xdeadbeef);
 411     ret = ReadEventLogA(handle, EVENTLOG_SEEK_READ, 0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 412     ok(!ret, "Expected failure\n");
 413     todo_wine
 414     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 415
 416     SetLastError(0xdeadbeef);
 417     ret = ReadEventLogA(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ,
 418                         0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 419     ok(!ret, "Expected failure\n");
 420     todo_wine
 421     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 422
 423     SetLastError(0xdeadbeef);
 424     ret = ReadEventLogA(handle, EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ,
 425                         0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 426     ok(!ret, "Expected failure\n");
 427     todo_wine
 428     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 429
 430     SetLastError(0xdeadbeef);
 431     ret = ReadEventLogA(handle, EVENTLOG_SEEK_READ | EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ,
 432                         0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 433     ok(!ret, "Expected failure\n");
 434     todo_wine
 435     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 436
 437     HeapFree(GetProcessHeap(), 0, buf);
 438
 439     /* First check if there are any records (in practice only on Wine: FIXME) */
 440     count = 0;
 441     GetNumberOfEventLogRecords(handle, &count);
 442     if (!count)
 443     {
 444         skip("No records in the 'Application' log\n");
 445         CloseEventLog(handle);
 446         return;
 447     }
 448
 449     /* Get the buffer size for the first record */
 450     buf = HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD));
 451     read = needed = 0xdeadbeef;
 452     SetLastError(0xdeadbeef);
 453     ret = ReadEventLogA(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ,
 454                         0, buf, sizeof(EVENTLOGRECORD), &read, &needed);
 455     ok(!ret, "Expected failure\n");
 456     ok(read == 0, "Expected no bytes read\n");
 457     ok(needed > sizeof(EVENTLOGRECORD), "Expected the needed buffersize to be bigger than sizeof(EVENTLOGRECORD)\n");
 458     ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 459
 460     /* Read the first record */
 461     toread = needed;
 462     buf = HeapReAlloc(GetProcessHeap(), 0, buf, toread);
 463     read = needed = 0xdeadbeef;
 464     SetLastError(0xdeadbeef);
 465     ret = ReadEventLogA(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, 0, buf, toread, &read, &needed);
 466     ok(ret, "Expected success\n");
 467     ok(read == toread ||
 468        broken(read < toread), /* NT4 wants a buffer size way bigger than just 1 record */
 469        "Expected the requested size to be read\n");
 470     ok(needed == 0, "Expected no extra bytes to be read\n");
 471     HeapFree(GetProcessHeap(), 0, buf);
 472
 473     CloseEventLog(handle);
 474 }
 475
 476 static void test_openbackup(void)
 477 {
 478     HANDLE handle, handle2, file;
 479     DWORD written;
 480     const char backup[] = "backup.evt";
 481     const char text[] = "Just some text";
 482
 483     SetLastError(0xdeadbeef);
 484     handle = OpenBackupEventLogA(NULL, NULL);
 485     ok(handle == NULL, "Didn't expect a handle\n");
 486     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 487
 488     SetLastError(0xdeadbeef);
 489     handle = OpenBackupEventLogA(NULL, "idontexist.evt");
 490     ok(handle == NULL, "Didn't expect a handle\n");
 491     ok(GetLastError() == ERROR_FILE_NOT_FOUND, "Expected ERROR_FILE_NOT_FOUND, got %d\n", GetLastError());
 492
 493     SetLastError(0xdeadbeef);
 494     handle = OpenBackupEventLogA("IDontExist", NULL);
 495     ok(handle == NULL, "Didn't expect a handle\n");
 496     ok(GetLastError() == ERROR_INVALID_PARAMETER, "Expected ERROR_INVALID_PARAMETER, got %d\n", GetLastError());
 497
 498     SetLastError(0xdeadbeef);
 499     handle = OpenBackupEventLogA("IDontExist", "idontexist.evt");
 500     ok(handle == NULL, "Didn't expect a handle\n");
 501     ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
 502        GetLastError() == RPC_S_INVALID_NET_ADDR, /* Some Vista and Win7 */
 503        "Expected RPC_S_SERVER_UNAVAILABLE, got %d\n", GetLastError());
 504
 505     /* Make a backup eventlog to work with */
 506     create_backup(backup);
 507
 508     /* FIXME: Wine stops here */
 509     if (GetFileAttributesA(backup) == INVALID_FILE_ATTRIBUTES)
 510     {
 511         skip("We don't have a backup eventlog to work with\n");
 512         return;
 513     }
 514
 515     SetLastError(0xdeadbeef);
 516     handle = OpenBackupEventLogA("IDontExist", backup);
 517     ok(handle == NULL, "Didn't expect a handle\n");
 518     ok(GetLastError() == RPC_S_SERVER_UNAVAILABLE ||
 519        GetLastError() == RPC_S_INVALID_NET_ADDR, /* Some Vista and Win7 */
 520        "Expected RPC_S_SERVER_UNAVAILABLE, got %d\n", GetLastError());
 521
 522     /* Empty servername should be read as local server */
 523     handle = OpenBackupEventLogA("", backup);
 524     ok(handle != NULL, "Expected a handle\n");
 525     CloseEventLog(handle);
 526
 527     handle = OpenBackupEventLogA(NULL, backup);
 528     ok(handle != NULL, "Expected a handle\n");
 529
 530     /* Can we open that same backup eventlog more than once? */
 531     handle2 = OpenBackupEventLogA(NULL, backup);
 532     ok(handle2 != NULL, "Expected a handle\n");
 533     ok(handle2 != handle, "Didn't expect the same handle\n");
 534     CloseEventLog(handle2);
 535
 536     CloseEventLog(handle);
 537     DeleteFileA(backup);
 538
 539     /* Is there any content checking done? */
 540     file = CreateFileA(backup, GENERIC_WRITE, 0, NULL, CREATE_NEW, 0, NULL);
 541     CloseHandle(file);
 542     SetLastError(0xdeadbeef);
 543     handle = OpenBackupEventLogA(NULL, backup);
 544     ok(handle == NULL, "Didn't expect a handle\n");
 545     ok(GetLastError() == ERROR_NOT_ENOUGH_MEMORY ||
 546        GetLastError() == ERROR_EVENTLOG_FILE_CORRUPT, /* Vista and Win7 */
 547        "Expected ERROR_NOT_ENOUGH_MEMORY, got %d\n", GetLastError());
 548     CloseEventLog(handle);
 549     DeleteFileA(backup);
 550
 551     file = CreateFileA(backup, GENERIC_WRITE, 0, NULL, CREATE_NEW, 0, NULL);
 552     WriteFile(file, text, sizeof(text), &written, NULL);
 553     CloseHandle(file);
 554     SetLastError(0xdeadbeef);
 555     handle = OpenBackupEventLogA(NULL, backup);
 556     ok(handle == NULL, "Didn't expect a handle\n");
 557     ok(GetLastError() == ERROR_EVENTLOG_FILE_CORRUPT, "Expected ERROR_EVENTLOG_FILE_CORRUPT, got %d\n", GetLastError());
 558     CloseEventLog(handle);
 559     DeleteFileA(backup);
 560 }
 561
 562 static void test_clear(void)
 563 {
 564     HANDLE handle;
 565     BOOL ret;
 566     const char backup[] = "backup.evt";
 567     const char backup2[] = "backup2.evt";
 568
 569     SetLastError(0xdeadbeef);
 570     ret = ClearEventLogA(NULL, NULL);
 571     ok(!ret, "Expected failure\n");
 572     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 573
 574     /* Make a backup eventlog to work with */
 575     create_backup(backup);
 576
 577     SetLastError(0xdeadbeef);
 578     ret = ClearEventLogA(NULL, backup);
 579     ok(!ret, "Expected failure\n");
 580     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 581
 582     handle = OpenBackupEventLogA(NULL, backup);
 583     todo_wine
 584     ok(handle != NULL, "Expected a handle\n");
 585
 586     /* A real eventlog would fail with ERROR_ALREADY_EXISTS */
 587     SetLastError(0xdeadbeef);
 588     ret = ClearEventLogA(handle, backup);
 589     ok(!ret, "Expected failure\n");
 590     /* The eventlog service runs under an account that doesn't have the necessary
 591      * permissions on the users home directory on a default Vista+ system.
 592      */
 593     ok(GetLastError() == ERROR_INVALID_HANDLE ||
 594        GetLastError() == ERROR_ACCESS_DENIED, /* Vista+ */
 595        "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 596
 597     /* Show that ClearEventLog only works for real eventlogs. */
 598     SetLastError(0xdeadbeef);
 599     ret = ClearEventLogA(handle, backup2);
 600     ok(!ret, "Expected failure\n");
 601     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 602     ok(GetFileAttributesA(backup2) == INVALID_FILE_ATTRIBUTES, "Expected no backup file\n");
 603
 604     SetLastError(0xdeadbeef);
 605     ret = ClearEventLogA(handle, NULL);
 606     ok(!ret, "Expected failure\n");
 607     ok(GetLastError() == ERROR_INVALID_HANDLE, "Expected ERROR_INVALID_HANDLE, got %d\n", GetLastError());
 608
 609     CloseEventLog(handle);
 610     todo_wine
 611     ok(DeleteFileA(backup), "Could not delete the backup file\n");
 612 }
 613
 614 START_TEST(eventlog)
 615 {
 616     SetLastError(0xdeadbeef);
 617     CloseEventLog(NULL);
 618     if (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 619     {
 620         win_skip("Event log functions are not implemented\n");
 621         return;
 622     }
 623
 624     init_function_pointers();
 625
 626     /* Parameters only */
 627     test_open_close();
 628     test_info();
 629     test_count();
 630     test_oldest();
 631     test_backup();
 632     test_openbackup();
 633     test_read();
 634     test_clear();
 635 }