// Licensed under the Apache License, Version 2.0
// <LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0 > or the MIT license
// <LICENSE-MIT or http://opensource.org/licenses/MIT >, at your option.
// All files in the project carrying such notice may not be copied, modified, or distributed
// except according to those terms.
//! Windows Events API
use ctypes::{c_double, c_float};
use shared::basetsd::{INT16, INT32, INT64, INT8, UINT16, UINT32, UINT64, UINT8};
use shared::guiddef::GUID;
use shared::minwindef::{BOOL, DWORD, FILETIME, PBYTE, PDWORD};
use um::minwinbase::SYSTEMTIME;
use um::winnt::{HANDLE, LCID, LONGLONG, LPCSTR, LPCWSTR, LPSTR, LPWSTR, PSID, PVOID, ULONG
LONG};
use vc::vcruntime::size_t;
pub type EVT_HANDLE = HANDLE;
pub type PEVT_HANDLE = *mut HANDLE;
ENUM !{enum EVT_VARIANT_TYPE {
EvtVarTypeNull = 0 ,
EvtVarTypeString = 1 ,
EvtVarTypeAnsiString = 2 ,
EvtVarTypeSByte = 3 ,
EvtVarTypeByte = 4 ,
EvtVarTypeInt16 = 5 ,
EvtVarTypeUInt16 = 6 ,
EvtVarTypeInt32 = 7 ,
EvtVarTypeUInt32 = 8 ,
EvtVarTypeInt64 = 9 ,
EvtVarTypeUInt64 = 10 ,
EvtVarTypeSingle = 11 ,
EvtVarTypeDouble = 12 ,
EvtVarTypeBoolean = 13 ,
EvtVarTypeBinary = 14 ,
EvtVarTypeGuid = 15 ,
EvtVarTypeSizeT = 16 ,
EvtVarTypeFileTime = 17 ,
EvtVarTypeSysTime = 18 ,
EvtVarTypeSid = 19 ,
EvtVarTypeHexInt32 = 20 ,
EvtVarTypeHexInt64 = 21 ,
EvtVarTypeEvtHandle = 32 ,
EvtVarTypeEvtXml = 35 ,
}}
pub const EVT_VARIANT_TYPE_MASK: DWORD = 0 x7f;
pub const EVT_VARIANT_TYPE_ARRAY: DWORD = 128 ;
UNION!{union EVT_VARIANT_u {
[u64; 1 ],
BooleanVal BooleanVal_mut: BOOL,
SByteVal SByteVal_mut: INT8,
Int16Val Int16Val_mut: INT16,
Int32Val Int32Val_mut: INT32,
Int64Val Int64Val_mut: INT64,
ByteVal ByteVal_mut: UINT8,
UInt16Val UInt16Val_mut: UINT16,
UInt32Val UInt32Val_mut: UINT32,
UInt64Val UInt64Val_mut: UINT64,
SingleVal SingleVal_mut: c_float,
DoubleVal DoubleVal_mut: c_double,
FileTimeVal FileTimeVal_mut: ULONGLONG,
SysTimeVal SysTimeVal_mut: *mut SYSTEMTIME,
GuidVal GuidVal_mut: *mut GUID,
StringVal StringVal_mut: LPCWSTR,
AnsiStringVal AnsiStringVal_mut: LPCSTR,
BinaryVal BinaryVal_mut: PBYTE,
SidVal SidVal_mut: PSID,
SizeTVal SizeTVal_mut: size_t,
BooleanArr BooleanArr_mut: *mut BOOL,
SByteArr SByteArr_mut: *mut INT8,
Int16Arr Int16Arr_mut: *mut INT16,
Int32Arr Int32Arr_mut: *mut INT32,
Int64Arr Int64Arr_mut: *mut INT64,
ByteArr ByteArr_mut: *mut UINT8,
UInt16Arr UInt16Arr_mut: *mut UINT16,
UInt32Arr UInt32Arr_mut: *mut UINT32,
UInt64Arr UInt64Arr_mut: *mut UINT64,
SingleArr SingleArr_mut: *mut c_float,
DoubleArr DoubleArr_mut: *mut c_double,
FileTimeArr FileTimeArr_mut: *mut FILETIME,
SysTimeArr SysTimeArr_mut: *mut SYSTEMTIME,
GuidArr GuidArr_mut: *mut GUID,
StringArr StringArr_mut: *mut LPWSTR,
AnsiStringArr AnsiStringArr_mut: *mut LPSTR,
SidArr SidArr_mut: *mut PSID,
SizeTArr SizeTArr_mut: *mut size_t,
EvtHandleVal EvtHandleVal_mut: EVT_HANDLE,
XmlVal XmlVal_mut: LPCWSTR,
XmlValArr XmlValArr_mut: *mut LPCWSTR,
}}
STRUCT !{struct EVT_VARIANT {
u: EVT_VARIANT_u,
Count: DWORD,
Type : DWORD,
}}
pub type PEVT_VARIANT = *mut EVT_VARIANT;
ENUM !{enum EVT_LOGIN_CLASS {
EvtRpcLogin = 1 ,
}}
ENUM !{enum EVT_RPC_LOGIN_FLAGS {
EvtRpcLoginAuthDefault = 0 ,
EvtRpcLoginAuthNegotiate,
EvtRpcLoginAuthKerberos,
EvtRpcLoginAuthNTLM,
}}
STRUCT !{struct EVT_RPC_LOGIN {
Server: LPWSTR,
User: LPWSTR,
Domain: LPWSTR,
Password: LPWSTR,
Flags: DWORD,
}}
extern "system" {
pub fn EvtOpenSession(
LoginClass: EVT_LOGIN_CLASS,
Login: PVOID,
Timeout: DWORD,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtClose(
Object: EVT_HANDLE,
) -> BOOL;
pub fn EvtCancel(
Object: EVT_HANDLE,
) -> BOOL;
pub fn EvtGetExtendedStatus(
BufferSize: DWORD,
Buffer: LPWSTR,
BufferUsed: PDWORD,
) -> DWORD;
}
ENUM !{enum EVT_QUERY_FLAGS {
EvtQueryChannelPath = 0 x1,
EvtQueryFilePath = 0 x2,
EvtQueryForwardDirection = 0 x100,
EvtQueryReverseDirection = 0 x200,
EvtQueryTolerateQueryErrors = 0 x1000,
}}
ENUM !{enum EVT_SEEK_FLAGS {
EvtSeekRelativeToFirst = 1 ,
EvtSeekRelativeToLast = 2 ,
EvtSeekRelativeToCurrent = 3 ,
EvtSeekRelativeToBookmark = 4 ,
EvtSeekOriginMask = 7 ,
EvtSeekStrict = 0 x10000,
}}
extern "system" {
pub fn EvtQuery(
Session: EVT_HANDLE,
Path: LPCWSTR,
Query: LPCWSTR,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtNext(
ResultSet: EVT_HANDLE,
EventsSize: DWORD,
Events: PEVT_HANDLE,
Timeout: DWORD,
Flags: DWORD,
Returned: PDWORD,
) -> BOOL;
pub fn EvtSeek(
ResultSet: EVT_HANDLE,
Position: LONGLONG,
Bookmark: EVT_HANDLE,
Timeout: DWORD,
Flags: DWORD,
) -> BOOL;
}
ENUM !{enum EVT_SUBSCRIBE_FLAGS {
EvtSubscribeToFutureEvents = 1 ,
EvtSubscribeStartAtOldestRecord = 2 ,
EvtSubscribeStartAfterBookmark = 3 ,
EvtSubscribeOriginMask = 3 ,
EvtSubscribeTolerateQueryErrors = 0 x1000,
EvtSubscribeStrict = 0 x10000,
}}
ENUM !{enum EVT_SUBSCRIBE_NOTIFY_ACTION {
EvtSubscribeActionError = 0 ,
EvtSubscribeActionDeliver,
}}
FN !{stdcall EVT_SUBSCRIBE_CALLBACK(
Action: EVT_SUBSCRIBE_NOTIFY_ACTION,
UserContext: PVOID,
Event: EVT_HANDLE,
) -> DWORD}
extern "system" {
pub fn EvtSubscribe(
Session: EVT_HANDLE,
SignalEvent: HANDLE,
ChannelPath: LPCWSTR,
Query: LPCWSTR,
Bookmark: EVT_HANDLE,
Context: PVOID,
Callback: EVT_SUBSCRIBE_CALLBACK,
Flags: DWORD,
) -> EVT_HANDLE;
}
ENUM !{enum EVT_SYSTEM_PROPERTY_ID {
EvtSystemProviderName = 0 ,
EvtSystemProviderGuid,
EvtSystemEventID,
EvtSystemQualifiers,
EvtSystemLevel,
EvtSystemTask,
EvtSystemOpcode,
EvtSystemKeywords,
EvtSystemTimeCreated,
EvtSystemEventRecordId,
EvtSystemActivityID,
EvtSystemRelatedActivityID,
EvtSystemProcessID,
EvtSystemThreadID,
EvtSystemChannel,
EvtSystemComputer,
EvtSystemUserID,
EvtSystemVersion,
EvtSystemPropertyIdEND,
}}
ENUM !{enum EVT_RENDER_CONTEXT_FLAGS {
EvtRenderContextValues = 0 ,
EvtRenderContextSystem,
EvtRenderContextUser,
}}
ENUM !{enum EVT_RENDER_FLAGS {
EvtRenderEventValues = 0 ,
EvtRenderEventXml,
EvtRenderBookmark,
}}
extern "system" {
pub fn EvtCreateRenderContext(
ValuePathsCount: DWORD,
ValuePaths: *mut LPCWSTR,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtRender(
Context: EVT_HANDLE,
Fragment: EVT_HANDLE,
Flags: DWORD,
BufferSize: DWORD,
Buffer: PVOID,
BufferUsed: PDWORD,
PropertyCount: PDWORD,
) -> BOOL;
}
ENUM !{enum EVT_FORMAT_MESSAGE_FLAGS {
EvtFormatMessageEvent = 1 ,
EvtFormatMessageLevel,
EvtFormatMessageTask,
EvtFormatMessageOpcode,
EvtFormatMessageKeyword,
EvtFormatMessageChannel,
EvtFormatMessageProvider,
EvtFormatMessageId,
EvtFormatMessageXml,
}}
extern "system" {
pub fn EvtFormatMessage(
PublisherMetadata: EVT_HANDLE,
Event: EVT_HANDLE,
MessageId: DWORD,
ValueCount: DWORD,
Values: PEVT_VARIANT,
Flags: DWORD,
BufferSize: DWORD,
Buffer: LPWSTR,
BufferUsed: PDWORD,
) -> BOOL;
}
ENUM !{enum EVT_OPEN_LOG_FLAGS {
EvtOpenChannelPath = 0 x1,
EvtOpenFilePath = 0 x2,
}}
ENUM !{enum EVT_LOG_PROPERTY_ID {
EvtLogCreationTime = 0 ,
EvtLogLastAccessTime,
EvtLogLastWriteTime,
EvtLogFileSize,
EvtLogAttributes,
EvtLogNumberOfLogRecords,
EvtLogOldestRecordNumber,
EvtLogFull,
}}
extern "system" {
pub fn EvtOpenLog(
Session: EVT_HANDLE,
Path: LPCWSTR,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtGetLogInfo(
Log: EVT_HANDLE,
PropertyId: EVT_LOG_PROPERTY_ID,
PropertyValueBufferSize: DWORD,
PropertyValueBuffer: PEVT_VARIANT,
PropertyValueBufferUsed: PDWORD,
) -> BOOL;
pub fn EvtClearLog(
Session: EVT_HANDLE,
ChannelPath: LPCWSTR,
TargetFilePath: LPCWSTR,
Flags: DWORD,
) -> BOOL;
}
ENUM !{enum EVT_EXPORTLOG_FLAGS {
EvtExportLogChannelPath = 0 x1,
EvtExportLogFilePath = 0 x2,
EvtExportLogTolerateQueryErrors = 0 x1000,
EvtExportLogOverwrite = 0 x2000,
}}
extern "system" {
pub fn EvtExportLog(
Session: EVT_HANDLE,
Path: LPCWSTR,
Query: LPCWSTR,
TargetFilePath: LPCWSTR,
Flags: DWORD,
) -> BOOL;
pub fn EvtArchiveExportedLog(
Session: EVT_HANDLE,
LogFilePath: LPCWSTR,
Locale: LCID,
Flags: DWORD,
) -> BOOL;
}
ENUM !{enum EVT_CHANNEL_CONFIG_PROPERTY_ID {
EvtChannelConfigEnabled = 0 ,
EvtChannelConfigIsolation,
EvtChannelConfigType,
EvtChannelConfigOwningPublisher,
EvtChannelConfigClassicEventlog,
EvtChannelConfigAccess,
EvtChannelLoggingConfigRetention,
EvtChannelLoggingConfigAutoBackup,
EvtChannelLoggingConfigMaxSize,
EvtChannelLoggingConfigLogFilePath,
EvtChannelPublishingConfigLevel,
EvtChannelPublishingConfigKeywords,
EvtChannelPublishingConfigControlGuid,
EvtChannelPublishingConfigBufferSize,
EvtChannelPublishingConfigMinBuffers,
EvtChannelPublishingConfigMaxBuffers,
EvtChannelPublishingConfigLatency,
EvtChannelPublishingConfigClockType,
EvtChannelPublishingConfigSidType,
EvtChannelPublisherList,
EvtChannelPublishingConfigFileMax,
EvtChannelConfigPropertyIdEND,
}}
ENUM !{enum EVT_CHANNEL_TYPE {
EvtChannelTypeAdmin = 0 ,
EvtChannelTypeOperational,
EvtChannelTypeAnalytic,
EvtChannelTypeDebug,
}}
ENUM !{enum EVT_CHANNEL_ISOLATION_TYPE {
EvtChannelIsolationTypeApplication = 0 ,
EvtChannelIsolationTypeSystem,
EvtChannelIsolationTypeCustom,
}}
ENUM !{enum EVT_CHANNEL_CLOCK_TYPE {
EvtChannelClockTypeSystemTime = 0 ,
EvtChannelClockTypeQPC,
}}
ENUM !{enum EVT_CHANNEL_SID_TYPE {
EvtChannelSidTypeNone = 0 ,
EvtChannelSidTypePublishing,
}}
extern "system" {
pub fn EvtOpenChannelEnum(
Session: EVT_HANDLE,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtNextChannelPath(
ChannelEnum: EVT_HANDLE,
ChannelPathBufferSize: DWORD,
ChannelPathBuffer: LPWSTR,
ChannelPathBufferUsed: PDWORD,
) -> BOOL;
pub fn EvtOpenChannelConfig(
Session: EVT_HANDLE,
ChannelPath: LPCWSTR,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtSaveChannelConfig(
ChannelConfig: EVT_HANDLE,
Flags: DWORD,
) -> BOOL;
pub fn EvtSetChannelConfigProperty(
ChannelConfig: EVT_HANDLE,
PropertyId: EVT_CHANNEL_CONFIG_PROPERTY_ID,
Flags: DWORD,
PropertyValue: PEVT_VARIANT,
) -> BOOL;
pub fn EvtGetChannelConfigProperty(
ChannelConfig: EVT_HANDLE,
PropertyId: EVT_CHANNEL_CONFIG_PROPERTY_ID,
Flags: DWORD,
PropertyValueBufferSize: DWORD,
PropertyValueBuffer: PEVT_VARIANT,
PropertyValueBufferUsed: PDWORD,
) -> BOOL;
}
ENUM !{enum EVT_CHANNEL_REFERENCE_FLAGS {
EvtChannelReferenceImported = 0 x1,
}}
ENUM !{enum EVT_PUBLISHER_METADATA_PROPERTY_ID {
EvtPublisherMetadataPublisherGuid = 0 ,
EvtPublisherMetadataResourceFilePath,
EvtPublisherMetadataParameterFilePath,
EvtPublisherMetadataMessageFilePath,
EvtPublisherMetadataHelpLink,
EvtPublisherMetadataPublisherMessageID,
EvtPublisherMetadataChannelReferences,
EvtPublisherMetadataChannelReferencePath,
EvtPublisherMetadataChannelReferenceIndex,
EvtPublisherMetadataChannelReferenceID,
EvtPublisherMetadataChannelReferenceFlags,
EvtPublisherMetadataChannelReferenceMessageID,
EvtPublisherMetadataLevels,
EvtPublisherMetadataLevelName,
EvtPublisherMetadataLevelValue,
EvtPublisherMetadataLevelMessageID,
EvtPublisherMetadataTasks,
EvtPublisherMetadataTaskName,
EvtPublisherMetadataTaskEventGuid,
EvtPublisherMetadataTaskValue,
EvtPublisherMetadataTaskMessageID,
EvtPublisherMetadataOpcodes,
EvtPublisherMetadataOpcodeName,
EvtPublisherMetadataOpcodeValue,
EvtPublisherMetadataOpcodeMessageID,
EvtPublisherMetadataKeywords,
EvtPublisherMetadataKeywordName,
EvtPublisherMetadataKeywordValue,
EvtPublisherMetadataKeywordMessageID,
EvtPublisherMetadataPropertyIdEND,
}}
extern "system" {
pub fn EvtOpenPublisherEnum(
Session: EVT_HANDLE,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtNextPublisherId(
PublisherEnum: EVT_HANDLE,
PublisherIdBufferSize: DWORD,
PublisherIdBuffer: LPWSTR,
PublisherIdBufferUsed: PDWORD,
) -> BOOL;
pub fn EvtOpenPublisherMetadata(
Session: EVT_HANDLE,
PublisherId: LPCWSTR,
LogFilePath: LPCWSTR,
Locale: LCID,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtGetPublisherMetadataProperty(
PublisherMetadata: EVT_HANDLE,
PropertyId: EVT_PUBLISHER_METADATA_PROPERTY_ID,
Flags: DWORD,
PublisherMetadataPropertyBufferSize: DWORD,
PublisherMetadataPropertyBuffer: PEVT_VARIANT,
PublisherMetadataPropertyBufferUsed: PDWORD,
) -> BOOL;
}
ENUM !{enum EVT_EVENT_METADATA_PROPERTY_ID {
EventMetadataEventID,
EventMetadataEventVersion,
EventMetadataEventChannel,
EventMetadataEventLevel,
EventMetadataEventOpcode,
EventMetadataEventTask,
EventMetadataEventKeyword,
EventMetadataEventMessageID,
EventMetadataEventTemplate,
EvtEventMetadataPropertyIdEND,
}}
extern "system" {
pub fn EvtOpenEventMetadataEnum(
PublisherMetadata: EVT_HANDLE,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtNextEventMetadata(
EventMetadataEnum: EVT_HANDLE,
Flags: DWORD,
) -> EVT_HANDLE;
pub fn EvtGetEventMetadataProperty(
EventMetadata: EVT_HANDLE,
PropertyId: EVT_EVENT_METADATA_PROPERTY_ID,
Flags: DWORD,
EventMetadataPropertyBufferSize: DWORD,
EventMetadataPropertyBuffer: PEVT_VARIANT,
EventMetadataPropertyBufferUsed: PDWORD,
) -> BOOL;
}
pub type EVT_OBJECT_ARRAY_PROPERTY_HANDLE = HANDLE;
extern "system" {
pub fn EvtGetObjectArraySize(
ObjectArray: EVT_OBJECT_ARRAY_PROPERTY_HANDLE,
ObjectArraySize: PDWORD,
) -> BOOL;
pub fn EvtGetObjectArrayProperty(
ObjectArray: EVT_OBJECT_ARRAY_PROPERTY_HANDLE,
PropertyId: DWORD,
ArrayIndex: DWORD,
Flags: DWORD,
PropertyValueBufferSize: DWORD,
PropertyValueBuffer: PEVT_VARIANT,
PropertyValueBufferUsed: PDWORD,
) -> BOOL;
}
ENUM !{enum EVT_QUERY_PROPERTY_ID {
EvtQueryNames,
EvtQueryStatuses,
EvtQueryPropertyIdEND,
}}
ENUM !{enum EVT_EVENT_PROPERTY_ID {
EvtEventQueryIDs = 0 ,
EvtEventPath,
EvtEventPropertyIdEND,
}}
extern "system" {
pub fn EvtGetQueryInfo(
QueryOrSubscription: EVT_HANDLE,
PropertyId: EVT_QUERY_PROPERTY_ID,
PropertyValueBufferSize: DWORD,
PropertyValueBuffer: PEVT_VARIANT,
PropertyValueBufferUsed: PDWORD,
) -> BOOL;
pub fn EvtCreateBookmark(
BookmarkXml: LPCWSTR,
) -> EVT_HANDLE;
pub fn EvtUpdateBookmark(
Bookmark: EVT_HANDLE,
Event: EVT_HANDLE,
) -> BOOL;
pub fn EvtGetEventInfo(
Event: EVT_HANDLE,
PropertyId: EVT_EVENT_PROPERTY_ID,
PropertyValueBufferSize: DWORD,
PropertyValueBuffer: PEVT_VARIANT,
PropertyValueBufferUsed: PDWORD,
) -> BOOL;
}
pub const EVT_READ_ACCESS: DWORD = 0 x1;
pub const EVT_WRITE_ACCESS: DWORD = 0 x2;
pub const EVT_CLEAR_ACCESS: DWORD = 0 x4;
pub const EVT_ALL_ACCESS: DWORD = 0 x7;
Messung V0.5 in Prozent C=98 H=98 G=97
¤ Dauer der Verarbeitung: 0.11 Sekunden
(vorverarbeitet am 2026-06-18)
¤
*© Formatika GbR, Deutschland