Quelle  winevt.rs   Sprache: unbekannt

// Licensed under the Apache License, Version 2.0
// <LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your option.
// All files in the project carrying such notice may not be copied, modified, or distributed
// except according to those terms.
//! Windows Events API
use ctypes::{c_double, c_float};
use shared::basetsd::{INT16, INT32, INT64, INT8, UINT16, UINT32, UINT64, UINT8};
use shared::guiddef::GUID;
use shared::minwindef::{BOOL, DWORD, FILETIME, PBYTE, PDWORD};
use um::minwinbase::SYSTEMTIME;
use um::winnt::{HANDLE, LCID, LONGLONG, LPCSTR, LPCWSTR, LPSTR, LPWSTR, PSID, PVOID, ULONGLONG};
use vc::vcruntime::size_t;
pub type EVT_HANDLE = HANDLE;
pub type PEVT_HANDLE = *mut HANDLE;
ENUM!{enum EVT_VARIANT_TYPE {
    EvtVarTypeNull = 0,
    EvtVarTypeString = 1,
    EvtVarTypeAnsiString = 2,
    EvtVarTypeSByte = 3,
    EvtVarTypeByte = 4,
    EvtVarTypeInt16 = 5,
    EvtVarTypeUInt16 = 6,
    EvtVarTypeInt32 = 7,
    EvtVarTypeUInt32 = 8,
    EvtVarTypeInt64 = 9,
    EvtVarTypeUInt64 = 10,
    EvtVarTypeSingle = 11,
    EvtVarTypeDouble = 12,
    EvtVarTypeBoolean = 13,
    EvtVarTypeBinary = 14,
    EvtVarTypeGuid = 15,
    EvtVarTypeSizeT = 16,
    EvtVarTypeFileTime = 17,
    EvtVarTypeSysTime = 18,
    EvtVarTypeSid = 19,
    EvtVarTypeHexInt32 = 20,
    EvtVarTypeHexInt64 = 21,
    EvtVarTypeEvtHandle = 32,
    EvtVarTypeEvtXml = 35,
}}
pub const EVT_VARIANT_TYPE_MASK: DWORD = 0x7f;
pub const EVT_VARIANT_TYPE_ARRAY: DWORD = 128;
UNION!{union EVT_VARIANT_u {
    [u64; 1],
    BooleanVal BooleanVal_mut: BOOL,
    SByteVal SByteVal_mut: INT8,
    Int16Val Int16Val_mut: INT16,
    Int32Val Int32Val_mut: INT32,
    Int64Val Int64Val_mut: INT64,
    ByteVal ByteVal_mut: UINT8,
    UInt16Val UInt16Val_mut: UINT16,
    UInt32Val UInt32Val_mut: UINT32,
    UInt64Val UInt64Val_mut: UINT64,
    SingleVal SingleVal_mut: c_float,
    DoubleVal DoubleVal_mut: c_double,
    FileTimeVal FileTimeVal_mut: ULONGLONG,
    SysTimeVal SysTimeVal_mut: *mut SYSTEMTIME,
    GuidVal GuidVal_mut: *mut GUID,
    StringVal StringVal_mut: LPCWSTR,
    AnsiStringVal AnsiStringVal_mut: LPCSTR,
    BinaryVal BinaryVal_mut: PBYTE,
    SidVal SidVal_mut: PSID,
    SizeTVal SizeTVal_mut: size_t,
    BooleanArr BooleanArr_mut: *mut BOOL,
    SByteArr SByteArr_mut: *mut INT8,
    Int16Arr Int16Arr_mut: *mut INT16,
    Int32Arr Int32Arr_mut: *mut INT32,
    Int64Arr Int64Arr_mut: *mut INT64,
    ByteArr ByteArr_mut: *mut UINT8,
    UInt16Arr UInt16Arr_mut: *mut UINT16,
    UInt32Arr UInt32Arr_mut: *mut UINT32,
    UInt64Arr UInt64Arr_mut: *mut UINT64,
    SingleArr SingleArr_mut: *mut c_float,
    DoubleArr DoubleArr_mut: *mut c_double,
    FileTimeArr FileTimeArr_mut: *mut FILETIME,
    SysTimeArr SysTimeArr_mut: *mut SYSTEMTIME,
    GuidArr GuidArr_mut: *mut GUID,
    StringArr StringArr_mut: *mut LPWSTR,
    AnsiStringArr AnsiStringArr_mut: *mut LPSTR,
    SidArr SidArr_mut: *mut PSID,
    SizeTArr SizeTArr_mut: *mut size_t,
    EvtHandleVal EvtHandleVal_mut: EVT_HANDLE,
    XmlVal XmlVal_mut: LPCWSTR,
    XmlValArr XmlValArr_mut: *mut LPCWSTR,
}}
STRUCT!{struct EVT_VARIANT {
    u: EVT_VARIANT_u,
    Count: DWORD,
    Type: DWORD,
}}
pub type PEVT_VARIANT = *mut EVT_VARIANT;
ENUM!{enum EVT_LOGIN_CLASS {
    EvtRpcLogin = 1,
}}
ENUM!{enum EVT_RPC_LOGIN_FLAGS {
    EvtRpcLoginAuthDefault = 0,
    EvtRpcLoginAuthNegotiate,
    EvtRpcLoginAuthKerberos,
    EvtRpcLoginAuthNTLM,
}}
STRUCT!{struct EVT_RPC_LOGIN {
    Server: LPWSTR,
    User: LPWSTR,
    Domain: LPWSTR,
    Password: LPWSTR,
    Flags: DWORD,
}}
extern "system" {
    pub fn EvtOpenSession(
        LoginClass: EVT_LOGIN_CLASS,
        Login: PVOID,
        Timeout: DWORD,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtClose(
        Object: EVT_HANDLE,
    ) -> BOOL;
    pub fn EvtCancel(
        Object: EVT_HANDLE,
    ) -> BOOL;
    pub fn EvtGetExtendedStatus(
        BufferSize: DWORD,
        Buffer: LPWSTR,
        BufferUsed: PDWORD,
    ) -> DWORD;
}
ENUM!{enum EVT_QUERY_FLAGS {
    EvtQueryChannelPath = 0x1,
    EvtQueryFilePath = 0x2,
    EvtQueryForwardDirection = 0x100,
    EvtQueryReverseDirection = 0x200,
    EvtQueryTolerateQueryErrors = 0x1000,
}}
ENUM!{enum EVT_SEEK_FLAGS {
    EvtSeekRelativeToFirst = 1,
    EvtSeekRelativeToLast = 2,
    EvtSeekRelativeToCurrent = 3,
    EvtSeekRelativeToBookmark = 4,
    EvtSeekOriginMask = 7,
    EvtSeekStrict = 0x10000,
}}
extern "system" {
    pub fn EvtQuery(
        Session: EVT_HANDLE,
        Path: LPCWSTR,
        Query: LPCWSTR,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtNext(
        ResultSet: EVT_HANDLE,
        EventsSize: DWORD,
        Events: PEVT_HANDLE,
        Timeout: DWORD,
        Flags: DWORD,
        Returned: PDWORD,
    ) -> BOOL;
    pub fn EvtSeek(
        ResultSet: EVT_HANDLE,
        Position: LONGLONG,
        Bookmark: EVT_HANDLE,
        Timeout: DWORD,
        Flags: DWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_SUBSCRIBE_FLAGS {
    EvtSubscribeToFutureEvents = 1,
    EvtSubscribeStartAtOldestRecord = 2,
    EvtSubscribeStartAfterBookmark = 3,
    EvtSubscribeOriginMask = 3,
    EvtSubscribeTolerateQueryErrors = 0x1000,
    EvtSubscribeStrict = 0x10000,
}}
ENUM!{enum EVT_SUBSCRIBE_NOTIFY_ACTION {
    EvtSubscribeActionError = 0,
    EvtSubscribeActionDeliver,
}}
FN!{stdcall EVT_SUBSCRIBE_CALLBACK(
    Action: EVT_SUBSCRIBE_NOTIFY_ACTION,
    UserContext: PVOID,
    Event: EVT_HANDLE,
) -> DWORD}
extern "system" {
    pub fn EvtSubscribe(
        Session: EVT_HANDLE,
        SignalEvent: HANDLE,
        ChannelPath: LPCWSTR,
        Query: LPCWSTR,
        Bookmark: EVT_HANDLE,
        Context: PVOID,
        Callback: EVT_SUBSCRIBE_CALLBACK,
        Flags: DWORD,
    ) -> EVT_HANDLE;
}
ENUM!{enum EVT_SYSTEM_PROPERTY_ID {
    EvtSystemProviderName = 0,
    EvtSystemProviderGuid,
    EvtSystemEventID,
    EvtSystemQualifiers,
    EvtSystemLevel,
    EvtSystemTask,
    EvtSystemOpcode,
    EvtSystemKeywords,
    EvtSystemTimeCreated,
    EvtSystemEventRecordId,
    EvtSystemActivityID,
    EvtSystemRelatedActivityID,
    EvtSystemProcessID,
    EvtSystemThreadID,
    EvtSystemChannel,
    EvtSystemComputer,
    EvtSystemUserID,
    EvtSystemVersion,
    EvtSystemPropertyIdEND,
}}
ENUM!{enum EVT_RENDER_CONTEXT_FLAGS {
    EvtRenderContextValues = 0,
    EvtRenderContextSystem,
    EvtRenderContextUser,
}}
ENUM!{enum EVT_RENDER_FLAGS {
    EvtRenderEventValues = 0,
    EvtRenderEventXml,
    EvtRenderBookmark,
}}
extern "system" {
    pub fn EvtCreateRenderContext(
        ValuePathsCount: DWORD,
        ValuePaths: *mut LPCWSTR,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtRender(
        Context: EVT_HANDLE,
        Fragment: EVT_HANDLE,
        Flags: DWORD,
        BufferSize: DWORD,
        Buffer: PVOID,
        BufferUsed: PDWORD,
        PropertyCount: PDWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_FORMAT_MESSAGE_FLAGS {
    EvtFormatMessageEvent = 1,
    EvtFormatMessageLevel,
    EvtFormatMessageTask,
    EvtFormatMessageOpcode,
    EvtFormatMessageKeyword,
    EvtFormatMessageChannel,
    EvtFormatMessageProvider,
    EvtFormatMessageId,
    EvtFormatMessageXml,
}}
extern "system" {
    pub fn EvtFormatMessage(
        PublisherMetadata: EVT_HANDLE,
        Event: EVT_HANDLE,
        MessageId: DWORD,
        ValueCount: DWORD,
        Values: PEVT_VARIANT,
        Flags: DWORD,
        BufferSize: DWORD,
        Buffer: LPWSTR,
        BufferUsed: PDWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_OPEN_LOG_FLAGS {
    EvtOpenChannelPath = 0x1,
    EvtOpenFilePath = 0x2,
}}
ENUM!{enum EVT_LOG_PROPERTY_ID {
    EvtLogCreationTime = 0,
    EvtLogLastAccessTime,
    EvtLogLastWriteTime,
    EvtLogFileSize,
    EvtLogAttributes,
    EvtLogNumberOfLogRecords,
    EvtLogOldestRecordNumber,
    EvtLogFull,
}}
extern "system" {
    pub fn EvtOpenLog(
        Session: EVT_HANDLE,
        Path: LPCWSTR,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtGetLogInfo(
        Log: EVT_HANDLE,
        PropertyId: EVT_LOG_PROPERTY_ID,
        PropertyValueBufferSize: DWORD,
        PropertyValueBuffer: PEVT_VARIANT,
        PropertyValueBufferUsed: PDWORD,
    ) -> BOOL;
    pub fn EvtClearLog(
        Session: EVT_HANDLE,
        ChannelPath: LPCWSTR,
        TargetFilePath: LPCWSTR,
        Flags: DWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_EXPORTLOG_FLAGS {
    EvtExportLogChannelPath = 0x1,
    EvtExportLogFilePath = 0x2,
    EvtExportLogTolerateQueryErrors = 0x1000,
    EvtExportLogOverwrite = 0x2000,
}}
extern "system" {
    pub fn EvtExportLog(
        Session: EVT_HANDLE,
        Path: LPCWSTR,
        Query: LPCWSTR,
        TargetFilePath: LPCWSTR,
        Flags: DWORD,
    ) -> BOOL;
    pub fn EvtArchiveExportedLog(
        Session: EVT_HANDLE,
        LogFilePath: LPCWSTR,
        Locale: LCID,
        Flags: DWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_CHANNEL_CONFIG_PROPERTY_ID {
    EvtChannelConfigEnabled = 0,
    EvtChannelConfigIsolation,
    EvtChannelConfigType,
    EvtChannelConfigOwningPublisher,
    EvtChannelConfigClassicEventlog,
    EvtChannelConfigAccess,
    EvtChannelLoggingConfigRetention,
    EvtChannelLoggingConfigAutoBackup,
    EvtChannelLoggingConfigMaxSize,
    EvtChannelLoggingConfigLogFilePath,
    EvtChannelPublishingConfigLevel,
    EvtChannelPublishingConfigKeywords,
    EvtChannelPublishingConfigControlGuid,
    EvtChannelPublishingConfigBufferSize,
    EvtChannelPublishingConfigMinBuffers,
    EvtChannelPublishingConfigMaxBuffers,
    EvtChannelPublishingConfigLatency,
    EvtChannelPublishingConfigClockType,
    EvtChannelPublishingConfigSidType,
    EvtChannelPublisherList,
    EvtChannelPublishingConfigFileMax,
    EvtChannelConfigPropertyIdEND,
}}
ENUM!{enum EVT_CHANNEL_TYPE {
    EvtChannelTypeAdmin = 0,
    EvtChannelTypeOperational,
    EvtChannelTypeAnalytic,
    EvtChannelTypeDebug,
}}
ENUM!{enum EVT_CHANNEL_ISOLATION_TYPE {
    EvtChannelIsolationTypeApplication = 0,
    EvtChannelIsolationTypeSystem,
    EvtChannelIsolationTypeCustom,
}}
ENUM!{enum EVT_CHANNEL_CLOCK_TYPE {
    EvtChannelClockTypeSystemTime = 0,
    EvtChannelClockTypeQPC,
}}
ENUM!{enum EVT_CHANNEL_SID_TYPE {
    EvtChannelSidTypeNone = 0,
    EvtChannelSidTypePublishing,
}}
extern "system" {
    pub fn EvtOpenChannelEnum(
        Session: EVT_HANDLE,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtNextChannelPath(
        ChannelEnum: EVT_HANDLE,
        ChannelPathBufferSize: DWORD,
        ChannelPathBuffer: LPWSTR,
        ChannelPathBufferUsed: PDWORD,
    ) -> BOOL;
    pub fn EvtOpenChannelConfig(
        Session: EVT_HANDLE,
        ChannelPath: LPCWSTR,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtSaveChannelConfig(
        ChannelConfig: EVT_HANDLE,
        Flags: DWORD,
    ) -> BOOL;
    pub fn EvtSetChannelConfigProperty(
        ChannelConfig: EVT_HANDLE,
        PropertyId: EVT_CHANNEL_CONFIG_PROPERTY_ID,
        Flags: DWORD,
        PropertyValue: PEVT_VARIANT,
    ) -> BOOL;
    pub fn EvtGetChannelConfigProperty(
        ChannelConfig: EVT_HANDLE,
        PropertyId: EVT_CHANNEL_CONFIG_PROPERTY_ID,
        Flags: DWORD,
        PropertyValueBufferSize: DWORD,
        PropertyValueBuffer: PEVT_VARIANT,
        PropertyValueBufferUsed: PDWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_CHANNEL_REFERENCE_FLAGS {
    EvtChannelReferenceImported = 0x1,
}}
ENUM!{enum EVT_PUBLISHER_METADATA_PROPERTY_ID {
    EvtPublisherMetadataPublisherGuid = 0,
    EvtPublisherMetadataResourceFilePath,
    EvtPublisherMetadataParameterFilePath,
    EvtPublisherMetadataMessageFilePath,
    EvtPublisherMetadataHelpLink,
    EvtPublisherMetadataPublisherMessageID,
    EvtPublisherMetadataChannelReferences,
    EvtPublisherMetadataChannelReferencePath,
    EvtPublisherMetadataChannelReferenceIndex,
    EvtPublisherMetadataChannelReferenceID,
    EvtPublisherMetadataChannelReferenceFlags,
    EvtPublisherMetadataChannelReferenceMessageID,
    EvtPublisherMetadataLevels,
    EvtPublisherMetadataLevelName,
    EvtPublisherMetadataLevelValue,
    EvtPublisherMetadataLevelMessageID,
    EvtPublisherMetadataTasks,
    EvtPublisherMetadataTaskName,
    EvtPublisherMetadataTaskEventGuid,
    EvtPublisherMetadataTaskValue,
    EvtPublisherMetadataTaskMessageID,
    EvtPublisherMetadataOpcodes,
    EvtPublisherMetadataOpcodeName,
    EvtPublisherMetadataOpcodeValue,
    EvtPublisherMetadataOpcodeMessageID,
    EvtPublisherMetadataKeywords,
    EvtPublisherMetadataKeywordName,
    EvtPublisherMetadataKeywordValue,
    EvtPublisherMetadataKeywordMessageID,
    EvtPublisherMetadataPropertyIdEND,
}}
extern "system" {
    pub fn EvtOpenPublisherEnum(
        Session: EVT_HANDLE,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtNextPublisherId(
        PublisherEnum: EVT_HANDLE,
        PublisherIdBufferSize: DWORD,
        PublisherIdBuffer: LPWSTR,
        PublisherIdBufferUsed: PDWORD,
    ) -> BOOL;
    pub fn EvtOpenPublisherMetadata(
        Session: EVT_HANDLE,
        PublisherId: LPCWSTR,
        LogFilePath: LPCWSTR,
        Locale: LCID,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtGetPublisherMetadataProperty(
        PublisherMetadata: EVT_HANDLE,
        PropertyId: EVT_PUBLISHER_METADATA_PROPERTY_ID,
        Flags: DWORD,
        PublisherMetadataPropertyBufferSize: DWORD,
        PublisherMetadataPropertyBuffer: PEVT_VARIANT,
        PublisherMetadataPropertyBufferUsed: PDWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_EVENT_METADATA_PROPERTY_ID {
    EventMetadataEventID,
    EventMetadataEventVersion,
    EventMetadataEventChannel,
    EventMetadataEventLevel,
    EventMetadataEventOpcode,
    EventMetadataEventTask,
    EventMetadataEventKeyword,
    EventMetadataEventMessageID,
    EventMetadataEventTemplate,
    EvtEventMetadataPropertyIdEND,
}}
extern "system" {
    pub fn EvtOpenEventMetadataEnum(
        PublisherMetadata: EVT_HANDLE,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtNextEventMetadata(
        EventMetadataEnum: EVT_HANDLE,
        Flags: DWORD,
    ) -> EVT_HANDLE;
    pub fn EvtGetEventMetadataProperty(
        EventMetadata: EVT_HANDLE,
        PropertyId: EVT_EVENT_METADATA_PROPERTY_ID,
        Flags: DWORD,
        EventMetadataPropertyBufferSize: DWORD,
        EventMetadataPropertyBuffer: PEVT_VARIANT,
        EventMetadataPropertyBufferUsed: PDWORD,
    ) -> BOOL;
}
pub type EVT_OBJECT_ARRAY_PROPERTY_HANDLE = HANDLE;
extern "system" {
    pub fn EvtGetObjectArraySize(
        ObjectArray: EVT_OBJECT_ARRAY_PROPERTY_HANDLE,
        ObjectArraySize: PDWORD,
    ) -> BOOL;
    pub fn EvtGetObjectArrayProperty(
        ObjectArray: EVT_OBJECT_ARRAY_PROPERTY_HANDLE,
        PropertyId: DWORD,
        ArrayIndex: DWORD,
        Flags: DWORD,
        PropertyValueBufferSize: DWORD,
        PropertyValueBuffer: PEVT_VARIANT,
        PropertyValueBufferUsed: PDWORD,
    ) -> BOOL;
}
ENUM!{enum EVT_QUERY_PROPERTY_ID {
    EvtQueryNames,
    EvtQueryStatuses,
    EvtQueryPropertyIdEND,
}}
ENUM!{enum EVT_EVENT_PROPERTY_ID {
    EvtEventQueryIDs = 0,
    EvtEventPath,
    EvtEventPropertyIdEND,
}}
extern "system" {
    pub fn EvtGetQueryInfo(
        QueryOrSubscription: EVT_HANDLE,
        PropertyId: EVT_QUERY_PROPERTY_ID,
        PropertyValueBufferSize: DWORD,
        PropertyValueBuffer: PEVT_VARIANT,
        PropertyValueBufferUsed: PDWORD,
    ) -> BOOL;
    pub fn EvtCreateBookmark(
        BookmarkXml: LPCWSTR,
    ) -> EVT_HANDLE;
    pub fn EvtUpdateBookmark(
        Bookmark: EVT_HANDLE,
        Event: EVT_HANDLE,
    ) -> BOOL;
    pub fn EvtGetEventInfo(
        Event: EVT_HANDLE,
        PropertyId: EVT_EVENT_PROPERTY_ID,
        PropertyValueBufferSize: DWORD,
        PropertyValueBuffer: PEVT_VARIANT,
        PropertyValueBufferUsed: PDWORD,
    ) -> BOOL;
}
pub const EVT_READ_ACCESS: DWORD = 0x1;
pub const EVT_WRITE_ACCESS: DWORD = 0x2;
pub const EVT_CLEAR_ACCESS: DWORD = 0x4;
pub const EVT_ALL_ACCESS: DWORD = 0x7;