[ros-diffs] [gvg] 17940: Saveliy Tretiakov <[e-mail]>:

Saveliy Tretiakov <saveliyt(a)mail.ru>ru>:
EventLog changes
- Implement basic file operations (WindowsNT compatible file format)
- Write events from lpc port to System Log
  (to read these events, open \ReactOS\system32\config\SysEvent.evt in
Windows
  EventViewer)  
- RPC server (stubs)
Added: trunk/reactos/include/idl/eventlogrpc.idl
Modified: trunk/reactos/include/idl/idl.xml
Modified: trunk/reactos/services/eventlog/eventlog.c
Modified: trunk/reactos/services/eventlog/eventlog.h
Modified: trunk/reactos/services/eventlog/eventlog.xml
Added: trunk/reactos/services/eventlog/file.c
Modified: trunk/reactos/services/eventlog/logport.c
Added: trunk/reactos/services/eventlog/rpc.c
  _____  

Added: trunk/reactos/include/idl/eventlogrpc.idl
--- trunk/reactos/include/idl/eventlogrpc.idl	2005-09-20 07:37:45 UTC
(rev 17939)
+++ trunk/reactos/include/idl/eventlogrpc.idl	2005-09-20 07:58:28 UTC
(rev 17940)
@@ -0,0 +1,237 @@

+/* 
+ *  Copyright (c) 2005 Saveliy Tretiakov (saveliyt(a)mail.ru)  
+ *
+ *  This program is free software; you can redistribute it and/or
modify
+ *  it under the terms of the GNU General Public License as published
by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+ 
+[
+	uuid(82273FDC-E32A-18C3-3F78-827929DC23EA),
+	version(0.0),
+	pointer_default(unique),
+	explicit_handle
+]
+
+interface eventlog
+{
+	/*
+	cpp_quote("#if 0")
+	typedef [handle, unique] wchar_t *LPWSTR;
+	typedef [handle, unique] char *LPSTR;
+	cpp_quote("#endif")
+	typedef [context_handle] void *LOGHANDLE;
+	typedef LOGHANDLE *PLOGHANDLE;
+	typedef unsigned int NTSTATUS;
+
+	typedef struct _UNICODE_STRING {
+		unsigned short Length;
+		unsigned short MaximumLength;
+		[size_is(MaximumLength)] wchar_t *Buffer;
+	} UNICODE_STRING, *PUNICODE_STRING;
+
+	typedef struct _ANSI_STRING {
+		unsigned short Length;
+		unsigned short MaximumLength;
+		[size_is(MaximumLength)] char *Buffer;
+	} ANSI_STRING, *PANSI_STRING;
+	*/
+	
+	#define LPWSTR wchar_t*
+	#define LPSTR char*
+	#define LOGHANDLE unsigned char*
+	#define PLOGHANDLE int* 
+	#define NTSTATUS long
+	
+	/* Function 0 */
+	NTSTATUS EventLogClearW(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] wchar_t *BackupName);
+
+	/* Function 1 */
+	NTSTATUS EventLogBackupW(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] wchar_t *FileName);
+	
+	/* Function 2 */
+	NTSTATUS EventLogClose(
+		handle_t BindingHandle,
+		[in,out] PLOGHANDLE Handle);   
+
+	/* Function 3 */
+	NTSTATUS EventLogUnregSrc(
+		handle_t BindingHandle,
+		[in,out] PLOGHANDLE Handle);
+
+	/* Function 4 */
+	NTSTATUS EventLogRecordsNumber(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[out] unsigned long *RecordsNumber);
+
+	/* Function 5 */
+	NTSTATUS EventLogGetOldestRec(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[out] unsigned long *OldestRecNumber);
+
+	/* FIXME */
+	NTSTATUS Unknown6(handle_t BindingHandle);
+
+	/* Function 7 */
+	NTSTATUS EventLogOpenW(
+		handle_t BindingHandle,
+		[in] LPWSTR ServerName,
+		[in] wchar_t *FileName, 
+		[in] wchar_t *NullStr, 
+		[in] unsigned long MajorVer,
+		[in] unsigned long MinorVer,
+		[out] PLOGHANDLE Handle );
+		
+	/* Function 8 */
+	NTSTATUS EventLogRegSrcW(
+		handle_t BindingHandle,
+		[in] LPWSTR ServerName,
+		[in] wchar_t *LogName, 
+		[in] wchar_t *NullStr, 
+		[in] unsigned long MajorVer,
+		[in] unsigned long MinorVer,
+		[out] PLOGHANDLE Handle);
+		
+	/* Function 9 */
+	NTSTATUS EventLogOpenBackupW(
+		handle_t BindingHandle,
+		[in] LPWSTR ServerName,
+		[in] wchar_t *BackupName, 
+		[in] unsigned long MajorVer,
+		[in] unsigned long MinorVer,
+		[out] PLOGHANDLE Handle);
+
+	/* Function 10 */
+	NTSTATUS EventLogReadW(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] unsigned long Flags,
+		[in] unsigned long Offset,
+		[in] unsigned long BufSize,
+		[out,size_is(BufSize)] unsigned char *Buffer,
+		[out] unsigned long *BytesRead,
+		[out] unsigned long *BytesNeeded);
+
+	/* Function 11 */
+	NTSTATUS EventLogReportEventW(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] unsigned long Time,
+		[in] unsigned short Type,
+		[in] unsigned short Category,
+		[in] unsigned long ID,
+		[in] unsigned short NumStrings,
+		[in] unsigned long DataSize,
+		[in] wchar_t *ComputerName,
+		[in] unsigned char *SID,
+		[in] wchar_t *Strings,
+		[in,size_is(DataSize)] unsigned char *Data,
+		[in] unsigned short Flags);
+		
+	/* Function 12 */
+	NTSTATUS EventLogClearA(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] char *BackupName);
+
+	/* Function 13 */
+	NTSTATUS EventLogBackupA(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] char *BackupName);
+
+	/* Function 14 */
+	NTSTATUS EventLogOpenA(
+		handle_t BindingHandle,
+		[in] LPSTR ServerName,
+		[in] char *LogName, 
+		[in] char *NullStr, 
+		[in] unsigned long MajorVer,
+		[in] unsigned long MinorVer,
+		[out] PLOGHANDLE Handle);
+
+	/* Function 15 */
+	NTSTATUS EventLogRegSrcA(
+		handle_t BindingHandle,
+		[in] LPSTR ServerName,
+		[in] char *LogName, 
+		[in] char *NullStr,
+		[in] unsigned long MajorVer,
+		[in] unsigned long MinorVer,
+		[out] PLOGHANDLE Handle);
+
+
+	/* Function 16 */
+	NTSTATUS EventLogOpenBackupA(
+		handle_t BindingHandle,
+		[in] LPSTR ServerName,
+		[in] char *BackupName, 
+		[in] unsigned long MajorVer,
+		[in] unsigned long MinorVer,
+		[out] PLOGHANDLE Handle);
+
+	/* Function 17 */
+	NTSTATUS EventLogReadA(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] unsigned long Flags,
+		[in] unsigned long Offset,
+		[in] unsigned long BufSize,
+		[out,size_is(BufSize)] unsigned char *Buffer,
+		[out] unsigned long *BytesRead,
+		[out] unsigned long *BytesNeeded);
+
+	/* Function 18 */
+	NTSTATUS EventLogReportEventA(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] unsigned long Time,
+		[in] unsigned short Type,
+		[in] unsigned short Category,
+		[in] unsigned long ID,
+		[in] unsigned short NumStrings,
+		[in] unsigned long DataSize,
+		[in] char *ComputerName,
+		[in] unsigned char *SID,
+		[in] char* Strings,
+		[in,size_is(DataSize)] unsigned char *Data,
+		[in] unsigned short Flags);
+		
+	/* FIXME */
+	NTSTATUS Unknown19(handle_t BindingHandle);
+	
+	/* FIXME */
+	NTSTATUS Unknown20(handle_t BindingHandle);
+
+	/* FIXME */
+	NTSTATUS Unknown21(handle_t BindingHandle);
+
+	/* Function 22 */
+	NTSTATUS EventLogGetInfo(
+		handle_t BindingHandle,
+		[in] LOGHANDLE Handle,
+		[in] unsigned long InfoLevel,
+		[out,size_is(BufSize)] unsigned char *Buffer,
+		[in] unsigned long BufSize,
+		[out] unsigned long *BytesNeeded);
+
+}
+
  _____  

Modified: trunk/reactos/include/idl/idl.xml
--- trunk/reactos/include/idl/idl.xml	2005-09-20 07:37:45 UTC (rev
17939)
+++ trunk/reactos/include/idl/idl.xml	2005-09-20 07:58:28 UTC (rev
17940)
@@ -23,4 +23,16 @@

 	<define name="_X86_" />
 	<file switches="-o">svcctl.idl</file>
 </module>
+<module name="eventlog_server" type="rpcserver">
+	<include base="ReactOS">.</include>
+	<include base="ReactOS">w32api/include</include>
+	<define name="_X86_" />
+	<file switches="-o">eventlogrpc.idl</file>
+</module>
+<module name="eventlog_client" type="rpcclient">
+	<include base="ReactOS">.</include>
+	<include base="ReactOS">w32api/include</include>
+	<define name="_X86_" />
+	<file switches="-o">eventlogrpc.idl</file>
+</module>
 </group>
  _____  

Modified: trunk/reactos/services/eventlog/eventlog.c
--- trunk/reactos/services/eventlog/eventlog.c	2005-09-20 07:37:45 UTC
(rev 17939)
+++ trunk/reactos/services/eventlog/eventlog.c	2005-09-20 07:58:28 UTC
(rev 17940)
@@ -1,83 +1,211 @@

 /*
- *  ReactOS kernel
- *  Copyright (C) 2002, 2005 ReactOS Team
- *
- *  This program is free software; you can redistribute it and/or
modify
- *  it under the terms of the GNU General Public License as published
by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-/*
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
  * FILE:             services/eventlog/eventlog.c
  * PURPOSE:          Event logging service
- * PROGRAMMER:       Eric Kohl
+ * PROGRAMMERS:      Saveliy Tretiakov (saveliyt(a)mail.ru)
+ *                   Eric Kohl  
  */
 
-/* INCLUDES
*****************************************************************/
 
-#include <windows.h>
-#define NTOS_MODE_USER
-#include <ndk/ntndk.h>
-
 #include "eventlog.h"
 
-#define NDEBUG
-#include <debug.h>
+VOID CALLBACK ServiceMain(DWORD argc, LPTSTR *argv);
 
-
-VOID CALLBACK
-ServiceMain(DWORD argc, LPTSTR *argv);
-
-
-/* GLOBALS
******************************************************************/
-
 SERVICE_TABLE_ENTRY ServiceTable[2] =
 {
   {L"EventLog", (LPSERVICE_MAIN_FUNCTION)ServiceMain},
   {NULL, NULL}
 };
 
+HANDLE MyHeap = NULL;
+PLOGFILE SystemLog = NULL;
 
-/* FUNCTIONS
*****************************************************************/
+VOID CALLBACK ServiceMain(DWORD argc, LPTSTR *argv)
+{
+    HANDLE hThread;
 
+    hThread = CreateThread(NULL,
+                           0,
+                           (LPTHREAD_START_ROUTINE)
+                            PortThreadRoutine,
+                           NULL,
+                           0,
+                           NULL);
+    
+    if(!hThread) DPRINT("Can't create PortThread\n");
+    else CloseHandle(hThread);
+    
+    hThread = CreateThread(NULL,
+                           0,
+                           (LPTHREAD_START_ROUTINE)
+                            RpcThreadRoutine,
+                           NULL,
+                           0,
+                           NULL);
 
-VOID CALLBACK
-ServiceMain(DWORD argc, LPTSTR *argv)
+    if(!hThread) DPRINT("Can't create RpcThread\n");
+    else CloseHandle(hThread);
+}
+
+
+int main(int argc, char *argv[])
 {
-  DPRINT("ServiceMain() called\n");
+	WCHAR SysLogPath[MAX_PATH];
+	MyHeap = HeapCreate(0, 1024*256, 0);
 
-  if (StartPortThread() == FALSE)
-    {
-      DPRINT("StartPortThread() failed\n");
-    }
+	if(MyHeap==NULL)
+	{
+		DbgPrint("EventLog: FATAL ERROR, can't create heap.\n");
+		return 1;
+	}
+	
+	/*
+	This will be fixed in near future
+	 */
+	
+	GetWindowsDirectory(SysLogPath, MAX_PATH);
+	lstrcat(SysLogPath, L"\\system32\\config\\SysEvent.evt");
 
-  DPRINT("ServiceMain() done\n");
+	SystemLog = LogfCreate(L"System", SysLogPath);
+
+	if(SystemLog == NULL)
+	{
+		DbgPrint("EventLog: FATAL ERROR, can't create %S\n",
SysLogPath);
+		HeapDestroy(MyHeap);
+		return 1;
+	}
+
+    StartServiceCtrlDispatcher(ServiceTable);
+
+	LogfClose(SystemLog);
+	HeapDestroy(MyHeap);
+
+    return 0;
 }
 
+VOID EventTimeToSystemTime(DWORD EventTime, 
+                           SYSTEMTIME *pSystemTime)
+{
+	SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
+	FILETIME ftLocal;
+	union {
+		FILETIME ft;
+		ULONGLONG ll;
+	} u1970, uUCT;
+	
+	uUCT.ft.dwHighDateTime = 0;
+	uUCT.ft.dwLowDateTime = EventTime;
+	SystemTimeToFileTime(&st1970, &u1970.ft);
+	uUCT.ll = uUCT.ll * 10000000 + u1970.ll;
+	FileTimeToLocalFileTime(&uUCT.ft, &ftLocal);
+	FileTimeToSystemTime(&ftLocal, pSystemTime);
+}
 
-int
-main(int argc, char *argv[])
+VOID SystemTimeToEventTime(SYSTEMTIME *pSystemTime,
+						   DWORD *pEventTime)
 {
-  DPRINT("main() called\n");
+	SYSTEMTIME st1970 = { 1970, 1, 0, 1, 0, 0, 0, 0 };
+	union {
+		FILETIME ft;
+		ULONGLONG ll;
+	} Time, u1970;
 
-  StartServiceCtrlDispatcher(ServiceTable);
+	SystemTimeToFileTime(pSystemTime, &Time.ft);
+	SystemTimeToFileTime(&st1970, &u1970.ft);
+	*pEventTime = (Time.ll - u1970.ll) / 10000000; 
+}
 
-  DPRINT("main() done\n");
+VOID PRINT_HEADER(PFILE_HEADER header)
+{
+	DPRINT("SizeOfHeader=%d\n",header->SizeOfHeader);
+	DPRINT("Signature=0x%x\n",header->Signature);
+	DPRINT("MajorVersion=%d\n",header->MajorVersion);
+	DPRINT("MinorVersion=%d\n",header->MinorVersion);
+	DPRINT("FirstRecordOffset=%d\n",header->FirstRecordOffset);
+	DPRINT("EofOffset=0x%x\n",header->EofOffset);
+	DPRINT("NextRecord=%d\n",header->NextRecord);
+	DPRINT("OldestRecord=%d\n",header->OldestRecord);
+	DPRINT("unknown1=0x%x\n",header->unknown1);
+	DPRINT("unknown2=0x%x\n",header->unknown2);
+	DPRINT("SizeOfHeader2=%d\n",header->SizeOfHeader2);
+	DPRINT("Flags: ");
+	if(header->Flags & LOGFILE_FLAG1)DPRINT("LOGFILE_FLAG1 ");
+	if(header->Flags & LOGFILE_FLAG2)DPRINT("| LOGFILE_FLAG2 ");
+	if(header->Flags & LOGFILE_FLAG3)DPRINT("| LOGFILE_FLAG3 ");
+	if(header->Flags & LOGFILE_FLAG4)DPRINT("| LOGFILE_FLAG4");
+	DPRINT("\n"); 
+}
 
-  ExitThread(0);
+VOID PRINT_RECORD(PEVENTLOGRECORD pRec)
+{
+	UINT i;
+	WCHAR *str;
+	SYSTEMTIME time;
+	
+	DPRINT("Length=%d\n", pRec->Length );
+	DPRINT("Reserved=0x%x\n", pRec->Reserved );
+	DPRINT("RecordNumber=%d\n", pRec->RecordNumber );
+	
+	EventTimeToSystemTime(pRec->TimeGenerated, &time);
+	DPRINT("TimeGenerated=%d.%d.%d %d:%d:%d\n", 
+			time.wDay, time.wMonth, time.wYear,
+			time.wHour, time.wMinute, time.wSecond);
 
-  return 0;
+	EventTimeToSystemTime(pRec->TimeWritten, &time);  
+	DPRINT("TimeWritten=%d.%d.%d %d:%d:%d\n", 
+			time.wDay, time.wMonth, time.wYear,
+			time.wHour, time.wMinute, time.wSecond);
+
+	DPRINT("EventID=%d\n", pRec->EventID ); 
+
+	switch(pRec->EventType)
+	{
+		case EVENTLOG_ERROR_TYPE:
+			DPRINT("EventType = EVENTLOG_ERROR_TYPE\n");
+			break;
+		case EVENTLOG_WARNING_TYPE:
+			DPRINT("EventType = EVENTLOG_WARNING_TYPE\n");
+			break;
+		case EVENTLOG_INFORMATION_TYPE:
+			DPRINT("EventType =
EVENTLOG_INFORMATION_TYPE\n");
+ 			break;
+		case EVENTLOG_AUDIT_SUCCESS:
+			DPRINT("EventType = EVENTLOG_AUDIT_SUCCESS\n");
+			break;
+		case EVENTLOG_AUDIT_FAILURE:
+			DPRINT("EventType = EVENTLOG_AUDIT_FAILURE\n");
+			break;
+		default:
+			DPRINT("EventType = %x\n");
+	}	
+
+	DPRINT("NumStrings=%d\n",  pRec->NumStrings );
+	DPRINT("EventCategory=%d\n",  pRec->EventCategory); 
+	DPRINT("ReservedFlags=0x%x\n", pRec->ReservedFlags);
+	DPRINT("ClosingRecordNumber=%d\n", pRec->ClosingRecordNumber);
+	DPRINT("StringOffset=%d\n", pRec->StringOffset); 
+	DPRINT("UserSidLength=%d\n", pRec->UserSidLength);  
+	DPRINT("UserSidOffset=%d\n", pRec->UserSidOffset); 
+	DPRINT("DataLength=%d\n", pRec->DataLength); 
+	DPRINT("DataOffset=%d\n", pRec->DataOffset); 
+
+	DPRINT("SourceName: %S\n", (WCHAR
*)(((PBYTE)pRec)+sizeof(EVENTLOGRECORD)));
+	i = (lstrlenW((WCHAR
*)(((PBYTE)pRec)+sizeof(EVENTLOGRECORD)))+1)*sizeof(WCHAR);
+	DPRINT("ComputerName: %S\n", (WCHAR
*)(((PBYTE)pRec)+sizeof(EVENTLOGRECORD)+i));
+	
+	if(pRec->StringOffset < pRec->Length && pRec->NumStrings){
+		DPRINT("Strings:\n");
+		str = (WCHAR*)(((PBYTE)pRec)+pRec->StringOffset);
+		for(i = 0; i < pRec->NumStrings; i++)
+		{
+			DPRINT("[%d] %S\n", i, str);
+			str = str+lstrlenW(str)+1;
+		}
+	}
+
+	DPRINT("Length2=%d\n", *(PDWORD)(((PBYTE)pRec)+pRec->Length-4));
 }
 
-/* EOF */
+
+
  _____  

Modified: trunk/reactos/services/eventlog/eventlog.h
--- trunk/reactos/services/eventlog/eventlog.h	2005-09-20 07:37:45 UTC
(rev 17939)
+++ trunk/reactos/services/eventlog/eventlog.h	2005-09-20 07:58:28 UTC
(rev 17940)
@@ -1,17 +1,329 @@

-
+/*
+ * COPYRIGHT:   See COPYING in the top level directory
+ * PROJECT:     ReactOS
+ * FILE:        eventlog.h
+ * PURPOSE:     Event logging service
+ * PROGRAMMER:  Saveliy Tretiakov (saveliyt(a)mail.ru)
+ */
+ 
 #ifndef __EVENTLOG_H__
 #define __EVENTLOG_H__
 
+#include <windows.h>
+#define NTOS_MODE_USER
+#include <ndk/ntndk.h>
+#include <debug.h>
+#include "eventlogrpc_s.h"
+
 typedef struct _IO_ERROR_LPC
 {
     PORT_MESSAGE Header;
     IO_ERROR_LOG_MESSAGE Message;
 } IO_ERROR_LPC, *PIO_ERROR_LPC;
 
-BOOL
-StartPortThread(VOID);
+#define LOGHANDLE unsigned char*
+#define PLOGHANDLE int* 
 
+#define MAJORVER 1
+#define MINORVER 1
 
+/*
+ *  Our file format will be compatible with NT's
+ */
+
+#define LOGFILE_SIGNATURE 0x654c664c 
+
+/*  
+ *  FIXME
+ *  Flags used in logfile header
+ */
+#define LOGFILE_FLAG1 1
+#define LOGFILE_FLAG2 2
+#define LOGFILE_FLAG3 4
+#define LOGFILE_FLAG4 8
+
+typedef struct {
+	DWORD SizeOfHeader;
+	DWORD Signature;
+	DWORD MajorVersion;
+	DWORD MinorVersion;
+	DWORD FirstRecordOffset;
+	DWORD EofOffset;
+	DWORD NextRecord;
+	DWORD OldestRecord;
+	DWORD unknown1;
+	DWORD Flags;
+	DWORD unknown2; 
+	DWORD SizeOfHeader2; 
+} FILE_HEADER, *PFILE_HEADER;
+
+typedef struct {
+	DWORD Size1;
+	DWORD Ones; // Must be 0x11111111
+	DWORD Twos; // Must be 0x22222222
+	DWORD Threes; // Must be 0x33333333
+	DWORD Fours; // Must be 0x44444444
+	DWORD StartOffset;
+	DWORD EndOffset;
+	DWORD NextRecordNumber;
+	DWORD OldestRecordNumber;
+	DWORD Size2;
+} EOF_RECORD, *PEOF_RECORD;
+
+typedef struct {
+	ULONG EventNumber;
+	ULONG EventOffset;
+} EVENT_OFFSET_INFO, *PEVENT_OFFSET_INFO;
+
+typedef struct {
+	HANDLE hFile;
+	FILE_HEADER Header;
+	WCHAR *LogName;
+	WCHAR *FileName;
+    CRITICAL_SECTION cs;
+	PEVENT_OFFSET_INFO OffsetInfo;
+	ULONG OffsetInfoSize;
+	ULONG OffsetInfoNext;
+	PVOID Next;
+	PVOID Prev;
+} LOGFILE, *PLOGFILE;
+
+
+/* file.c */
+PLOGFILE LogfListHead();
+
+INT LogfListItemCount();
+
+PLOGFILE LogfListItemByIndex(INT Index);
+
+PLOGFILE LogfListItemByName(WCHAR *Name);
+
+VOID LogfListAddItem(PLOGFILE Item);
+
+VOID LogfListRemoveItem(PLOGFILE Item);
+
+BOOL LogfReadEvent(PLOGFILE LogFile,
+                   DWORD Flags,
+                   DWORD RecordNumber,
+                   DWORD BufSize,
+                   PBYTE Buffer,
+                   DWORD *BytesRead,
+                   DWORD *BytesNeeded);
+
+BOOL LogfWriteData(PLOGFILE LogFile,
+                    DWORD BufSize,
+                    PBYTE Buffer);
+
+PLOGFILE LogfCreate(WCHAR *LogName, 
+                    WCHAR *FileName);
+
+VOID LogfClose(PLOGFILE LogFile);
+
+BOOL LogfInitializeNew(PLOGFILE LogFile);
+
+BOOL LogfInitializeExisting(PLOGFILE LogFile);
+
+DWORD LogfGetOldestRecord(PLOGFILE LogFile);
+
+ULONG LogfOffsetByNumber(PLOGFILE LogFile,
+						 DWORD RecordNumber);
+
+BOOL LogfAddOffsetInformation(PLOGFILE LogFile, 
+							  ULONG
ulNumber,
+							  ULONG
ulOffset);
+
+DWORD LogfBuildNewRecord(PBYTE Buffer, 
+						 DWORD dwRecordNumber,
+						 WORD wType,
+						 WORD wCategory,
+						 DWORD dwEventId,
+						 LPCWSTR SourceName,
+						 LPCWSTR ComputerName,
+						 DWORD dwSidLength,
+						 PSID lpUserSid,
+						 WORD wNumStrings,
+						 WCHAR *lpStrings,
+						 DWORD dwDataSize,
+						 LPVOID lpRawData);
+
+/* eventlog.c */
+VOID PRINT_HEADER(PFILE_HEADER header);
+
+VOID PRINT_RECORD(PEVENTLOGRECORD pRec);
+
+VOID EventTimeToSystemTime(DWORD EventTime, 
+						   SYSTEMTIME
*SystemTime);
+
+VOID SystemTimeToEventTime(SYSTEMTIME *pSystemTime,
+						   DWORD *pEventTime);
+
+/* logport.c */
+NTSTATUS STDCALL PortThreadRoutine(PVOID Param);
+
+NTSTATUS InitLogPort(VOID);
+
+NTSTATUS ProcessPortMessage(VOID);
+
+/* rpc.c */
+DWORD STDCALL RpcThreadRoutine(LPVOID lpParameter);
+
+NTSTATUS EventLogClearW(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	wchar_t *BackupName);
+
+NTSTATUS EventLogBackupW(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	wchar_t *FileName);
+
+NTSTATUS EventLogClose(
+	handle_t BindingHandle,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogUnregSrc(
+	handle_t BindingHandle,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogRecordsNumber(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long *RecordsNumber);
+
+NTSTATUS EventLogGetOldestRec(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long *OldestRecNumber);
+
+NTSTATUS Unknown6(handle_t BindingHandle);
+
+NTSTATUS EventLogOpenW(
+	handle_t BindingHandle,
+	LPWSTR ServerName,
+	wchar_t *FileName, 
+	wchar_t *NullStr, 
+	unsigned long MajorVer,
+	unsigned long MinorVer,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogRegSrcW(
+	handle_t BindingHandle,
+	LPWSTR ServerName,
+	wchar_t *LogName, 
+	wchar_t *NullStr, 
+	unsigned long MajorVer,
+	unsigned long MinorVer,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogOpenBackupW(
+	handle_t BindingHandle,
+	LPWSTR ServerName,
+	wchar_t *BackupName, 
+	unsigned long MajorVer,
+	unsigned long MinorVer,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogReadW(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long Flags,
+	unsigned long Offset,
+	unsigned long BufSize,
+	unsigned char *Buffer,
+	unsigned long *BytesRead,
+	unsigned long *BytesNeeded);
+
+NTSTATUS EventLogReportEventW(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long Time,
+	unsigned short Type,
+	unsigned short Category,
+	unsigned long ID,
+	unsigned short NumStrings,
+	unsigned long DataSize,
+	wchar_t *ComputerName,
+	unsigned char *SID,
+	wchar_t *Strings,
+	unsigned char *Data,
+	unsigned short Flags);
+
+NTSTATUS EventLogClearA(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	char *BackupName);
+
+NTSTATUS EventLogBackupA(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	char *BackupName);
+
+NTSTATUS EventLogOpenA(
+	handle_t BindingHandle,
+	LPSTR ServerName,
+	char *LogName, 
+	char *NullStr, 
+	unsigned long MajorVer,
+	unsigned long MinorVer,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogRegSrcA(
+	handle_t BindingHandle,
+	LPSTR ServerName,
+	char *LogName, 
+	char *NullStr,
+	unsigned long MajorVer,
+	unsigned long MinorVer,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogOpenBackupA(
+	handle_t BindingHandle,
+	LPSTR ServerName,
+	char *BackupName, 
+	unsigned long MajorVer,
+	unsigned long MinorVer,
+	PLOGHANDLE Handle);
+
+NTSTATUS EventLogReadA(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long Flags,
+	unsigned long Offset,
+	unsigned long BufSize,
+	unsigned char *Buffer,
+	unsigned long *BytesRead,
+	unsigned long *BytesNeeded);
+
+NTSTATUS EventLogReportEventA(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long Time,
+	unsigned short Type,
+	unsigned short Category,
+	unsigned long ID,
+	unsigned short NumStrings,
+	unsigned long DataSize,
+	char *ComputerName,
+	unsigned char *SID,
+	char* Strings,
+	unsigned char *Data,
+	unsigned short Flags);
+
+NTSTATUS Unknown19(handle_t BindingHandle);
+
+NTSTATUS Unknown20(handle_t BindingHandle);
+
+NTSTATUS Unknown21(handle_t BindingHandle);
+
+NTSTATUS EventLogGetInfo(
+	handle_t BindingHandle,
+	LOGHANDLE Handle,
+	unsigned long InfoLevel,
+	unsigned char *Buffer,
+	unsigned long BufSize,
+	unsigned long *BytesNeeded);
+
+
+
 #endif /* __EVENTLOG_H__ */
 
-/* EOF */
  _____  

Modified: trunk/reactos/services/eventlog/eventlog.xml
--- trunk/reactos/services/eventlog/eventlog.xml	2005-09-20
07:37:45 UTC (rev 17939)
+++ trunk/reactos/services/eventlog/eventlog.xml	2005-09-20
07:58:28 UTC (rev 17940)
@@ -1,12 +1,17 @@

 <module name="eventlog" type="win32cui"
installbase="system32"
installname="eventlog.exe">
 	<include base="eventlog">.</include>
+	<include base="eventlog_server">.</include>
 	<define name="UNICODE" />
 	<define name="_UNICODE" />
 	<define name="__USE_W32API" />
 	<library>ntdll</library>
 	<library>kernel32</library>
 	<library>advapi32</library>
+	<library>eventlog_server</library>
+	<library>rpcrt4</library>
 	<file>eventlog.c</file>
 	<file>logport.c</file>
 	<file>eventlog.rc</file>
+	<file>rpc.c</file>
+	<file>file.c</file>
 </module>
  _____  

Added: trunk/reactos/services/eventlog/file.c
--- trunk/reactos/services/eventlog/file.c	2005-09-20 07:37:45 UTC
(rev 17939)
+++ trunk/reactos/services/eventlog/file.c	2005-09-20 07:58:28 UTC
(rev 17940)
@@ -0,0 +1,684 @@

+/*
+ * COPYRIGHT:        See COPYING in the top level directory
+ * PROJECT:          ReactOS
+ * FILE:             services/eventlog/file.c
+ * PURPOSE:          Event logging service
+ * PROGRAMMER:       Saveliy Tretiakov (saveliyt(a)mail.ru)
+ */
+ 
+#include "eventlog.h"
+
+PLOGFILE _LogListHead = NULL;
+extern HANDLE MyHeap;
+
+BOOL LogfInitializeNew(PLOGFILE LogFile)
+{
+    DWORD dwWritten;
+	EOF_RECORD EofRec;
+    
+    ZeroMemory(&LogFile->Header, sizeof(FILE_HEADER));
+	SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN);
+	SetEndOfFile(LogFile->hFile);
+	
+	LogFile->Header.SizeOfHeader = sizeof(FILE_HEADER);
+	LogFile->Header.SizeOfHeader2 = sizeof(FILE_HEADER);
+	LogFile->Header.FirstRecordOffset = sizeof(FILE_HEADER);
+	LogFile->Header.EofOffset = sizeof(FILE_HEADER);
+	LogFile->Header.MajorVersion = MAJORVER;
+	LogFile->Header.MinorVersion = MINORVER;
+	LogFile->Header.NextRecord = 1;
+
+	LogFile->Header.Signature = LOGFILE_SIGNATURE;
+	WriteFile(LogFile->hFile,
+			  &LogFile->Header,
+			  sizeof(FILE_HEADER),
+			  &dwWritten,
+			  NULL);
+
+	EofRec.Ones = 0x11111111;
+	EofRec.Twos = 0x22222222;
+	EofRec.Threes = 0x33333333;
+	EofRec.Fours = 0x44444444;
+	EofRec.Size1 = sizeof(EOF_RECORD);
+	EofRec.Size2 = sizeof(EOF_RECORD);
+	EofRec.NextRecordNumber = LogFile->Header.NextRecord;
+	EofRec.OldestRecordNumber = LogFile->Header.OldestRecord;
+	EofRec.StartOffset = LogFile->Header.FirstRecordOffset;
+	EofRec.EndOffset = LogFile->Header.EofOffset;
+
+	WriteFile(LogFile->hFile, &EofRec, sizeof(EOF_RECORD),
&dwWritten, NULL);
+
+	FlushFileBuffers(LogFile->hFile);
+      
+    return TRUE;
+}
+
+BOOL LogfInitializeExisting(PLOGFILE LogFile)
+{
+	DWORD dwRead;
+	DWORD dwRecordsNumber = 0;
+	DWORD dwRecSize, dwRecSign, dwFilePointer;
+	PDWORD pdwRecSize2;
+	PEVENTLOGRECORD RecBuf;
+
+	SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN);
+	ReadFile(LogFile->hFile, 
+             &LogFile->Header, 
+             sizeof(FILE_HEADER), 
+             &dwRead, NULL);
+             
+	if(dwRead != sizeof(FILE_HEADER))
+	{
+		DPRINT("EventLog: Invalid file %S.\n",
LogFile->FileName);
+		return LogfInitializeNew(LogFile);
+    }
+    
+	if(LogFile->Header.SizeOfHeader != sizeof(FILE_HEADER) ||
+		LogFile->Header.SizeOfHeader2 != sizeof(FILE_HEADER))
+	{
+		DPRINT("EventLog: Invalid header size in %S.\n",
LogFile->FileName);
+		return LogfInitializeNew(LogFile);
+    }
+    
+    if(LogFile->Header.Signature != LOGFILE_SIGNATURE)
+    {
+        DPRINT("EventLog: Invalid signature %x in %S.\n", 
+               LogFile->Header.Signature,
+               LogFile->FileName);
+        return LogfInitializeNew(LogFile);
+    }
+
+	if(LogFile->Header.EofOffset > GetFileSize(LogFile->hFile,
NULL)+1)
+	{
+        DPRINT("EventLog: Invalid eof offset %x in %S.\n", 
+               LogFile->Header.EofOffset,
+               LogFile->FileName);
+        return LogfInitializeNew(LogFile);
+	}
+
+	for(;;)
+	{
+		dwFilePointer = SetFilePointer(LogFile->hFile, 
+
0, 
+
NULL, 
+
FILE_CURRENT);
+
+		ReadFile(LogFile->hFile, 
[truncated at 1000 lines; 1352 more skipped]