[hbelusca] 72236: [EVENTLOG] - Get rid of MyHeap. - Continue using safe string functions. - Allow event logs themselves to be their own source. And store the full list of log sources in the "Source...

Author: hbelusca
Date: Tue Aug 16 21:08:15 2016
New Revision: 72236

URL: http://svn.reactos.org/svn/reactos?rev=72236&view=rev
Log:
[EVENTLOG]
- Get rid of MyHeap.
- Continue using safe string functions.
- Allow event logs themselves to be their own source. And store the full list of log
sources in the "Sources" registry multi-string value.
- Correctly compute the number of records.
- Correctly return the event number and the write timestamp of reported events.
- Use a helper function for ElfrReportEventW/A and for ElfrReportEventAndSourceW that is
now implemented.
- Rewrite the file.c functions using NT-APIs almost exclusively for file operations.
- Modify the logic of LogfReadEvents so that a RecordNumber == 0 in sequential read mode
means we need to determine where to start the read operation, depending on whether a
forwards-read or a backwards-read is performed. The log handle's CurrentRecord member
is therefore initialized to 0 before usage.
- Adjust LogfAllocAndBuildNewRecord to take in input the event generation timestamp.
- Do not "compute" the RecordNumber of the new event in
LogfAllocAndBuildNewRecord; it will be consistently assigned by LogfWriteRecord.
- Correctly initialize the OldestRecordNumber to zero for new (empty) logs.
- Perform extensive log validity checks when opening existing logs: log header and EOF
record as well as boundary checks.
- Rewrite almost of the functions to support event log wrapping (see
https://msdn.microsoft.com/en-us/library/windows/desktop/bb309026(v=vs.85).… ) and
splitted records. Now our event logs are not corrupted anymore, and are readable under
Windows 2k/xp/2k3/Vista+.
- As a consequence of supporting wrapping event logs we need to iterate through them at
loading time in order to locate the valid EOF record (indeed it may happen that the log
header is not correctly synced, and its Start/EndOffsets are invalid. The EOF record
offsets contain on the other way the correct values).

The file.c fixes are a bit still work-in-progress, but the bulk of the code works. It is
extensively tested in situ in my local VM since 2 months now.

CORE-11843 #resolve

Modified:
    trunk/reactos/base/services/eventlog/eventlog.c
    trunk/reactos/base/services/eventlog/eventlog.h
    trunk/reactos/base/services/eventlog/eventsource.c
    trunk/reactos/base/services/eventlog/file.c
    trunk/reactos/base/services/eventlog/logport.c
    trunk/reactos/base/services/eventlog/rpc.c

[This mail would be too long, it was shortened to contain the URLs only.]

Modified: trunk/reactos/base/services/eventlog/eventlog.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve…

Modified: trunk/reactos/base/services/eventlog/eventlog.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve…

Modified: trunk/reactos/base/services/eventlog/eventsource.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/eve…

Modified: trunk/reactos/base/services/eventlog/file.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/fil…

Modified: trunk/reactos/base/services/eventlog/logport.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/log…

Modified: trunk/reactos/base/services/eventlog/rpc.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/rpc…