[ekohl] 64159: [EVENTLOG] - Read MaxSize and Retention from the Registry when a new log file is created. - Use ntdll file functions instead of their kernel32 counterparts.
Author: ekohl Date: Mon Sep 15 12:16:46 2014 New Revision: 64159
URL: http://svn.reactos.org/svn/reactos?rev=64159&view=rev Log: [EVENTLOG] - Read MaxSize and Retention from the Registry when a new log file is created. - Use ntdll file functions instead of their kernel32 counterparts.
Modified: trunk/reactos/base/services/eventlog/eventlog.c trunk/reactos/base/services/eventlog/eventlog.h trunk/reactos/base/services/eventlog/file.c trunk/reactos/base/services/eventlog/rpc.c
Modified: trunk/reactos/base/services/eventlog/eventlog.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/even... ============================================================================== --- trunk/reactos/base/services/eventlog/eventlog.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/eventlog.c [iso-8859-1] Mon Sep 15 12:16:46 2014 @@ -106,7 +106,7 @@ UpdateServiceStatus(SERVICE_STOPPED); return ERROR_SUCCESS;
- default : + default: DPRINT1(" Control %lu received\n", dwControl); return ERROR_CALL_NOT_IMPLEMENTED; } @@ -275,6 +275,7 @@ LONG Result; PLOGFILE pLogf = NULL; UNICODE_STRING FileName; + ULONG ulMaxSize, ulRetention; NTSTATUS Status;
DPRINT("LoadLogFile: %S\n", LogName); @@ -333,7 +334,27 @@
DPRINT("%S -> %S\n", Buf, Expanded);
- Status = LogfCreate(&pLogf, LogName, &FileName, TRUE, FALSE); + ValueLen = sizeof(ULONG); + Result = RegQueryValueEx(hKey, + L"MaxSize", + NULL, + &Type, + (LPBYTE)&ulMaxSize, + &ValueLen); + if (Result != ERROR_SUCCESS) + ulMaxSize = 512 * 1024; /* 512 kBytes */ + + ValueLen = sizeof(ULONG); + Result = RegQueryValueEx(hKey, + L"Retention", + NULL, + &Type, + (LPBYTE)&ulRetention, + &ValueLen); + if (Result != ERROR_SUCCESS) + ulRetention = 0; + + Status = LogfCreate(&pLogf, LogName, &FileName, ulMaxSize, ulRetention, TRUE, FALSE); if (!NT_SUCCESS(Status)) { DPRINT1("Failed to create %S! (Status %08lx)\n", Expanded, Status);
Modified: trunk/reactos/base/services/eventlog/eventlog.h URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/even... ============================================================================== --- trunk/reactos/base/services/eventlog/eventlog.h [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/eventlog.h [iso-8859-1] Mon Sep 15 12:16:46 2014 @@ -156,6 +156,8 @@ LogfCreate(PLOGFILE *Logfile, WCHAR * LogName, PUNICODE_STRING FileName, + ULONG ulMaxSize, + ULONG ulRetention, BOOL Permanent, BOOL Backup);
Modified: trunk/reactos/base/services/eventlog/file.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/file... ============================================================================== --- trunk/reactos/base/services/eventlog/file.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/file.c [iso-8859-1] Mon Sep 15 12:16:46 2014 @@ -24,62 +24,78 @@ /* FUNCTIONS ****************************************************************/
static NTSTATUS -LogfInitializeNew(PLOGFILE LogFile) -{ - DWORD dwWritten; +LogfInitializeNew(PLOGFILE LogFile, + ULONG ulMaxSize, + ULONG ulRetention) +{ + IO_STATUS_BLOCK IoStatusBlock; EVENTLOGEOF EofRec; + NTSTATUS Status;
ZeroMemory(&LogFile->Header, sizeof(EVENTLOGHEADER)); SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN); SetEndOfFile(LogFile->hFile);
LogFile->Header.HeaderSize = sizeof(EVENTLOGHEADER); - LogFile->Header.EndHeaderSize = sizeof(EVENTLOGHEADER); + LogFile->Header.Signature = LOGFILE_SIGNATURE; + LogFile->Header.MajorVersion = MAJORVER; + LogFile->Header.MinorVersion = MINORVER; LogFile->Header.StartOffset = sizeof(EVENTLOGHEADER); LogFile->Header.EndOffset = sizeof(EVENTLOGHEADER); - LogFile->Header.MajorVersion = MAJORVER; - LogFile->Header.MinorVersion = MINORVER; LogFile->Header.CurrentRecordNumber = 1; LogFile->Header.OldestRecordNumber = 1; - /* FIXME: Read MaxSize from registry for this LogFile. - But for now limit EventLog size to just under 5K. */ - LogFile->Header.MaxSize = 5000; - LogFile->Header.Signature = LOGFILE_SIGNATURE; - if (!WriteFile(LogFile->hFile, - &LogFile->Header, - sizeof(EVENTLOGHEADER), - &dwWritten, - NULL)) - { - DPRINT1("WriteFile failed:%d!\n", GetLastError()); - return STATUS_UNSUCCESSFUL; - } - + LogFile->Header.MaxSize = ulMaxSize; + LogFile->Header.Flags = 0; + LogFile->Header.Retention = ulRetention; + LogFile->Header.EndHeaderSize = sizeof(EVENTLOGHEADER); + + Status = NtWriteFile(LogFile->hFile, + NULL, + NULL, + NULL, + &IoStatusBlock, + &LogFile->Header, + sizeof(EVENTLOGHEADER), + NULL, + NULL); + if (!NT_SUCCESS(Status)) + { + DPRINT1("NtWriteFile failed (Status 0x%08lx)\n", Status); + return Status; + } + + EofRec.RecordSizeBeginning = sizeof(EVENTLOGEOF); EofRec.Ones = 0x11111111; EofRec.Twos = 0x22222222; EofRec.Threes = 0x33333333; EofRec.Fours = 0x44444444; - EofRec.RecordSizeBeginning = sizeof(EVENTLOGEOF); - EofRec.RecordSizeEnd = sizeof(EVENTLOGEOF); + EofRec.BeginRecord = LogFile->Header.StartOffset; + EofRec.EndRecord = LogFile->Header.EndOffset; EofRec.CurrentRecordNumber = LogFile->Header.CurrentRecordNumber; EofRec.OldestRecordNumber = LogFile->Header.OldestRecordNumber; - EofRec.BeginRecord = LogFile->Header.StartOffset; - EofRec.EndRecord = LogFile->Header.EndOffset; - - if (!WriteFile(LogFile->hFile, - &EofRec, - sizeof(EVENTLOGEOF), - &dwWritten, - NULL)) - { - DPRINT1("WriteFile failed:%d!\n", GetLastError()); - return STATUS_UNSUCCESSFUL; - } - - if (!FlushFileBuffers(LogFile->hFile)) - { - DPRINT1("FlushFileBuffers failed:%d!\n", GetLastError()); - return STATUS_UNSUCCESSFUL; + EofRec.RecordSizeEnd = sizeof(EVENTLOGEOF); + + Status = NtWriteFile(LogFile->hFile, + NULL, + NULL, + NULL, + &IoStatusBlock, + &EofRec, + sizeof(EVENTLOGEOF), + NULL, + NULL); + if (!NT_SUCCESS(Status)) + { + DPRINT1("NtWriteFile failed (Status 0x%08lx)\n", Status); + return Status; + } + + Status = NtFlushBuffersFile(LogFile->hFile, + &IoStatusBlock); + if (!NT_SUCCESS(Status)) + { + DPRINT1("NtFlushBuffersFile failed (Status 0x%08lx)\n", Status); + return Status; }
return STATUS_SUCCESS; @@ -87,7 +103,8 @@
static NTSTATUS -LogfInitializeExisting(PLOGFILE LogFile, BOOL Backup) +LogfInitializeExisting(PLOGFILE LogFile, + BOOL Backup) { DWORD dwRead; DWORD dwRecordsNumber = 0; @@ -265,10 +282,6 @@ if (LogFile->Header.CurrentRecordNumber == 0) LogFile->Header.CurrentRecordNumber = 1;
- /* FIXME: Read MaxSize from registry for this LogFile. - But for now limit EventLog size to just under 5K. */ - LogFile->Header.MaxSize = 5000; - if (!Backup) { if (SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN) == @@ -301,8 +314,10 @@
NTSTATUS LogfCreate(PLOGFILE *LogFile, - WCHAR * LogName, + WCHAR *LogName, PUNICODE_STRING FileName, + ULONG ulMaxSize, + ULONG ulRetention, BOOL Permanent, BOOL Backup) { @@ -355,7 +370,7 @@ goto fail; }
- if(LogName) + if (LogName) StringCchCopy(pLogFile->LogName,lstrlenW(LogName) + 1, LogName);
pLogFile->FileName = @@ -387,7 +402,7 @@ pLogFile->Permanent = Permanent;
if (bCreateNew) - Status = LogfInitializeNew(pLogFile); + Status = LogfInitializeNew(pLogFile, ulMaxSize, ulRetention); else Status = LogfInitializeExisting(pLogFile, Backup);
@@ -1117,7 +1132,9 @@ } }
- Status = LogfInitializeNew(LogFile); + Status = LogfInitializeNew(LogFile, + LogFile->Header.MaxSize, + LogFile->Header.Retention); if (!NT_SUCCESS(Status)) { DPRINT1("LogfInitializeNew failed (Status: 0x%08lx)\n", Status); @@ -1145,7 +1162,7 @@
DWORD dwOffset, dwRead, dwRecSize;
- DPRINT("LogfBackupFile(%p, %wZ)\n", LogFile, BackupFileName); + DPRINT1("LogfBackupFile(%p, %wZ)\n", LogFile, BackupFileName);
/* Lock the log file shared */ RtlAcquireResourceShared(&LogFile->Lock, TRUE); @@ -1182,7 +1199,7 @@ Header.EndOffset = sizeof(EVENTLOGHEADER); Header.CurrentRecordNumber = 1; Header.OldestRecordNumber = 1; - Header.MaxSize = 0; + Header.MaxSize = LogFile->Header.MaxSize; Header.Flags = ELF_LOGFILE_HEADER_DIRTY; Header.Retention = LogFile->Header.Retention; Header.EndHeaderSize = sizeof(EVENTLOGHEADER);
Modified: trunk/reactos/base/services/eventlog/rpc.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/base/services/eventlog/rpc.... ============================================================================== --- trunk/reactos/base/services/eventlog/rpc.c [iso-8859-1] (original) +++ trunk/reactos/base/services/eventlog/rpc.c [iso-8859-1] Mon Sep 15 12:16:46 2014 @@ -162,6 +162,8 @@ Status = LogfCreate(&lpLogHandle->LogFile, NULL, FileName, + 0, + 0, FALSE, TRUE); if (!NT_SUCCESS(Status))
-
ekohl＠svn.reactos.org