blob: 3f5d03ed6339d64b32d0535cdf9470ff57f1ef46 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/*
* Unix SMB/CIFS implementation.
* RPC Pipe client / server routines
* Copyright (C) Marcin Krzysztof Porwit 2005.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#ifndef _RPC_EVENTLOG_H /* _RPC_EVENTLOG_H */
#define _RPC_EVENTLOG_H
/* opcodes */
#define EVENTLOG_CLEAREVENTLOG 0x00
#define EVENTLOG_CLOSEEVENTLOG 0x02
#define EVENTLOG_GETNUMRECORDS 0x04
#define EVENTLOG_GETOLDESTENTRY 0x05
#define EVENTLOG_OPENEVENTLOG 0x07
#define EVENTLOG_READEVENTLOG 0x0a
/* Eventlog read flags */
/* defined in librpc/gen_ndr/eventlog.h */
/* Event types */
/* defined in librpc/gen_ndr/eventlog.h */
/* Defines for TDB keys */
#define EVT_OLDEST_ENTRY "INFO/oldest_entry"
#define EVT_NEXT_RECORD "INFO/next_record"
#define EVT_VERSION "INFO/version"
#define EVT_MAXSIZE "INFO/maxsize"
#define EVT_RETENTION "INFO/retention"
#define ELOG_APPL "Application"
#define ELOG_SYS "System"
#define ELOG_SEC "Security"
typedef struct elog_tdb {
struct elog_tdb *prev, *next;
char *name;
TDB_CONTEXT *tdb;
int ref_count;
} ELOG_TDB;
#define ELOG_TDB_CTX(x) ((x)->tdb)
#define EVENTLOG_DATABASE_VERSION_V1 1
/***********************************/
typedef struct
{
POLICY_HND handle;
uint32 flags;
uint32 offset;
uint32 max_read_size;
} EVENTLOG_Q_READ_EVENTLOG;
typedef struct {
uint32 length;
uint32 reserved1;
uint32 record_number;
uint32 time_generated;
uint32 time_written;
uint32 event_id;
uint16 event_type;
uint16 num_strings;
uint16 event_category;
uint16 reserved2;
uint32 closing_record_number;
uint32 string_offset;
uint32 user_sid_length;
uint32 user_sid_offset;
uint32 data_length;
uint32 data_offset;
} Eventlog_record;
typedef struct {
uint32 source_name_len;
smb_ucs2_t *source_name;
uint32 computer_name_len;
smb_ucs2_t *computer_name;
uint32 sid_padding;
smb_ucs2_t *sid;
uint32 strings_len;
smb_ucs2_t *strings;
uint32 user_data_len;
char *user_data;
uint32 data_padding;
} Eventlog_data_record;
typedef struct eventlog_entry {
Eventlog_record record;
Eventlog_data_record data_record;
uint8 *data;
uint8 *end_of_data_padding;
struct eventlog_entry *next;
} Eventlog_entry;
typedef struct {
uint32 num_bytes_in_resp;
uint32 bytes_in_next_record;
uint32 num_records;
Eventlog_entry *entry;
uint8 *end_of_entries_padding;
uint32 sent_size;
uint32 real_size;
NTSTATUS status;
} EVENTLOG_R_READ_EVENTLOG;
#endif /* _RPC_EVENTLOG_H */
|
