public EventRecord ReadEvent(TimeSpan timeout) { EventLogPermissionHolder.GetEventLogPermission().Demand(); if (this.isEof) { throw new InvalidOperationException(); } if (this.currentIndex >= this.eventCount) { // buffer is empty, get next batch. GetNextBatch(timeout); if (this.currentIndex >= this.eventCount) { this.isEof = true; return(null); } } EventLogRecord eventInstance = new EventLogRecord(new EventLogHandle(this.eventsBuffer[currentIndex], true), this.eventQuery.Session, this.cachedMetadataInformation); currentIndex++; return(eventInstance); }
public EventLogPropertySelector(IEnumerable <string> propertyQueries) { EventLogPermissionHolder.GetEventLogPermission().Demand(); if (propertyQueries == null) { throw new ArgumentNullException("propertyQueries"); } string[] paths; ICollection <string> coll = propertyQueries as ICollection <string>; if (coll != null) { paths = new string[coll.Count]; coll.CopyTo(paths, 0); } else { List <string> queries; queries = new List <string>(propertyQueries); paths = queries.ToArray(); } renderContextHandleValues = NativeWrapper.EvtCreateRenderContext(paths.Length, paths, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextValues); }
private void RequestEvents() { EventLogPermissionHolder.GetEventLogPermission().Demand(); this.asyncException = null; bool flag = false; do { if (!this.isSubscribing) { return; } try { if (!NativeWrapper.EvtNext(this.handle, this.eventsBuffer.Length, this.eventsBuffer, 0, 0, ref this.numEventsInBuffer)) { break; } } catch (EventLogException exception) { this.asyncException = exception; } this.HandleEventsRequestCompletion(); }while (flag); }
public EventLogSession(string server, string domain, string user, SecureString password, SessionAuthentication logOnType) { EventLogPermissionHolder.GetEventLogPermission().Demand(); if (server == null) { server = "localhost"; } syncObject = new object(); this.server = server; this.domain = domain; this.user = user; this.logOnType = logOnType; UnsafeNativeMethods.EvtRpcLogin erLogin = new UnsafeNativeMethods.EvtRpcLogin(); erLogin.Server = this.server; erLogin.User = this.user; erLogin.Domain = this.domain; erLogin.Flags = (int)this.logOnType; erLogin.Password = CoTaskMemUnicodeSafeHandle.Zero; try { if (password != null) { erLogin.Password.SetMemory(Marshal.SecureStringToCoTaskMemUnicode(password)); } //open a session using the erLogin structure. handle = NativeWrapper.EvtOpenSession(UnsafeNativeMethods.EvtLoginClass.EvtRpcLogin, ref erLogin, 0, 0); } finally { erLogin.Password.Close(); } }
protected virtual void Dispose(bool disposing) { if (disposing) { if (this == globalSession) { throw new InvalidOperationException(); } EventLogPermissionHolder.GetEventLogPermission().Demand(); } if (this.renderContextHandleSystem != null && !this.renderContextHandleSystem.IsInvalid) { this.renderContextHandleSystem.Dispose(); } if (this.renderContextHandleUser != null && !this.renderContextHandleUser.IsInvalid) { this.renderContextHandleUser.Dispose(); } if (handle != null && !handle.IsInvalid) { handle.Dispose(); } }
private void RequestEvents() { EventLogPermissionHolder.GetEventLogPermission().Demand(); this.asyncException = null; Debug.Assert(this.numEventsInBuffer == 0); bool results = false; do { if (!this.isSubscribing) { break; } try { results = NativeWrapper.EvtNext(this.handle, this.eventsBuffer.Length, this.eventsBuffer, 0, 0, ref this.numEventsInBuffer); if (!results) { return; } } catch (Exception e) { this.asyncException = new EventLogException(); this.asyncException.Data.Add("RealException", e); } HandleEventsRequestCompletion(); } while (results); }
public EventLogSession(string server, string domain, string user, SecureString password, SessionAuthentication logOnType) { this.renderContextHandleSystem = EventLogHandle.Zero; this.renderContextHandleUser = EventLogHandle.Zero; this.handle = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); if (server == null) { server = "localhost"; } this.syncObject = new object(); this.server = server; this.domain = domain; this.user = user; this.logOnType = logOnType; Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin login = new Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin { Server = this.server, User = this.user, Domain = this.domain, Flags = (int)this.logOnType, Password = CoTaskMemUnicodeSafeHandle.Zero }; try { if (password != null) { login.Password.SetMemory(Marshal.SecureStringToCoTaskMemUnicode(password)); } this.handle = NativeWrapper.EvtOpenSession(Microsoft.Win32.UnsafeNativeMethods.EvtLoginClass.EvtRpcLogin, ref login, 0, 0); } finally { login.Password.Close(); } }
public override string ToXml() { EventLogPermissionHolder.GetEventLogPermission().Demand(); StringBuilder buffer = new StringBuilder(0x7d0); NativeWrapper.EvtRender(EventLogHandle.Zero, this.handle, Microsoft.Win32.UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventXml, buffer); return(buffer.ToString()); }
public override string ToXml() { EventLogPermissionHolder.GetEventLogPermission().Demand(); StringBuilder renderBuffer = new StringBuilder(2000); NativeWrapper.EvtRender(EventLogHandle.Zero, this.handle, UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventXml, renderBuffer); return(renderBuffer.ToString()); }
public EventLogSession() { this.renderContextHandleSystem = EventLogHandle.Zero; this.renderContextHandleUser = EventLogHandle.Zero; this.handle = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); this.syncObject = new object(); }
internal void StartSubscribing() { if (this.isSubscribing) { throw new InvalidOperationException(); } int flag = 0; if (bookmark != null) { flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAfterBookmark; } else if (this.readExistingEvents) { flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAtOldestRecord; } else { flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeToFutureEvents; } if (this.eventQuery.TolerateQueryErrors) { flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeTolerateQueryErrors; } EventLogPermissionHolder.GetEventLogPermission().Demand(); this.callbackThreadId = -1; this.unregisterDoneHandle = new AutoResetEvent(false); this.subscriptionWaitHandle = new AutoResetEvent(false); EventLogHandle bookmarkHandle = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark); using (bookmarkHandle) { handle = NativeWrapper.EvtSubscribe(this.eventQuery.Session.Handle, this.subscriptionWaitHandle.SafeWaitHandle, this.eventQuery.Path, this.eventQuery.Query, bookmarkHandle, IntPtr.Zero, IntPtr.Zero, flag); } this.isSubscribing = true; RequestEvents(); this.registeredWaitHandle = ThreadPool.RegisterWaitForSingleObject( this.subscriptionWaitHandle, new WaitOrTimerCallback(SubscribedEventsAvailableCallback), null, -1, false); }
internal void StopSubscribing() { EventLogPermissionHolder.GetEventLogPermission().Demand(); // // need to set isSubscribing to false before waiting for completion of callback. // this.isSubscribing = false; if (this.registeredWaitHandle != null) { this.registeredWaitHandle.Unregister(this.unregisterDoneHandle); if (this.callbackThreadId != Thread.CurrentThread.ManagedThreadId) { // // not calling Stop from within callback - wait for // any outstanding callbacks to complete. // if (this.unregisterDoneHandle != null) { this.unregisterDoneHandle.WaitOne(); } } this.registeredWaitHandle = null; } if (this.unregisterDoneHandle != null) { this.unregisterDoneHandle.Close(); this.unregisterDoneHandle = null; } if (this.subscriptionWaitHandle != null) { this.subscriptionWaitHandle.Close(); this.subscriptionWaitHandle = null; } for (int i = 0; i < this.numEventsInBuffer; i++) { if (eventsBuffer[i] != IntPtr.Zero) { NativeWrapper.EvtClose(eventsBuffer[i]); eventsBuffer[i] = IntPtr.Zero; } } this.numEventsInBuffer = 0; if (handle != null && !handle.IsInvalid) { handle.Dispose(); } }
protected virtual void Dispose(bool disposing) { if (disposing) { EventLogPermissionHolder.GetEventLogPermission().Demand(); } if (renderContextHandleValues != null && !renderContextHandleValues.IsInvalid) { renderContextHandleValues.Dispose(); } }
protected virtual void Dispose(bool disposing) { if (disposing) { EventLogPermissionHolder.GetEventLogPermission().Demand(); } if (handle != null && !handle.IsInvalid) { handle.Dispose(); } }
internal void SetupUserContext() { EventLogPermissionHolder.GetEventLogPermission().Demand(); lock (this.syncObject) { if (this.renderContextHandleUser.IsInvalid) { this.renderContextHandleUser = NativeWrapper.EvtCreateRenderContext(0, null, Microsoft.Win32.UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextUser); } } }
public EventLogConfiguration(string logName, EventLogSession session) { this.handle = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); if (session == null) { session = EventLogSession.GlobalSession; } this.session = session; this.channelName = logName; this.handle = NativeWrapper.EvtOpenChannelConfig(this.session.Handle, this.channelName, 0); }
public void Seek(EventBookmark bookmark, long offset) { if (bookmark == null) { throw new ArgumentNullException("bookmark"); } EventLogPermissionHolder.GetEventLogPermission().Demand(); this.SeekReset(); using (EventLogHandle handle = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark)) { NativeWrapper.EvtSeek(this.handle, offset, handle, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark); } }
protected virtual void Dispose(bool disposing) { if (disposing) { EventLogPermissionHolder.GetEventLogPermission().Demand(); } while (this.currentIndex < this.eventCount) { NativeWrapper.EvtClose(this.eventsBuffer[this.currentIndex]); this.currentIndex++; } if ((this.handle != null) && !this.handle.IsInvalid) { this.handle.Dispose(); } }
protected override void Dispose(bool disposing) { try { if (disposing) { EventLogPermissionHolder.GetEventLogPermission().Demand(); } if (this.handle != null && !this.handle.IsInvalid) { this.handle.Dispose(); } } finally { base.Dispose(disposing); } }
internal EventLogInformation(EventLogSession session, string channelName, PathType pathType) { EventLogPermissionHolder.GetEventLogPermission().Demand(); EventLogHandle logHandle = NativeWrapper.EvtOpenLog(session.Handle, channelName, pathType); using (logHandle) { creationTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogCreationTime); lastAccessTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastAccessTime); lastWriteTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastWriteTime); fileSize = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogFileSize)); fileAttributes = (int?)((uint?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogAttributes)); recordCount = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogNumberOfLogRecords)); oldestRecordNumber = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogOldestRecordNumber)); isLogFull = (bool?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogFull); } }
internal void SetupSystemContext() { EventLogPermissionHolder.GetEventLogPermission().Demand(); if (!this.renderContextHandleSystem.IsInvalid) { return; } lock (this.syncObject) { if (this.renderContextHandleSystem.IsInvalid) { //create the SYSTEM render context //call the EvtCreateRenderContext to get the renderContextHandleSystem, so that we can get the system/values/user properties. this.renderContextHandleSystem = NativeWrapper.EvtCreateRenderContext(0, null, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextSystem); } } }
public EventLogReader(EventLogQuery eventQuery, EventBookmark bookmark) { if (eventQuery == null) { throw new ArgumentNullException("eventQuery"); } string logfile = null; if (eventQuery.ThePathType == PathType.FilePath) { logfile = eventQuery.Path; } this.cachedMetadataInformation = new ProviderMetadataCachedInformation(eventQuery.Session, logfile, 50); this.eventQuery = eventQuery; this.batchSize = 0x40; this.eventsBuffer = new IntPtr[this.batchSize]; int flags = 0; if (this.eventQuery.ThePathType == PathType.LogName) { flags |= 1; } else { flags |= 2; } if (this.eventQuery.ReverseDirection) { flags |= 0x200; } if (this.eventQuery.TolerateQueryErrors) { flags |= 0x1000; } EventLogPermissionHolder.GetEventLogPermission().Demand(); this.handle = NativeWrapper.EvtQuery(this.eventQuery.Session.Handle, this.eventQuery.Path, this.eventQuery.Query, flags); EventLogHandle bookmarkHandleFromBookmark = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark); if (!bookmarkHandleFromBookmark.IsInvalid) { using (bookmarkHandleFromBookmark) { NativeWrapper.EvtSeek(this.handle, 1L, bookmarkHandleFromBookmark, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark); } } }
public IEnumerable <string> GetProviderNames() { EventLogPermissionHolder.GetEventLogPermission().Demand(); List <string> list = new List <string>(100); using (EventLogHandle handle = NativeWrapper.EvtOpenProviderEnum(this.Handle, 0)) { bool finish = false; do { string item = NativeWrapper.EvtNextPublisherId(handle, ref finish); if (!finish) { list.Add(item); } }while (!finish); return(list); } }
internal ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo, string logFilePath) { this.handle = EventLogHandle.Zero; this.defaultProviderHandle = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); if (targetCultureInfo == null) { targetCultureInfo = CultureInfo.CurrentCulture; } if (session == null) { session = EventLogSession.GlobalSession; } this.session = session; this.providerName = providerName; this.cultureInfo = targetCultureInfo; this.logFilePath = logFilePath; this.handle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, this.providerName, this.logFilePath, this.cultureInfo.LCID, 0); this.syncObject = new object(); }
public void Seek(SeekOrigin origin, long offset) { EventLogPermissionHolder.GetEventLogPermission().Demand(); switch (origin) { case SeekOrigin.Begin: this.SeekReset(); NativeWrapper.EvtSeek(this.handle, offset, EventLogHandle.Zero, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToFirst); return; case SeekOrigin.Current: if (offset < 0L) { if ((this.currentIndex + offset) >= 0L) { this.SeekCommon(offset); } else { this.SeekCommon(offset); } return; } if ((this.currentIndex + offset) >= this.eventCount) { this.SeekCommon(offset); return; } for (int i = this.currentIndex; i < (this.currentIndex + offset); i++) { NativeWrapper.EvtClose(this.eventsBuffer[i]); } this.currentIndex += (int)offset; return; case SeekOrigin.End: this.SeekReset(); NativeWrapper.EvtSeek(this.handle, offset, EventLogHandle.Zero, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToLast); return; } }
internal EventLogInformation(EventLogSession session, string channelName, PathType pathType) { EventLogPermissionHolder.GetEventLogPermission().Demand(); EventLogHandle handle = NativeWrapper.EvtOpenLog(session.Handle, channelName, pathType); using (handle) { this.creationTime = (DateTime?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogCreationTime); this.lastAccessTime = (DateTime?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastAccessTime); this.lastWriteTime = (DateTime?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastWriteTime); long?nullable = (long?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogFileSize); this.fileSize = nullable.HasValue ? new long?(nullable.GetValueOrDefault()) : null; int?nullable3 = (int?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogAttributes); this.fileAttributes = nullable3.HasValue ? new int?(nullable3.GetValueOrDefault()) : null; long?nullable5 = (long?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogNumberOfLogRecords); this.recordCount = nullable5.HasValue ? new long?(nullable5.GetValueOrDefault()) : null; long?nullable7 = (long?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogOldestRecordNumber); this.oldestRecordNumber = nullable7.HasValue ? new long?(nullable7.GetValueOrDefault()) : null; this.isLogFull = (bool?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogFull); } }
public EventLogPropertySelector(IEnumerable <string> propertyQueries) { string[] strArray; EventLogPermissionHolder.GetEventLogPermission().Demand(); if (propertyQueries == null) { throw new ArgumentNullException("propertyQueries"); } ICollection <string> is2 = propertyQueries as ICollection <string>; if (is2 != null) { strArray = new string[is2.Count]; is2.CopyTo(strArray, 0); } else { strArray = new List <string>(propertyQueries).ToArray(); } this.renderContextHandleValues = NativeWrapper.EvtCreateRenderContext(strArray.Length, strArray, Microsoft.Win32.UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextValues); }
public IEnumerable <string> GetLogNames() { EventLogPermissionHolder.GetEventLogPermission().Demand(); List <string> namesList = new List <string>(100); using (EventLogHandle channelEnum = NativeWrapper.EvtOpenChannelEnum(this.Handle, 0)) { bool finish = false; do { string s = NativeWrapper.EvtNextChannelPath(channelEnum, ref finish); if (finish == false) { namesList.Add(s); } }while (finish == false); return(namesList); } }
internal void StartSubscribing() { if (this.isSubscribing) { throw new InvalidOperationException(); } int flags = 0; if (this.bookmark != null) { flags |= 3; } else if (this.readExistingEvents) { flags |= 2; } else { flags |= 1; } if (this.eventQuery.TolerateQueryErrors) { flags |= 0x1000; } EventLogPermissionHolder.GetEventLogPermission().Demand(); this.callbackThreadId = -1; this.unregisterDoneHandle = new AutoResetEvent(false); this.subscriptionWaitHandle = new AutoResetEvent(false); EventLogHandle bookmarkHandleFromBookmark = EventLogRecord.GetBookmarkHandleFromBookmark(this.bookmark); using (bookmarkHandleFromBookmark) { this.handle = NativeWrapper.EvtSubscribe(this.eventQuery.Session.Handle, this.subscriptionWaitHandle.SafeWaitHandle, this.eventQuery.Path, this.eventQuery.Query, bookmarkHandleFromBookmark, IntPtr.Zero, IntPtr.Zero, flags); } this.isSubscribing = true; this.RequestEvents(); this.registeredWaitHandle = ThreadPool.RegisterWaitForSingleObject(this.subscriptionWaitHandle, new WaitOrTimerCallback(this.SubscribedEventsAvailableCallback), null, -1, false); }
internal void StopSubscribing() { EventLogPermissionHolder.GetEventLogPermission().Demand(); this.isSubscribing = false; if (this.registeredWaitHandle != null) { this.registeredWaitHandle.Unregister(this.unregisterDoneHandle); if ((this.callbackThreadId != Thread.CurrentThread.ManagedThreadId) && (this.unregisterDoneHandle != null)) { this.unregisterDoneHandle.WaitOne(); } this.registeredWaitHandle = null; } if (this.unregisterDoneHandle != null) { this.unregisterDoneHandle.Close(); this.unregisterDoneHandle = null; } if (this.subscriptionWaitHandle != null) { this.subscriptionWaitHandle.Close(); this.subscriptionWaitHandle = null; } for (int i = 0; i < this.numEventsInBuffer; i++) { if (this.eventsBuffer[i] != IntPtr.Zero) { NativeWrapper.EvtClose(this.eventsBuffer[i]); this.eventsBuffer[i] = IntPtr.Zero; } } this.numEventsInBuffer = 0; if ((this.handle != null) && !this.handle.IsInvalid) { this.handle.Dispose(); } }