Code:
/ 4.0 / 4.0 / DEVDIV_TFS / Dev10 / Releases / RTMRel / ndp / fx / src / Core / System / Diagnostics / Eventing / Reader / ProviderMetadata.cs / 1305376 / ProviderMetadata.cs
// ==++== // // Copyright (c) Microsoft Corporation. All rights reserved. // // ==--== /*============================================================ ** ** Class: ProviderMetadata ** ** Purpose: ** This public class exposes all the metadata for a specific ** Provider. An instance of this class is obtained from ** EventLogManagement and is scoped to a single Locale. ** ============================================================*/ using System.Globalization; using System.Collections.Generic; using System.Runtime.InteropServices; using System.Text; using System.Security.Permissions; using Microsoft.Win32; using System.Diagnostics.CodeAnalysis; namespace System.Diagnostics.Eventing.Reader { ////// Exposes all the metadata for a specific event Provider. An instance /// of this class is obtained from EventLogManagement and is scoped to a /// single Locale. /// [System.Security.Permissions.HostProtection(MayLeakOnAbort = true)] public class ProviderMetadata : IDisposable { // // access to the data member reference is safe, while // invoking methods on it is marked SecurityCritical as appropriate. // private EventLogHandle handle = EventLogHandle.Zero; private EventLogHandle defaultProviderHandle = EventLogHandle.Zero; private EventLogSession session = null; private string providerName; private CultureInfo cultureInfo; private string logFilePath; //caching of the IEnumerable, , , on the ProviderMetadata //they do not change with every call. private IList levels = null; private IList opcodes = null; private IList tasks = null; private IList keywords = null; private IList standardLevels = null; private IList standardOpcodes = null; private IList standardTasks = null; private IList standardKeywords = null; private IList channelReferences = null; private object syncObject; public ProviderMetadata(string providerName) : this(providerName, null, null, null) { } public ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo) : this(providerName, session, targetCultureInfo, null) { } // SecurityCritical since it allocates SafeHandles. // Marked TreatAsSafe since we perform the Demand check. [System.Security.SecuritySafeCritical] internal ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo, string logFilePath) { EventLogPermissionHolder.GetEventLogPermission().Demand(); if (targetCultureInfo == null) targetCultureInfo = CultureInfo.CurrentCulture; if (session == null) session = EventLogSession.GlobalSession; this.session = session; this.providerName = providerName; this.cultureInfo = targetCultureInfo; this.logFilePath = logFilePath; handle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, this.providerName, this.logFilePath, this.cultureInfo.LCID, 0); this.syncObject = new object(); } internal EventLogHandle Handle { get { return handle; } } public string Name { get { return providerName; } } public Guid Id { get { return (Guid)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataPublisherGuid); } } public string MessageFilePath { get { return (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataMessageFilePath); } } public string ResourceFilePath { get { return (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataResourceFilePath); } } public string ParameterFilePath { get { return (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataParameterFilePath); } } public Uri HelpLink { get { string helpLinkStr = (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataHelpLink); if ( helpLinkStr == null || helpLinkStr.Length == 0 ) return null; return new Uri(helpLinkStr); } } private uint ProviderMessageID { get { return (uint)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataPublisherMessageID); } } public string DisplayName { [System.Security.SecurityCritical] get { uint msgId = (uint)this.ProviderMessageID; if ( msgId == 0xffffffff ) return null; EventLogPermissionHolder.GetEventLogPermission().Demand(); return NativeWrapper.EvtFormatMessage(this.handle, msgId); } } public IList LogLinks { [System.Security.SecurityCritical] get { EventLogHandle elHandle = EventLogHandle.Zero; try { lock (syncObject) { if (this.channelReferences != null) return this.channelReferences; EventLogPermissionHolder.GetEventLogPermission().Demand(); elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferences); int arraySize = NativeWrapper.EvtGetObjectArraySize(elHandle); List channelList = new List (arraySize); for (int index = 0; index < arraySize; index++) { string channelName = (string)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferencePath); uint channelId = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceID); uint flag = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceFlags); bool isImported; if (flag == (int) UnsafeNativeMethods.EvtChannelReferenceFlags.EvtChannelReferenceImported) isImported = true; else isImported = false; int channelRefMessageId = (int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceMessageID)); string channelRefDisplayName; //if channelRefMessageId == -1, we do not have anything in the message table. if (channelRefMessageId == -1) { channelRefDisplayName = null; } else { channelRefDisplayName = NativeWrapper.EvtFormatMessage(this.handle, (uint)channelRefMessageId); } if (channelRefDisplayName == null && isImported) { if (String.Compare(channelName, "Application", StringComparison.OrdinalIgnoreCase ) == 0) channelRefMessageId = 256; else if ( String.Compare(channelName, "System", StringComparison.OrdinalIgnoreCase ) == 0) channelRefMessageId = 258; else if ( String.Compare(channelName, "Security", StringComparison.OrdinalIgnoreCase ) == 0) channelRefMessageId = 257; else channelRefMessageId = -1; if ( channelRefMessageId != -1 ) { if ( this.defaultProviderHandle.IsInvalid ) { this.defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, null, null, this.cultureInfo.LCID, 0); } channelRefDisplayName = NativeWrapper.EvtFormatMessage(this.defaultProviderHandle, (uint)channelRefMessageId); } } channelList.Add(new EventLogLink(channelName, isImported, channelRefDisplayName, channelId)); } this.channelReferences = channelList.AsReadOnly(); } return this.channelReferences; } finally { elHandle.Close(); } } } internal enum ObjectTypeName { Level = 0, Opcode = 1, Task = 2, Keyword = 3 } internal string FindStandardLevelDisplayName(string name, uint value) { if( this.standardLevels == null ) this.standardLevels = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels); foreach (EventLevel standardLevel in this.standardLevels){ if (standardLevel.Name == name && standardLevel.Value == value) return standardLevel.DisplayName; } return null; } internal string FindStandardOpcodeDisplayName(string name, uint value){ if ( this.standardOpcodes == null ) this.standardOpcodes = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes); foreach (EventOpcode standardOpcode in this.standardOpcodes){ if (standardOpcode.Name == name && standardOpcode.Value == value) return standardOpcode.DisplayName; } return null; } internal string FindStandardKeywordDisplayName(string name, long value) { if ( this.standardKeywords == null ) this.standardKeywords = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords); foreach (EventKeyword standardKeyword in this.standardKeywords){ if (standardKeyword.Name == name && standardKeyword.Value == value) return standardKeyword.DisplayName; } return null; } internal string FindStandardTaskDisplayName(string name, uint value) { if ( this.standardTasks == null ) this.standardTasks = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks); foreach (EventTask standardTask in this.standardTasks) { if (standardTask.Name == name && standardTask.Value == value) return standardTask.DisplayName; } return null; } [System.Security.SecuritySafeCritical] internal object GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty) { EventLogHandle elHandle = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); try { UnsafeNativeMethods.EvtPublisherMetadataPropertyId propName; UnsafeNativeMethods.EvtPublisherMetadataPropertyId propValue; UnsafeNativeMethods.EvtPublisherMetadataPropertyId propMessageId; ObjectTypeName objectTypeName; List levelList = null; List opcodeList = null; List keywordList = null; List taskList = null; elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(providerHandle, metadataProperty); int arraySize = NativeWrapper.EvtGetObjectArraySize(elHandle); switch (metadataProperty) { case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID; objectTypeName = ObjectTypeName.Level; levelList = new List (arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID; objectTypeName = ObjectTypeName.Opcode; opcodeList = new List (arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID; objectTypeName = ObjectTypeName.Keyword; keywordList = new List (arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID; objectTypeName = ObjectTypeName.Task; taskList = new List (arraySize); break; default: return null; } for (int index = 0; index < arraySize; index++) { string generalName = (string)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propName); uint generalValue = 0; long generalValueKeyword = 0; if (objectTypeName != ObjectTypeName.Keyword) { generalValue = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue); } else { generalValueKeyword = (long)((ulong)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue)); } int generalMessageId = (int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propMessageId)); string generalDisplayName = null; if (generalMessageId == -1) { if (providerHandle != this.defaultProviderHandle) { if (this.defaultProviderHandle.IsInvalid) { this.defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, null, null, this.cultureInfo.LCID, 0); } switch (objectTypeName) { case ObjectTypeName.Level: generalDisplayName = FindStandardLevelDisplayName( generalName, generalValue ); break; case ObjectTypeName.Opcode: generalDisplayName = FindStandardOpcodeDisplayName( generalName, generalValue>>16 ); break; case ObjectTypeName.Keyword: generalDisplayName = FindStandardKeywordDisplayName(generalName, generalValueKeyword); break; case ObjectTypeName.Task: generalDisplayName = FindStandardTaskDisplayName(generalName, generalValue); break; default: generalDisplayName = null; break; } } } else { generalDisplayName = NativeWrapper.EvtFormatMessage(providerHandle, (uint)generalMessageId); } switch (objectTypeName) { case ObjectTypeName.Level: levelList.Add(new EventLevel(generalName, (int)generalValue, generalDisplayName)); break; case ObjectTypeName.Opcode: opcodeList.Add(new EventOpcode(generalName, (int)(generalValue>>16), generalDisplayName)); break; case ObjectTypeName.Keyword: keywordList.Add(new EventKeyword(generalName, (long)generalValueKeyword, generalDisplayName)); break; case ObjectTypeName.Task: Guid taskGuid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskEventGuid); taskList.Add(new EventTask(generalName, (int)generalValue, generalDisplayName, taskGuid)); break; default: return null; } } switch (objectTypeName) { case ObjectTypeName.Level: return levelList; case ObjectTypeName.Opcode: return opcodeList; case ObjectTypeName.Keyword: return keywordList; case ObjectTypeName.Task: return taskList; } return null; } finally { elHandle.Close(); } } public IList Levels { get { List el; lock (syncObject) { if (this.levels != null) return this.levels; el = (List )this.GetProviderListProperty( this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels); this.levels = el.AsReadOnly(); } return this.levels; } } [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "Opcodes", Justification = "[....]: Shipped public in 3.5, breaking change to fix now.")] public IList Opcodes { get { List eo; lock (syncObject) { if (this.opcodes != null) return this.opcodes; eo = (List )this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes); this.opcodes = eo.AsReadOnly(); } return this.opcodes; } } public IList Keywords { get { List ek; lock (syncObject) { if (this.keywords != null) return this.keywords; ek = (List )this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords); this.keywords = ek.AsReadOnly(); } return this.keywords; } } public IList Tasks { get { List et; lock (syncObject) { if (this.tasks != null) return this.tasks; et = (List )this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks); this.tasks = et.AsReadOnly(); } return this.tasks; } } public IEnumerable Events { [System.Security.SecurityCritical] get { EventLogPermissionHolder.GetEventLogPermission().Demand(); List emList = new List (); EventLogHandle emEnumHandle = NativeWrapper.EvtOpenEventMetadataEnum(handle, 0); using (emEnumHandle) { while (true) { EventLogHandle emHandle = emHandle = NativeWrapper.EvtNextEventMetadata(emEnumHandle, 0); if (emHandle == null) break; using (emHandle) { uint emId = (uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventID); byte emVersion = (byte)((uint)(NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventVersion))); byte emChannelId = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventChannel)); byte emLevel = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventLevel)); byte emOpcode = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventOpcode)); short emTask = (short)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventTask)); long emKeywords = (long)(ulong)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventKeyword); string emTemplate = (string)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventTemplate); int messageId = (int)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventMessageID)); string emMessage; if (messageId == -1) emMessage = null; else emMessage = NativeWrapper.EvtFormatMessage(this.handle, (uint)messageId); EventMetadata em = new EventMetadata(emId, emVersion, emChannelId, emLevel, emOpcode, emTask, emKeywords, emTemplate, emMessage, this); emList.Add(em); } } return emList.AsReadOnly(); } } } // throws if Provider metadata has been uninstalled since this object was created. internal void CheckReleased() { lock (syncObject) { this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks); } } public void Dispose() { Dispose(true); GC.SuppressFinalize(this); } [System.Security.SecuritySafeCritical] protected virtual void Dispose(bool disposing) { if (disposing) { EventLogPermissionHolder.GetEventLogPermission().Demand(); } if (handle != null && !handle.IsInvalid) handle.Dispose(); } } } // File provided for Reference Use Only by Microsoft Corporation (c) 2007. // ==++== // // Copyright (c) Microsoft Corporation. All rights reserved. // // ==--== /*============================================================ ** ** Class: ProviderMetadata ** ** Purpose: ** This public class exposes all the metadata for a specific ** Provider. An instance of this class is obtained from ** EventLogManagement and is scoped to a single Locale. ** ============================================================*/ using System.Globalization; using System.Collections.Generic; using System.Runtime.InteropServices; using System.Text; using System.Security.Permissions; using Microsoft.Win32; using System.Diagnostics.CodeAnalysis; namespace System.Diagnostics.Eventing.Reader { /// /// Exposes all the metadata for a specific event Provider. An instance /// of this class is obtained from EventLogManagement and is scoped to a /// single Locale. /// [System.Security.Permissions.HostProtection(MayLeakOnAbort = true)] public class ProviderMetadata : IDisposable { // // access to the data member reference is safe, while // invoking methods on it is marked SecurityCritical as appropriate. // private EventLogHandle handle = EventLogHandle.Zero; private EventLogHandle defaultProviderHandle = EventLogHandle.Zero; private EventLogSession session = null; private string providerName; private CultureInfo cultureInfo; private string logFilePath; //caching of the IEnumerable, , , on the ProviderMetadata //they do not change with every call. private IList levels = null; private IList opcodes = null; private IList tasks = null; private IList keywords = null; private IList standardLevels = null; private IList standardOpcodes = null; private IList standardTasks = null; private IList standardKeywords = null; private IList channelReferences = null; private object syncObject; public ProviderMetadata(string providerName) : this(providerName, null, null, null) { } public ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo) : this(providerName, session, targetCultureInfo, null) { } // SecurityCritical since it allocates SafeHandles. // Marked TreatAsSafe since we perform the Demand check. [System.Security.SecuritySafeCritical] internal ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo, string logFilePath) { EventLogPermissionHolder.GetEventLogPermission().Demand(); if (targetCultureInfo == null) targetCultureInfo = CultureInfo.CurrentCulture; if (session == null) session = EventLogSession.GlobalSession; this.session = session; this.providerName = providerName; this.cultureInfo = targetCultureInfo; this.logFilePath = logFilePath; handle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, this.providerName, this.logFilePath, this.cultureInfo.LCID, 0); this.syncObject = new object(); } internal EventLogHandle Handle { get { return handle; } } public string Name { get { return providerName; } } public Guid Id { get { return (Guid)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataPublisherGuid); } } public string MessageFilePath { get { return (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataMessageFilePath); } } public string ResourceFilePath { get { return (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataResourceFilePath); } } public string ParameterFilePath { get { return (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataParameterFilePath); } } public Uri HelpLink { get { string helpLinkStr = (string)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataHelpLink); if ( helpLinkStr == null || helpLinkStr.Length == 0 ) return null; return new Uri(helpLinkStr); } } private uint ProviderMessageID { get { return (uint)NativeWrapper.EvtGetPublisherMetadataProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataPublisherMessageID); } } public string DisplayName { [System.Security.SecurityCritical] get { uint msgId = (uint)this.ProviderMessageID; if ( msgId == 0xffffffff ) return null; EventLogPermissionHolder.GetEventLogPermission().Demand(); return NativeWrapper.EvtFormatMessage(this.handle, msgId); } } public IList LogLinks { [System.Security.SecurityCritical] get { EventLogHandle elHandle = EventLogHandle.Zero; try { lock (syncObject) { if (this.channelReferences != null) return this.channelReferences; EventLogPermissionHolder.GetEventLogPermission().Demand(); elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferences); int arraySize = NativeWrapper.EvtGetObjectArraySize(elHandle); List channelList = new List (arraySize); for (int index = 0; index < arraySize; index++) { string channelName = (string)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferencePath); uint channelId = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceID); uint flag = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceFlags); bool isImported; if (flag == (int) UnsafeNativeMethods.EvtChannelReferenceFlags.EvtChannelReferenceImported) isImported = true; else isImported = false; int channelRefMessageId = (int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceMessageID)); string channelRefDisplayName; //if channelRefMessageId == -1, we do not have anything in the message table. if (channelRefMessageId == -1) { channelRefDisplayName = null; } else { channelRefDisplayName = NativeWrapper.EvtFormatMessage(this.handle, (uint)channelRefMessageId); } if (channelRefDisplayName == null && isImported) { if (String.Compare(channelName, "Application", StringComparison.OrdinalIgnoreCase ) == 0) channelRefMessageId = 256; else if ( String.Compare(channelName, "System", StringComparison.OrdinalIgnoreCase ) == 0) channelRefMessageId = 258; else if ( String.Compare(channelName, "Security", StringComparison.OrdinalIgnoreCase ) == 0) channelRefMessageId = 257; else channelRefMessageId = -1; if ( channelRefMessageId != -1 ) { if ( this.defaultProviderHandle.IsInvalid ) { this.defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, null, null, this.cultureInfo.LCID, 0); } channelRefDisplayName = NativeWrapper.EvtFormatMessage(this.defaultProviderHandle, (uint)channelRefMessageId); } } channelList.Add(new EventLogLink(channelName, isImported, channelRefDisplayName, channelId)); } this.channelReferences = channelList.AsReadOnly(); } return this.channelReferences; } finally { elHandle.Close(); } } } internal enum ObjectTypeName { Level = 0, Opcode = 1, Task = 2, Keyword = 3 } internal string FindStandardLevelDisplayName(string name, uint value) { if( this.standardLevels == null ) this.standardLevels = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels); foreach (EventLevel standardLevel in this.standardLevels){ if (standardLevel.Name == name && standardLevel.Value == value) return standardLevel.DisplayName; } return null; } internal string FindStandardOpcodeDisplayName(string name, uint value){ if ( this.standardOpcodes == null ) this.standardOpcodes = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes); foreach (EventOpcode standardOpcode in this.standardOpcodes){ if (standardOpcode.Name == name && standardOpcode.Value == value) return standardOpcode.DisplayName; } return null; } internal string FindStandardKeywordDisplayName(string name, long value) { if ( this.standardKeywords == null ) this.standardKeywords = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords); foreach (EventKeyword standardKeyword in this.standardKeywords){ if (standardKeyword.Name == name && standardKeyword.Value == value) return standardKeyword.DisplayName; } return null; } internal string FindStandardTaskDisplayName(string name, uint value) { if ( this.standardTasks == null ) this.standardTasks = (List )GetProviderListProperty(this.defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks); foreach (EventTask standardTask in this.standardTasks) { if (standardTask.Name == name && standardTask.Value == value) return standardTask.DisplayName; } return null; } [System.Security.SecuritySafeCritical] internal object GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty) { EventLogHandle elHandle = EventLogHandle.Zero; EventLogPermissionHolder.GetEventLogPermission().Demand(); try { UnsafeNativeMethods.EvtPublisherMetadataPropertyId propName; UnsafeNativeMethods.EvtPublisherMetadataPropertyId propValue; UnsafeNativeMethods.EvtPublisherMetadataPropertyId propMessageId; ObjectTypeName objectTypeName; List levelList = null; List opcodeList = null; List keywordList = null; List taskList = null; elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(providerHandle, metadataProperty); int arraySize = NativeWrapper.EvtGetObjectArraySize(elHandle); switch (metadataProperty) { case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID; objectTypeName = ObjectTypeName.Level; levelList = new List (arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID; objectTypeName = ObjectTypeName.Opcode; opcodeList = new List (arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID; objectTypeName = ObjectTypeName.Keyword; keywordList = new List (arraySize); break; case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks: propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName; propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue; propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID; objectTypeName = ObjectTypeName.Task; taskList = new List (arraySize); break; default: return null; } for (int index = 0; index < arraySize; index++) { string generalName = (string)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propName); uint generalValue = 0; long generalValueKeyword = 0; if (objectTypeName != ObjectTypeName.Keyword) { generalValue = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue); } else { generalValueKeyword = (long)((ulong)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propValue)); } int generalMessageId = (int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)propMessageId)); string generalDisplayName = null; if (generalMessageId == -1) { if (providerHandle != this.defaultProviderHandle) { if (this.defaultProviderHandle.IsInvalid) { this.defaultProviderHandle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, null, null, this.cultureInfo.LCID, 0); } switch (objectTypeName) { case ObjectTypeName.Level: generalDisplayName = FindStandardLevelDisplayName( generalName, generalValue ); break; case ObjectTypeName.Opcode: generalDisplayName = FindStandardOpcodeDisplayName( generalName, generalValue>>16 ); break; case ObjectTypeName.Keyword: generalDisplayName = FindStandardKeywordDisplayName(generalName, generalValueKeyword); break; case ObjectTypeName.Task: generalDisplayName = FindStandardTaskDisplayName(generalName, generalValue); break; default: generalDisplayName = null; break; } } } else { generalDisplayName = NativeWrapper.EvtFormatMessage(providerHandle, (uint)generalMessageId); } switch (objectTypeName) { case ObjectTypeName.Level: levelList.Add(new EventLevel(generalName, (int)generalValue, generalDisplayName)); break; case ObjectTypeName.Opcode: opcodeList.Add(new EventOpcode(generalName, (int)(generalValue>>16), generalDisplayName)); break; case ObjectTypeName.Keyword: keywordList.Add(new EventKeyword(generalName, (long)generalValueKeyword, generalDisplayName)); break; case ObjectTypeName.Task: Guid taskGuid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int) UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskEventGuid); taskList.Add(new EventTask(generalName, (int)generalValue, generalDisplayName, taskGuid)); break; default: return null; } } switch (objectTypeName) { case ObjectTypeName.Level: return levelList; case ObjectTypeName.Opcode: return opcodeList; case ObjectTypeName.Keyword: return keywordList; case ObjectTypeName.Task: return taskList; } return null; } finally { elHandle.Close(); } } public IList Levels { get { List el; lock (syncObject) { if (this.levels != null) return this.levels; el = (List )this.GetProviderListProperty( this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels); this.levels = el.AsReadOnly(); } return this.levels; } } [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "Opcodes", Justification = "[....]: Shipped public in 3.5, breaking change to fix now.")] public IList Opcodes { get { List eo; lock (syncObject) { if (this.opcodes != null) return this.opcodes; eo = (List )this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes); this.opcodes = eo.AsReadOnly(); } return this.opcodes; } } public IList Keywords { get { List ek; lock (syncObject) { if (this.keywords != null) return this.keywords; ek = (List )this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords); this.keywords = ek.AsReadOnly(); } return this.keywords; } } public IList Tasks { get { List et; lock (syncObject) { if (this.tasks != null) return this.tasks; et = (List )this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks); this.tasks = et.AsReadOnly(); } return this.tasks; } } public IEnumerable Events { [System.Security.SecurityCritical] get { EventLogPermissionHolder.GetEventLogPermission().Demand(); List emList = new List (); EventLogHandle emEnumHandle = NativeWrapper.EvtOpenEventMetadataEnum(handle, 0); using (emEnumHandle) { while (true) { EventLogHandle emHandle = emHandle = NativeWrapper.EvtNextEventMetadata(emEnumHandle, 0); if (emHandle == null) break; using (emHandle) { uint emId = (uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventID); byte emVersion = (byte)((uint)(NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventVersion))); byte emChannelId = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventChannel)); byte emLevel = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventLevel)); byte emOpcode = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventOpcode)); short emTask = (short)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventTask)); long emKeywords = (long)(ulong)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventKeyword); string emTemplate = (string)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventTemplate); int messageId = (int)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventMessageID)); string emMessage; if (messageId == -1) emMessage = null; else emMessage = NativeWrapper.EvtFormatMessage(this.handle, (uint)messageId); EventMetadata em = new EventMetadata(emId, emVersion, emChannelId, emLevel, emOpcode, emTask, emKeywords, emTemplate, emMessage, this); emList.Add(em); } } return emList.AsReadOnly(); } } } // throws if Provider metadata has been uninstalled since this object was created. internal void CheckReleased() { lock (syncObject) { this.GetProviderListProperty(this.handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks); } } public void Dispose() { Dispose(true); GC.SuppressFinalize(this); } [System.Security.SecuritySafeCritical] protected virtual void Dispose(bool disposing) { if (disposing) { EventLogPermissionHolder.GetEventLogPermission().Demand(); } if (handle != null && !handle.IsInvalid) handle.Dispose(); } } } // File provided for Reference Use Only by Microsoft Corporation (c) 2007.
Link Menu

This book is available now!
Buy at Amazon US or
Buy at Amazon UK
- XPathMultyIterator.cs
- ObjectDataSourceStatusEventArgs.cs
- JsonDataContract.cs
- DoubleStorage.cs
- PropertyDescriptorComparer.cs
- Propagator.ExtentPlaceholderCreator.cs
- Viewport3DVisual.cs
- XPathEmptyIterator.cs
- TimelineGroup.cs
- XmlILConstructAnalyzer.cs
- MatrixStack.cs
- Wizard.cs
- ProfileModule.cs
- PointHitTestParameters.cs
- FirstMatchCodeGroup.cs
- DesignerAttribute.cs
- EncoderBestFitFallback.cs
- DynamicDataExtensions.cs
- Pair.cs
- PenContexts.cs
- PanelDesigner.cs
- InheritedPropertyChangedEventArgs.cs
- RowBinding.cs
- DataGridViewCellErrorTextNeededEventArgs.cs
- DataGridViewBand.cs
- DataGridViewSelectedRowCollection.cs
- RetrieveVirtualItemEventArgs.cs
- Camera.cs
- FullTrustAssemblyCollection.cs
- NonParentingControl.cs
- CookieParameter.cs
- XmlSiteMapProvider.cs
- RepeaterItemEventArgs.cs
- PartialTrustHelpers.cs
- WorkflowHostingResponseContext.cs
- safelinkcollection.cs
- CuspData.cs
- NotifyIcon.cs
- PropertyMapper.cs
- LongSumAggregationOperator.cs
- XmlSequenceWriter.cs
- TemplateLookupAction.cs
- CodeExporter.cs
- ModelTreeManager.cs
- WinEventHandler.cs
- MasterPageCodeDomTreeGenerator.cs
- DbParameterCollectionHelper.cs
- Point3DAnimationUsingKeyFrames.cs
- ComboBoxItem.cs
- CharEntityEncoderFallback.cs
- WsdlBuildProvider.cs
- VirtualDirectoryMapping.cs
- DefaultWorkflowTransactionService.cs
- KeyValueInternalCollection.cs
- QuaternionRotation3D.cs
- CacheChildrenQuery.cs
- ContentDesigner.cs
- _StreamFramer.cs
- WebBrowserDocumentCompletedEventHandler.cs
- Separator.cs
- BaseDataListDesigner.cs
- SizeF.cs
- ParallelTimeline.cs
- Privilege.cs
- D3DImage.cs
- DataControlButton.cs
- PeerCollaboration.cs
- DataGridViewImageColumn.cs
- dataprotectionpermission.cs
- DirectoryObjectSecurity.cs
- ChangeNode.cs
- ListQueryResults.cs
- DateTimeConverter.cs
- HwndHostAutomationPeer.cs
- SecurityDocument.cs
- InteropAutomationProvider.cs
- ContentIterators.cs
- FormViewUpdateEventArgs.cs
- XmlSchemaException.cs
- RuleInfoComparer.cs
- HttpResponseMessageProperty.cs
- SQLStringStorage.cs
- TagPrefixAttribute.cs
- StreamUpgradeBindingElement.cs
- TypeReference.cs
- ContextMenuStrip.cs
- DefaultDialogButtons.cs
- IndexerNameAttribute.cs
- SeparatorAutomationPeer.cs
- DispatcherExceptionEventArgs.cs
- EntityWrapperFactory.cs
- KeyFrames.cs
- XmlSiteMapProvider.cs
- ThreadStaticAttribute.cs
- QuaternionValueSerializer.cs
- DetailsViewPagerRow.cs
- XmlILOptimizerVisitor.cs
- AccessControlEntry.cs
- Calendar.cs
- Parsers.cs