EventLog.h

Go to the documentation of this file.

/*  EventLog.h - NT Event log API wrapper
    Copyright (C) 2001-2004 Mark Weaver
    Written by Mark Weaver <mark@npsl.co.uk>

    Part of the Open-Win32 library.
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
    License as published by the Free Software Foundation; either
    version 2 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Library General Public License for more details.

    You should have received a copy of the GNU Library General Public
    License along with this library; if not, write to the
    Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA  02111-1307, USA.
*/

#ifndef OW32_EventLog_h
#define OW32_EventLog_h

#include <OW32/XHKEY.h>
#include <tchar.h>
#include <cstdio>

namespace OW32
{

class OW32_LIB_EXPORT CEventLog
{
private:
    HANDLE m_hEventLog;

public:
    CEventLog() : m_hEventLog(NULL) {}

    ~CEventLog() { Close(); }

    BOOL Open(LPCTSTR SourceName, LPCTSTR Computer = NULL)
    {
        m_hEventLog = RegisterEventSource(Computer, SourceName); // open the event log
        return (m_hEventLog != NULL); // oh dear, and no way to report the error!
    }

    void Close()
    {
        if (m_hEventLog != NULL) {
            DeregisterEventSource(m_hEventLog);
            m_hEventLog = NULL;
        }
    }

    BOOL ReportEvent(WORD wType,                // type of event (success, error, etc).
                     DWORD dwEventID,           // message table ID of event
                     WORD wCategory = 0,        // category, defaults to `None'
                     WORD wNumStrings = 0,      // number of strings to merge
                     LPCTSTR* lpStrings = NULL, // the strings
                     DWORD dwDataSize = 0,      // raw data size
                     LPVOID lpRawData = NULL,   // raw data buffer
                     PSID lpUserSID = NULL)     // current user's SID for logging user name
    {
        if (!m_hEventLog) // uhoh!
            return FALSE;

        return ::ReportEvent(m_hEventLog, wType, wCategory, dwEventID, lpUserSID, 
                           wNumStrings, dwDataSize, lpStrings, lpRawData);
    }

    BOOL ReportInformation(DWORD dwEventID, LPCTSTR str1=0, LPCTSTR str2=0, LPCTSTR str3=0, LPCTSTR str4=0)
    {
        LPCTSTR lpStrings[5] = {str1, str2, str3, str4, 0};
        int NumStrings=0;
        for ( ; lpStrings[NumStrings] != 0; NumStrings++)
            ;
        return ReportEvent((WORD)EVENTLOG_INFORMATION_TYPE, dwEventID, (WORD)0, (WORD)NumStrings, lpStrings);
    }

    BOOL ReportWarning(DWORD dwEventID, LPCTSTR str1=0, LPCTSTR str2=0, LPCTSTR str3=0, LPCTSTR str4=0)
    {
        LPCTSTR lpStrings[5] = {str1, str2, str3, str4, 0};
        int NumStrings=0;
        for ( ; lpStrings[NumStrings] != 0; NumStrings++)
            ;
        return ReportEvent((WORD)EVENTLOG_WARNING_TYPE, dwEventID, (WORD)0, (WORD)NumStrings, lpStrings);
    }

    BOOL ReportError(DWORD dwEventID, LPCTSTR str1=0, LPCTSTR str2=0, LPCTSTR str3=0, LPCTSTR str4=0)
    {
        LPCTSTR lpStrings[5] = {str1, str2, str3, str4, 0};
        int NumStrings=0;
        for ( ; lpStrings[NumStrings] != 0; NumStrings++)
            ;
        return ReportEvent((WORD)EVENTLOG_ERROR_TYPE, dwEventID, (WORD)0, (WORD)NumStrings, lpStrings);
    }

    BOOL ReportAPIError(DWORD dwEventID, DWORD dwErr, LPCTSTR str1=0, LPCTSTR str2=0, LPCTSTR str3=0)
    {
        LPTSTR lpMessage=NULL;
        if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, // flags
                      0, // source (if hmodule/string)
                      dwErr, // message id
                      0, // lang id
                      (LPTSTR)&lpMessage, // output buffer
                      0, // max char count
                      NULL) == 0) { // args
            TCHAR num[32];
            _sntprintf(num, sizeof(num)/sizeof(num[0]), _T("%d"), dwErr);
            return ReportError(dwEventID, num, str1, str2, str3);
        }
        BOOL bRet = ReportError(dwEventID, lpMessage, str1, str2, str3);
        LocalFree(lpMessage);
        return bRet;
    }

    static LONG RegisterMessageDLL(LPCTSTR SourceName, LPCTSTR MessageDLLPath=NULL, HMODULE hModule=NULL,
        DWORD TypesSupported = EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE | EVENTLOG_INFORMATION_TYPE)
    {
        TCHAR EventLogKeyName[MAX_PATH];
        _sntprintf(EventLogKeyName, MAX_PATH, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\%s"), 
            SourceName);

        // register the app as an event source
        XHKEY hk;
        LONG lErr;
        if ((lErr=RegCreateKey(HKEY_LOCAL_MACHINE,
                EventLogKeyName,
                &hk)) != ERROR_SUCCESS) {
            return lErr;
        }

        // set the name of the message file
        TCHAR path[MAX_PATH];
        if (!MessageDLLPath) {
            if (!GetModuleFileName(hModule, path, MAX_PATH))
                return ::GetLastError();
            MessageDLLPath = path;
        }
        if ((lErr=RegSetValueEx(hk, _T("EventMessageFile"), 0, REG_EXPAND_SZ, (LPBYTE)MessageDLLPath, (DWORD)(_tcslen(MessageDLLPath)+1)*sizeof(TCHAR))) !=
            ERROR_SUCCESS) {
            return lErr;
        }

        // set the supported event types in the TypesSupported value
        if ((lErr=RegSetValueEx(hk, _T("TypesSupported"), 0, REG_DWORD, (LPBYTE)&TypesSupported, sizeof(TypesSupported))) !=
            ERROR_SUCCESS) {
            return lErr;
        }
        return ERROR_SUCCESS;
    }

    static LONG UnregisterMessageDLL(LPCTSTR SourceName)
    {
        // work out the name of the event log key
        TCHAR EventLogKeyName[MAX_PATH];
        _sntprintf(EventLogKeyName, MAX_PATH, _T("SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\%s"), SourceName);

        // delete registry key for event source
        LONG lErr;
        if ((lErr=RegDeleteKey(HKEY_LOCAL_MACHINE, EventLogKeyName)) != ERROR_SUCCESS) {
            return lErr;
        }
        return ERROR_SUCCESS;
    }
};

} // namespace OW32

#endif // OW32_EventLog_h

---