Export (0) Print
Expand All
Expand Minimize

3.1.4 Message Processing Events and Sequencing Rules

Because the server MUST make access control decisions as part of responding to EventLog Remoting Protocol Version 6.0 requests, the client MUST authenticate to the server. This is the responsibility of the lower-layer protocol, RPC over TCP/IP (as specified in [C706]). The access control decisions affecting the EventLog Remoting Protocol Version 6.0 are made based on the identity conveyed by this lower-layer protocol.

The following sections first provide an informative overview of the message sequences before giving the prescriptive details of processing for each message.

The following table lists the IDL members in opcode order.

Methods in RPC Opnum Order

Method Description

EvtRpcRegisterRemoteSubscription

Used by a client to create either a push or a pull subscription.

Opnum: 0

EvtRpcRemoteSubscriptionNextAsync

Used by a client to request asynchronous delivery of events that are delivered to a subscription.

Opnum: 1

EvtRpcRemoteSubscriptionNext

Used for pull subscriptions in which the client polls for events.

Opnum: 2

EvtRpcRemoteSubscriptionWaitAsync

Used to enable the client to only poll when results are likely.

Opnum: 3

EvtRpcRegisterControllableOperation

Obtains a CONTEXT_HANDLE_OPERATION_CONTROL handle that can be used to cancel other operations.

Opnum: 4

EvtRpcRegisterLogQuery

Used to query one or more channels. It can also be used to query a specific file.

Opnum: 5

EvtRpcClearLog

Instructs the server to clear a live event log.

Opnum: 6

EvtRpcExportLog

Instructs the server to create a backup event log at a specified file name.

Opnum: 7

EvtRpcLocalizeExportLog

Used by a client to add localized information to a previously created backup event log.

Opnum: 8

EvtRpcMessageRender

Used by a client to get localized descriptive strings for an event.

Opnum: 9

EvtRpcMessageRenderDefault

Used by a client to get localized strings for common values of opcodes, tasks, or keywords, as specified in section 3.1.4.31.

Opnum: 10

EvtRpcQueryNext

Used by a client to get the next batch of records from a query result set.

Opnum: 11

EvtRpcQuerySeek

Used by a client to move a query cursor within a result set.

Opnum: 12

EvtRpcClose

Used by a client to close context handles opened by other methods in this protocol.

Opnum: 13

EvtRpcCancel

Used by a client to cancel another method.

Opnum: 14

EvtRpcAssertConfig

Indicates to the server that publisher or channel configuration has been updated.

Opnum: 15

EvtRpcRetractConfig

Indicates to the server that publisher or channel configuration should be removed.

Opnum: 16

EvtRpcOpenLogHandle

Used by a client to get information on a live or backup log.

Opnum: 17

EvtRpcGetLogFileInfo

Used by a client to get information on an event log.

Opnum: 18

EvtRpcGetChannelList

Used to enumerate the set of available channels.

Opnum: 19

EvtRpcGetChannelConfig

Used by a client to get the configuration for a channel.

Opnum: 20

EvtRpcPutChannelConfig

Used by a client to update the configuration for a live event log.

Opnum: 21

EvtRpcGetPublisherList

Used by a client to get the list of publishers.

Opnum: 22

EvtRpcGetPublisherListForChannel

Used by a client to get the list of publishers that write events to a particular live event log.

Opnum: 23

EvtRpcGetPublisherMetadata

Used by a client to open a handle to publisher metadata. It also gets some initial information from the metadata.

Opnum: 24

EvtRpcGetPublisherResourceMetadata

Used by a client to obtain information from the publisher metadata.

Opnum: 25

EvtRpcGetEventMetadataEnum

Used by a client to obtain a handle for enumerating a publisher's event metadata.

Opnum: 26

EvtRpcGetNextEventMetadata

Used by a client to get details on a particular possible event, and also returns the next event metadata in the enumeration.

Opnum: 27

EvtRpcGetClassicLogDisplayName

Used to obtain a descriptive name of a channel.

Opnum: 28

All methods MUST NOT throw exceptions. All return values use the NTSTATUS numbering space (as specified in [MS-ERREF] section 2.3) and, in particular, a value of 0x00000000 indicates success, and any other return value indicates an error. For a mapping of Windows NT status error codes to Win32 error codes, see [MSKB-113996]. All error values MUST<5> be treated the same, unless specified otherwise.

Within the sections that follow this one, methods are presented in the order typically implemented to accomplish the following operations:

  • Subscription

  • Queries

  • Log Maintenance

  • Configuration and Metadata

  • Message Rendering

  • Miscellaneous Operations

 
Show:
© 2014 Microsoft