Export (0) Print
Expand All
Expand Minimize

3.1.4.26 EvtRpcGetPublisherResourceMetadata (Opnum 25)

The EvtRpcGetPublisherResourceMetadata (Opnum 25) method obtains information from the publisher metadata.

error_status_t EvtRpcGetPublisherResourceMetadata(
  [in, context_handle] PCONTEXT_HANDLE_PUBLISHER_METADATA handle,
  [in] DWORD propertyId,
  [in] DWORD flags,
  [out] EvtRpcVariantList* pubMetadataProps
);

handle: A handle to an event log. This handle is returned by the EvtRpcGetPublisherMetadata (Opnum 24) method. This parameter is an RPC context handle, as specified in [C706], Context Handles.

propertyId: Type of information as specified in the following table.

Value Meaning

0x00000004

Publisher help link.

0x00000005

Publisher friendly name.

0x0000000C

Level information.

0x00000010

Task information.

0x00000015

Opcode information.

0x00000019

Keyword information.

flags: A 32-bit unsigned integer that MUST be set to zero when sent and MAY be ignored on receipt.<47>

pubMetadataProps: Pointer to an EvtRpcVariantList (section 2.2.9) structure. This list MUST contain multiple entries.

Return Values: The method MUST return ERROR_SUCCESS (0x00000000) on success; otherwise, it MUST return an implementation-specific nonzero value as specified in [MS-ERREF].

In response to this request from the client, the server MUST first validate the handle. The server SHOULD save the context handle value that it creates in the EvtRpcGetPublisherMetadata method (as specified in section 3.1.4.25) in its handle table and compare it with the handle passed here to perform that check.<48> The server MUST return ERROR_INVALID_PARAMETER (0x00000057) if the handle is invalid.

The server MUST return an error if propertyID is anything other than 0x00000004, 0x00000005, 0x0000000C, 0x00000010, 0x00000015, or 0x00000019.

If all the above checks succeed, the server MUST attempt to return a list of properties for the publisher specified by the handle. If the publisher does not have metadata, this method SHOULD fail with the error ERROR_INVALID_DATA (0x0000000D).<49> Note that any one publisher which does have metadata may optionally specify only a subset of the metadata described herein. For example, not all publishers with metadata specify help links or keywords. For those cases, the server MUST return ERROR_SUCCESS (0x00000000) along with a complete EvtRpcVariantList having the corresponding entries set to EvtVarTypeNull.<50>

The EvtRpcVariantList (for more information, see section 2.2.9) MUST contain 29 EvtRpcVariants whenever this function returns success. As indicated below, not all of those EvtRpcVariant entries are used, and all unused entries MUST be set to EvtVarTypeNull.

The set of entries used depends on the value specified by the propertyID parameter. For the sake of brevity, the unused entries are not shown.

Note  The indexes referenced below are 0-based; for example, index 4 refers to the fifth variant that is returned in the EvtRpcVariantList.

When propertyID = 0x00000004, the following entries MUST be set in pubMetadataProps.

To do this, the server SHOULD get the helperlink string from the publisher resource file (as specified in section 3.1.1.14).

Index

Type

Description

4

EvtVarTypeString

HelpLink

When propertyID = 0x00000005, the following entries MUST be set in pubMetadataProps.

To do this, the server should get the messageId of the publisher name from the resource file (as specified in the section 3.1.1.14).

Index

Type

Description

5

EvtVarTypeUInt32

PublisherMessageID

When propertyID = 0x0000000C, the following entries MUST be set in pubMetadataProps.

To do this, the server SHOULD get all the levels' names, values, and messageId and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).

Index

Type

Description

13

EvtVarTypeStringArray

LevelName

14

EvtVarTypeUInt32Array

LevelValue

15

EvtVarTypeUInt32Array

LevelMessageID

When propertyID = 0x00000010, the following entries MUST be set in pubMetadataProps.

To do this, the server SHOULD get all the tasks' names, values, and messageIds and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).

Index

Type

Description

17

EvtVarTypeStringArray

TaskName

18

EvtVarTypeGuidArray

TaskEventGuid

19

EvtVarTypeUInt32Array

TaskValue

20

EvtVarTypeUInt32Array

TaskMessageID

When propertyID = 0x00000015, the following entries MUST be set in pubMetadataProps.

To do this, the server SHOULD get all the Opcodes' names, values, and messageIds and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).

Index

Type

Description

22

EvtVarTypeStringArray

OpcodeName

23

EvtVarTypeUInt32Array

OpcodeValue

24

EvtVarTypeUInt32Array

OpcodeMessageID

When propertyID = 0x00000019, the following entries MUST be set in pubMetadataProps.

To do this, the server SHOULD get all the Keywords' names, values, and messageIds and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).

Index

Type

Description

26

EvtVarTypeStringArray

KeywordName

27

EvtVarTypeUInt64Array

KeywordValue

28

EvtVarTypeUInt32Array

KeywordMessageID

The server MUST NOT update its state.

The server MUST return a value indicating success or failure for this operation.

 
Show:
© 2015 Microsoft