4.13 Publisher Table and Channel Table Example

A publisher table is a list of publishers. The following example shows a publisher table with two entries.

 {0063715b-eeda-4007-9429-ad526f62696e}    -------------    Publisher ID
 "Microsoft-Windows-Services"                             ------  Publisher Name
     "%SystemRoot%\system32\services.exe"                 ------  Resource File
     "%SystemRoot%\system32\services.exe"                 ------  Message File
     "w                                                   ------ Parameter File(empty)
 Channels
     1   ----------  channel count
          0x10  --------- channel ID for the channel 1         
          0     --------- channel flags for the channel 1
          0     --------- channel start index for the channel 1
          "Microsoft-Windows-Services/Operational"  --------  channel name for channel 1
  
 {134ea407-755d-4a93-b8a6-f290cd155023}        -------------    Publisher ID
 "Microsoft-Windows-HomeGroup-ControlPanel"    ------  Publisher Name
     "%SystemRoot%\system32\hgcpl.dll"         ------  Resource File
     "%SystemRoot%\system32\hgcpl.dll"         ------  Message File
     ""                                        ------ Parameter File(empty)
 Channels
     2   ----------  channel count
          0x10  --------- channel ID for the channel 1
          0     --------- channel flags for the channel 1
          0     --------- channel start index for the channel 1
          "Microsoft-Windows-HomeGroup-ControlPanel/operational" ---- channel name for channel 1
     0x11  --------- channel ID for the channel 2
          0     --------- channel flags for the channel 2
          0     --------- channel start index for the channel 2
          "Microsoft-Windows-HomeGroup-ControlPanel/admin"   ---- channel name for channel 2
  
  

A channel table is a list of registered channels on the server. The following example shows a channel table with one channel entry:

 ForwardedEvents             ----  Name of the channel
 Enabled: 0
 Isolation: 2
 Type: 1
 OwningPublisher: {b977cf02-76f6-df84-cc1a-6a4b232322b6}
 Classic: 0
 Access:    O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)
 Retention: 0
 Autobackup: 0
 MaxSize: 0x01400000
 FilePath: "%SystemRoot%\system32\winevt\logs\forwardedevents.evtx"
 Level:    0x0000FFFF
 Keywords: 0xFFFFFFFFFFFFFFFF
 ControlGuid: {00000000-0000-0000-0000-000000000000}
 BufferSize: 0x000000000000FFFF
 MinBuffers: 4
 MaxBuffers: 10
 Latency: 1
 ClockType: 0
 SIDType: 1
 FileMax: 16
  

Note The list of the publishers is not in the channel table entry because the channel table entry is built at runtime using the publisher table and the channel name.