CHANGE_LOG_ENTRY structure

[This information applies only to Windows XP with Service Pack 2 (SP2).]

A change log entry.

Syntax

typedef struct _CHANGE_LOG_ENTRY {
  RECORD_HEADER RecordHeader;
  DWORD         dwMagicNum;
  DWORD         dwEntryType;
  DWORD         dwEntryFlags;
  DWORD         dwAttributes;
  INT64         i64SequenceNum;
  WCHAR         szProcName[16];
} CHANGE_LOG_ENTRY, *PCHANGE_LOG_ENTRY;

Members

RecordHeader

A RECORD_HEADER structure. The dwRecordType member should be set to RecordTypeLogEntry (1).

dwMagicNum

This member should be set to 0xabcdef12.

dwEntryType

This member can be one of the following values:

CHANGE_LOG_ENTRYTYPES_ACLCHANGE (0x2)

CHANGE_LOG_ENTRYTYPES_ATTRCHANGE (0x4)

CHANGE_LOG_ENTRYTYPES_DIRCREATE (0x80)

CHANGE_LOG_ENTRYTYPES_DIRRENAME (0x100)

CHANGE_LOG_ENTRYTYPES_DIRDELETE (0x200)

CHANGE_LOG_ENTRYTYPES_FILECREATE (0x20)

CHANGE_LOG_ENTRYTYPES_FILEDELETE (0x10)

CHANGE_LOG_ENTRYTYPES_FILERENAME (0x40)

CHANGE_LOG_ENTRYTYPES_INPRECREATE (0x100000)

CHANGE_LOG_ENTRYTYPES_ISDIR (0x20000)

CHANGE_LOG_ENTRYTYPES_ISNOTDIR (0x40000)

CHANGE_LOG_ENTRYTYPES_MOUNTCREATE (0x400)

CHANGE_LOG_ENTRYTYPES_MOUNTDELETE (0x800)

CHANGE_LOG_ENTRYTYPES_NOOPTIMIZE (0x10000)

CHANGE_LOG_ENTRYTYPES_OPENBYID (0x200000)

CHANGE_LOG_ENTRYTYPES_SIMULATEDELETE (0x80000)

CHANGE_LOG_ENTRYTYPES_STREAMCHANGE (0x1)

CHANGE_LOG_ENTRYTYPES_STREAMCREATE (0x2000)

CHANGE_LOG_ENTRYTYPES_STREAMOVERWRITE (0x8)

CHANGE_LOG_ENTRYTYPES_VOLUMEERROR (0x1000)

dwEntryFlags

This member can be one of the following values:

CHANGE_LOG_ENTRYFLAGS_ACLINFO (0x4)

CHANGE_LOG_ENTRYFLAGS_DEBUGINFO (0x8)

CHANGE_LOG_ENTRYFLAGS_SECONDPATH (0x2)

CHANGE_LOG_ENTRYFLAGS_SHORTNAME (0x10)

CHANGE_LOG_ENTRYFLAGS_TEMPPATH (0x1)

dwAttributes

The file attributes of the change log file. If no attributes are specified, this value should be set to 0xFFFFFFFF.

i64SequenceNum

The sequence number assigned to the change log entry.

szProcName

The name of the process making the change.

Remarks

This structure is followed by a variable number of variable-length data records, plus a DWORD value that should be identical to the value of the dwRecordSize member of RecordHeader.

The variable-length data records consist of a RECORD_HEADER structure plus data that can be used to restore the change log entry. The format of the data depends on the value of the dwRecordType member of the RECORD_HEADER structure.

Requirements