' ########################################################################################
' Microsoft Windows
' File: winevt.inc
' Contents: Windows Events API
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
#IF NOT %DEF(PBX_winevt_PBI)
#DEFINE PBX_winevt_PBI
%EQUATE `WINEVT_INC = 1
#INCLUDE ONCE "Core/Windows.inc"
'#if (WINVER >= _WIN32_WINNT_LONGHORN)
'typedef HANDLE EVT_HANDLE, *PEVT_HANDLE;
' enum EVT_VARIANT_TYPE
%EQUATE `EvtVarTypeNull = 0
%EQUATE `EvtVarTypeString = 1
%EQUATE `EvtVarTypeAnsiString = 2
%EQUATE `EvtVarTypeSByte = 3
%EQUATE `EvtVarTypeByte = 4
%EQUATE `EvtVarTypeInt16 = 5
%EQUATE `EvtVarTypeUInt16 = 6
%EQUATE `EvtVarTypeInt32 = 7
%EQUATE `EvtVarTypeUInt32 = 8
%EQUATE `EvtVarTypeInt64 = 9
%EQUATE `EvtVarTypeUInt64 = 10
%EQUATE `EvtVarTypeSingle = 11
%EQUATE `EvtVarTypeDouble = 12
%EQUATE `EvtVarTypeBoolean = 13
%EQUATE `EvtVarTypeBinary = 14
%EQUATE `EvtVarTypeGuid = 15
%EQUATE `EvtVarTypeSizeT = 16
%EQUATE `EvtVarTypeFileTime = 17
%EQUATE `EvtVarTypeSysTime = 18
%EQUATE `EvtVarTypeSid = 19
%EQUATE `EvtVarTypeHexInt32 = 20
%EQUATE `EvtVarTypeHexInt64 = 21
'// these types used internally
%EQUATE `EvtVarTypeEvtHandle = 32
%EQUATE `EvtVarTypeEvtXml = 35
%EQUATE `EVT_VARIANT_TYPE_MASK = &H7f
%EQUATE `EVT_VARIANT_TYPE_ARRAY = 128
' // Size = 8 bytes
UNION EVT_VARIANT_UNION
 BooleanVal AS LONG
 SByteVal AS BYTE ' INT8
 Int16Val AS INTEGER ' INT16
 Int32Val AS LONG ' INT32
 Int64Val AS QUAD ' INT64
 ByteVal AS BYTE ' UINT8
 UInt16Val AS WORD ' UINT16
 UInt32Val AS DWORD ' UINT32
 UInt64Val AS QUAD ' UINT64
 SingleVal AS SINGLE ' float
 DoubleVal AS DOUBLE ' double
 FileTimeVal AS QUAD ' ULONGLONG
 SysTimeVal AS SYSTEMTIME PTR ' SYSTEMTIME*
 GuidVal AS GUID PTR ' GUID*
 StringVal AS WSTRINGZ PTR
 AnsiStringVal AS ASCIIZ PTR
 BinaryVal AS BYTE PTR
 SidVal AS SID PTR
 SizeTVal AS DWORD ' size_t
 ' // array fields
 BooleanArr AS LONG PTR ' BOOL*
 SByteArr AS BYTE PTR ' INT8*
 Int16Arr AS INTEGER PTR ' INT16*
 Int32Arr AS LONG PTR ' INT32*
 Int64Arr AS QUAD PTR ' INT64*
 ByteArr AS BYTE PTR ' UINT8*
 UInt16Arr AS WORD PTR ' UINT16*
 UInt32Arr AS DWORD PTR ' UINT32*
 UInt64Arr AS QUAD PTR ' UINT64*
 SingleArr AS SINGLE PTR ' float*
 DoubleArr AS DOUBLE PTR ' double*
 FileTimeArr AS FILETIME PTR ' FILETIME*
 SysTimeArr AS SYSTEMTIME PTR ' SYSTEMTIME*
 GuidArr AS GUID PTR ' GUID*
 StringArr AS WSTRINGZ PTR ' LPWSTR*
 AnsiStringArr AS ASCIIZ PTR ' LPSTR*
 SidArr AS SID PTR ' PSID*
 SizeTArr AS DWORD PTR ' size_t*
 ' // internal fields
 EvtHandleVal AS DWORD ' EVT_HANDLE
 XmlVal AS WSTRINGZ PTR
 XmlValArr AS WSTRINGZ PTR ' LPCWSTR*
END UNION
' // Size = 16 bytes
TYPE EVT_VARIANT DWORD
 EVT_VARIANT_UNION
 Count AS DWORD ' DWORD // number of elements (not length) in bytes.
 Type AS DWORD
END TYPE
'////////////////////////////////////////////////////////////////////////////////
'//
'// Sessions
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_LOGIN_CLASS
%EQUATE `EvtRpcLogin = 1
' enum EVT_RPC_LOGIN_FLAGS
%EQUATE `EvtRpcLoginAuthDefault = 0
%EQUATE `EvtRpcLoginAuthNegotiate = 1
%EQUATE `EvtRpcLoginAuthKerberos = 2
%EQUATE `EvtRpcLoginAuthNTLM = 3
' // Size = 20 bytes
TYPE EVT_RPC_LOGIN DWORD
 ' // all str params are optional
 Server AS WSTRINGZ PTR
 User AS WSTRINGZ PTR
 Domain AS WSTRINGZ PTR
 Password AS WSTRINGZ PTR
 Flags AS DWORD ' DWORD // EVT_RPC_LOGIN_FLAGS
END TYPE
DECLARE FUNCTION EvtOpenSession LIB "wevtapi.dll" ALIAS "EvtOpenSession" ( BYVAL LoginClass AS LONG , BYREF Login AS ANY , BYVAL Timeout AS QUAD , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
'////////////////////////////////////////////////////////////////////////////////
'//
'// General Purpose Functions
'//
'////////////////////////////////////////////////////////////////////////////////
DECLARE FUNCTION EvtClose LIB "wevtapi.dll" ALIAS "EvtClose" ( BYVAL Object AS QUAD ) AS LONG
DECLARE FUNCTION EvtCancel LIB "wevtapi.dll" ALIAS "EvtCancel" ( BYVAL Object AS QUAD
 ) AS LONG
DECLARE FUNCTION EvtGetExtendedStatus LIB "wevtapi.dll" ALIAS "EvtGetExtendedStatus" ( BYVAL BufferSize AS DWORD
 , BYREF Buffer AS WSTRINGZ
 , BYREF BufferUsed AS DWORD
 ) AS DWORD
'////////////////////////////////////////////////////////////////////////////////
'//
'// Queries
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_QUERY_FLAGS
%EQUATE `EvtQueryChannelPath = &H1
%EQUATE `EvtQueryFilePath = &H2
%EQUATE `EvtQueryForwardDirection = &H100
%EQUATE `EvtQueryReverseDirection = &H200
%EQUATE `EvtQueryTolerateQueryErrors = &H1000
' enum EVT_SEEK_FLAGS
%EQUATE `EvtSeekRelativeToFirst = 1
%EQUATE `EvtSeekRelativeToLast = 2
%EQUATE `EvtSeekRelativeToCurrent = 3
%EQUATE `EvtSeekRelativeToBookmark = 4
%EQUATE `EvtSeekOriginMask = 7
%EQUATE `EvtSeekStrict = &H10000
DECLARE FUNCTION EvtQuery LIB "wevtapi.dll" ALIAS "EvtQuery" ( BYVAL Session AS QUAD , BYREF Path AS WSTRINGZ , BYREF Query AS WSTRINGZ , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtNext LIB "wevtapi.dll" ALIAS "EvtNext" ( BYVAL ResultSet AS QUAD , BYVAL EventsSize AS QUAD , BYVAL Events AS QUAD , BYVAL Timeout AS QUAD , BYVAL Flags AS QUAD , BYREF Returned AS QUAD ) AS LONG
DECLARE FUNCTION EvtSeek LIB "wevtapi.dll" ALIAS "EvtSeek" ( BYVAL ResultSet AS QUAD
 , BYVAL Position AS QUAD
 , BYVAL Bookmark AS DWORD
 , BYVAL Timeout AS DWORD
 , BYVAL Flags AS DWORD
 ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Subscriptions
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_SUBSCRIBE_FLAGS
%EQUATE `EvtSubscribeToFutureEvents = 1
%EQUATE `EvtSubscribeStartAtOldestRecord = 2
%EQUATE `EvtSubscribeStartAfterBookmark = 3
%EQUATE `EvtSubscribeOriginMask = 3
%EQUATE `EvtSubscribeTolerateQueryErrors = &H1000
%EQUATE `EvtSubscribeStrict = &H10000
' enum _EVT_SUBSCRIBE_NOTIFY_ACTION
%EQUATE `EvtSubscribeActionError = 0
%EQUATE `EvtSubscribeActionDeliver = 1
'typedef DWORD (WINAPI *EVT_SUBSCRIBE_CALLBACK)(
' EVT_SUBSCRIBE_NOTIFY_ACTION Action,
' PVOID UserContext,
' EVT_HANDLE Event );
'FUNCTION EVT_SUBSCRIBE_CALLBACK ( ' BYVAL Action AS EVT_SUBSCRIBE_NOTIFY_ACTION ' , BYVAL UserContext AS DWORD ' , BYVAL dwEvent AS DWORD ' ) AS DWORD
DECLARE FUNCTION EvtSubscribe LIB "wevtapi.dll" ALIAS "EvtSubscribe" ( BYVAL ResultSet AS QUAD , BYVAL SignalEvent AS QUAD , BYREF ChannelPath AS WSTRINGZ , BYREF Query AS WSTRINGZ , BYVAL Bookmark AS QUAD , BYVAL context AS QUAD , BYVAL Callback AS QUAD , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
'////////////////////////////////////////////////////////////////////////////////
'//
'// Rendering
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_SYSTEM_PROPERTY_ID
%EQUATE `EvtSystemProviderName = 0 ' // EvtVarTypeString
%EQUATE `EvtSystemProviderGuid = 1 ' // EvtVarTypeGuid
%EQUATE `EvtSystemEventID = 2 ' // EvtVarTypeUInt16
%EQUATE `EvtSystemQualifiers = 3 ' // EvtVarTypeUInt16
%EQUATE `EvtSystemLevel = 4 ' // EvtVarTypeUInt8
%EQUATE `EvtSystemTask = 5 ' // EvtVarTypeUInt16
%EQUATE `EvtSystemOpcode = 6 ' // EvtVarTypeUInt8
%EQUATE `EvtSystemKeywords = 7 ' // EvtVarTypeHexInt64
%EQUATE `EvtSystemTimeCreated = 8 ' // EvtVarTypeFileTime
%EQUATE `EvtSystemEventRecordId = 9 ' // EvtVarTypeUInt64
%EQUATE `EvtSystemActivityID = 10 ' // EvtVarTypeGuid
%EQUATE `EvtSystemRelatedActivityID = 11 ' // EvtVarTypeGuid
%EQUATE `EvtSystemProcessID = 12 ' // EvtVarTypeUInt32
%EQUATE `EvtSystemThreadID = 13 ' // EvtVarTypeUInt32
%EQUATE `EvtSystemChannel = 14 ' // EvtVarTypeString
%EQUATE `EvtSystemComputer = 15 ' // EvtVarTypeString
%EQUATE `EvtSystemUserID = 16 ' // EvtVarTypeSid
%EQUATE `EvtSystemVersion = 17 ' // EvtVarTypeUInt8
%EQUATE `EvtSystemPropertyIdEND = 18
' enum EVT_RENDER_CONTEXT_FLAGS
%EQUATE `EvtRenderContextValues = 0 ' // Render specific properties
%EQUATE `EvtRenderContextSystem = 1 ' // Render all system properties (System)
%EQUATE `EvtRenderContextUser = 2 ' // Render all user properties (User/EventData)
' enum EVT_RENDER_FLAGS
%EQUATE `EvtRenderEventValues = 0 ' // Variants
%EQUATE `EvtRenderEventXml = 1 ' // XML
%EQUATE `EvtRenderBookmark = 2 ' // Bookmark
DECLARE FUNCTION EvtCreateRenderContext LIB "wevtapi.dll" ALIAS "EvtCreateRenderContext" ( BYVAL ValuePathsCount AS QUAD , BYREF ValuePaths AS WSTRINGZ , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtRender LIB "wevtapi.dll" ALIAS "EvtRender" ( BYVAL Context AS QUAD , BYVAL Fragment AS QUAD , BYVAL Flags AS QUAD , BYVAL BufferSize AS QUAD , BYREF Buffer AS ANY , BYREF BufferUsed AS QUAD , BYREF PropertyCount AS QUAD ) AS LONG
' enum EVT_FORMAT_MESSAGE_FLAGS
%EQUATE `EvtFormatMessageEvent = 1
%EQUATE `EvtFormatMessageLevel = 2
%EQUATE `EvtFormatMessageTask = 3
%EQUATE `EvtFormatMessageOpcode = 4
%EQUATE `EvtFormatMessageKeyword = 5
%EQUATE `EvtFormatMessageChannel = 6
%EQUATE `EvtFormatMessageProvider = 7
%EQUATE `EvtFormatMessageId = 8
%EQUATE `EvtFormatMessageXml = 9
DECLARE FUNCTION EvtFormatMessage LIB "wevtapi.dll" ALIAS "EvtFormatMessage" ( BYVAL PublisherMetadata AS QUAD , BYVAL Event AS QUAD , BYVAL MessageId AS QUAD , BYVAL ValueCount AS QUAD , BYREF Values AS EVT_VARIANT , BYVAL Flags AS QUAD , BYVAL BufferSize AS QUAD , BYREF Buffer AS WSTRINGZ , BYREF BufferUsed AS QUAD ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Log Maintenace and Information
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_OPEN_LOG_FLAGS
%EQUATE `EvtOpenChannelPath = &H1
%EQUATE `EvtOpenFilePath = &H2
' enum EVT_LOG_PROPERTY_ID
%EQUATE `EvtLogCreationTime = 0 ' // EvtVarTypeFileTime
%EQUATE `EvtLogLastAccessTime = 1 ' // EvtVarTypeFileTime
%EQUATE `EvtLogLastWriteTime = 2 ' // EvtVarTypeFileTime
%EQUATE `EvtLogFileSize = 3 ' // EvtVarTypeUInt64
%EQUATE `EvtLogAttributes = 4 ' // EvtVarTypeUInt32
%EQUATE `EvtLogNumberOfLogRecords = 5 ' // EvtVarTypeUInt64
%EQUATE `EvtLogOldestRecordNumber = 6 ' // EvtVarTypeUInt64
%EQUATE `EvtLogFull = 7 ' // EvtVarTypeBoolean
DECLARE FUNCTION EvtOpenLog LIB "wevtapi.dll" ALIAS "EvtOpenLog" ( BYVAL Session AS QUAD , BYREF Path AS WSTRINGZ , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtGetLogInfo LIB "wevtapi.dll" ALIAS "EvtGetLogInfo" ( BYVAL Log AS QUAD , BYVAL PropertyId AS LONG , BYVAL PropertyValueBufferSize AS QUAD , BYREF PropertyValueBuffer AS EVT_VARIANT , BYREF PropertyValueBufferUsed AS QUAD ) AS LONG
DECLARE FUNCTION EvtClearLog LIB "wevtapi.dll" ALIAS "EvtClearLog" ( BYVAL Session AS QUAD
 , BYREF ChannelPath AS WSTRINGZ
 , BYREF TargetFilePath AS WSTRINGZ
 , BYVAL Flags AS DWORD
 ) AS LONG
' enum EVT_EXPORTLOG_FLAGS
%EQUATE `EvtExportLogChannelPath = &H1
%EQUATE `EvtExportLogFilePath = &H2
%EQUATE `EvtExportLogTolerateQueryErrors = &H1000
%EQUATE `EvtExportLogOverwrite = &H2000
DECLARE FUNCTION EvtExportLog LIB "wevtapi.dll" ALIAS "EvtExportLog" ( BYVAL Session AS QUAD , BYREF Path AS WSTRINGZ , BYREF Query AS WSTRINGZ , BYREF TargetFilePath AS WSTRINGZ , BYVAL Flags AS QUAD ) AS LONG
DECLARE FUNCTION EvtArchiveExportedLog LIB "wevtapi.dll" ALIAS "EvtArchiveExportedLog" ( BYVAL Session AS QUAD
 , BYREF LogFilePath AS WSTRINGZ
 , BYVAL Locale AS DWORD
 , BYVAL Flags AS DWORD
 ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Channel Configuration
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_CHANNEL_CONFIG_PROPERTY_ID
%EQUATE `EvtChannelConfigEnabled = 0 ' // EvtVarTypeBoolean
%EQUATE `EvtChannelConfigIsolation = 1 ' // EvtVarTypeUInt32, EVT_CHANNEL_ISOLATION_TYPE
%EQUATE `EvtChannelConfigType = 2 ' // EvtVarTypeUInt32, EVT_CHANNEL_TYPE
%EQUATE `EvtChannelConfigOwningPublisher = 3 ' // EvtVarTypeString
%EQUATE `EvtChannelConfigClassicEventlog = 4 ' // EvtVarTypeBoolean
%EQUATE `EvtChannelConfigAccess = 5 ' // EvtVarTypeString
%EQUATE `EvtChannelLoggingConfigRetention = 6 ' // EvtVarTypeBoolean
%EQUATE `EvtChannelLoggingConfigAutoBackup = 7 ' // EvtVarTypeBoolean
%EQUATE `EvtChannelLoggingConfigMaxSize = 8 ' // EvtVarTypeUInt64
%EQUATE `EvtChannelLoggingConfigLogFilePath = 9 ' // EvtVarTypeString
%EQUATE `EvtChannelPublishingConfigLevel = 10 ' // EvtVarTypeUInt32
%EQUATE `EvtChannelPublishingConfigKeywords = 11 ' // EvtVarTypeUInt64
%EQUATE `EvtChannelPublishingConfigControlGuid = 12 ' // EvtVarTypeGuid
%EQUATE `EvtChannelPublishingConfigBufferSize = 13 ' // EvtVarTypeUInt32
%EQUATE `EvtChannelPublishingConfigMinBuffers = 14 ' // EvtVarTypeUInt32
%EQUATE `EvtChannelPublishingConfigMaxBuffers = 15 ' // EvtVarTypeUInt32
%EQUATE `EvtChannelPublishingConfigLatency = 16 ' // EvtVarTypeUInt32
%EQUATE `EvtChannelPublishingConfigClockType = 17 ' // EvtVarTypeUInt32, EVT_CHANNEL_CLOCK_TYPE
%EQUATE `EvtChannelPublishingConfigSidType = 18 ' // EvtVarTypeUInt32, EVT_CHANNEL_SID_TYPE
%EQUATE `EvtChannelPublisherList = 19 ' // EvtVarTypeString | EVT_VARIANT_TYPE_ARRAY
%EQUATE `EvtChannelConfigPropertyIdEND = 20
' enum EVT_CHANNEL_TYPE
%EQUATE `EvtChannelTypeAdmin = 0
%EQUATE `EvtChannelTypeOperational = 1
%EQUATE `EvtChannelTypeAnalytic = 2
%EQUATE `EvtChannelTypeDebug = 3
' enum EVT_CHANNEL_ISOLATION_TYPE
%EQUATE `EvtChannelIsolationTypeApplication = 0
%EQUATE `EvtChannelIsolationTypeSystem = 1
%EQUATE `EvtChannelIsolationTypeCustom = 2
' enum EVT_CHANNEL_CLOCK_TYPE
%EQUATE `EvtChannelClockTypeSystemTime = 0 ' // System time
%EQUATE `EvtChannelClockTypeQPC = 1 ' // Query performance counter
' enum EVT_CHANNEL_SID_TYPE
%EQUATE `EvtChannelSidTypeNone = 0
%EQUATE `EvtChannelSidTypePublishing = 1
DECLARE FUNCTION EvtOpenChannelEnum LIB "wevtapi.dll" ALIAS "EvtOpenChannelEnum" ( BYVAL Session AS QUAD , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtNextChannelPath LIB "wevtapi.dll" ALIAS "EvtNextChannelPath" ( BYVAL ChannelEnum AS QUAD , BYVAL ChannelPathBufferSize AS QUAD , BYREF ChannelPathBuffer AS WSTRINGZ , BYREF ChannelPathBufferUsed AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtOpenChannelConfig LIB "wevtapi.dll" ALIAS "EvtOpenChannelConfig" ( BYVAL Session AS QUAD , BYREF ChannelPath AS WSTRINGZ , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtSaveChannelConfig LIB "wevtapi.dll" ALIAS "EvtSaveChannelConfig" ( BYVAL ChannelConfig AS QUAD , BYVAL Flags AS QUAD ) AS LONG
DECLARE FUNCTION EvtSetChannelConfigProperty LIB "wevtapi.dll" ALIAS "EvtSaveChannelConfig" ( BYVAL ChannelConfig AS QUAD
 , BYVAL PropertyId AS LONG
 , BYVAL Flags AS DWORD
 , BYREF PropertyValue AS EVT_VARIANT
 ) AS LONG
DECLARE FUNCTION EvtGetChannelConfigProperty LIB "wevtapi.dll" ALIAS "EvtGetChannelConfigProperty" ( BYVAL ChannelConfig AS DWORD
 , BYVAL PropertyId AS LONG
 , BYVAL Flags AS DWORD
 , BYVAL PropertyValueBufferSize AS DWORD
 , BYREF PropertyValueBuffer AS EVT_VARIANT
 , BYREF PropertyValueBufferUsed AS DWORD
 ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Publisher Metadata
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_CHANNEL_REFERENCE_FLAGS
%EQUATE `EvtChannelReferenceImported = &H1
' enum EVT_PUBLISHER_METADATA_PROPERTY_ID
%EQUATE `EvtPublisherMetadataPublisherGuid = 0 ' // EvtVarTypeGuid
%EQUATE `EvtPublisherMetadataResourceFilePath = 1 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataParameterFilePath = 2 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataMessageFilePath = 3 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataHelpLink = 4 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataPublisherMessageID = 5 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataChannelReferences = 6 ' // EvtVarTypeEvtHandle, ObjectArray
%EQUATE `EvtPublisherMetadataChannelReferencePath = 7 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataChannelReferenceIndex = 8 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataChannelReferenceID = 9 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataChannelReferenceFlags = 10 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataChannelReferenceMessageID = 11 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataLevels = 12 ' // EvtVarTypeEvtHandle, ObjectArray
%EQUATE `EvtPublisherMetadataLevelName = 13 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataLevelValue = 14 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataLevelMessageID = 15 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataTasks = 16 ' // EvtVarTypeEvtHandle, ObjectArray
%EQUATE `EvtPublisherMetadataTaskName = 17 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataTaskEventGuid = 18 ' // EvtVarTypeGuid
%EQUATE `EvtPublisherMetadataTaskValue = 19 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataTaskMessageID = 20 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataOpcodes = 21 ' // EvtVarTypeEvtHandle, ObjectArray
%EQUATE `EvtPublisherMetadataOpcodeName = 22 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataOpcodeValue = 23 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataOpcodeMessageID = 24 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataKeywords = 25 ' // EvtVarTypeEvtHandle, ObjectArray
%EQUATE `EvtPublisherMetadataKeywordName = 26 ' // EvtVarTypeString
%EQUATE `EvtPublisherMetadataKeywordValue = 27 ' // EvtVarTypeUInt64
%EQUATE `EvtPublisherMetadataKeywordMessageID = 28 ' // EvtVarTypeUInt32
%EQUATE `EvtPublisherMetadataPropertyIdEND = 29
DECLARE FUNCTION EvtOpenPublisherEnum LIB "wevtapi.dll" ALIAS "EvtOpenPublisherEnum" ( BYVAL Session AS QUAD , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtNextPublisherId LIB "wevtapi.dll" ALIAS "EvtNextPublisherId" ( BYVAL PublisherEnum AS QUAD , BYVAL PublisherIdBufferSize AS QUAD , BYREF PublisherIdBuffer AS WSTRINGZ , BYREF PublisherIdBufferUsed AS QUAD ) AS LONG
DECLARE FUNCTION EvtOpenPublisherMetadata LIB "wevtapi.dll" ALIAS "EvtOpenPublisherMetadata" ( BYVAL Session AS QUAD
 , BYVAL PublisherId AS DWORD
 , BYREF LogFilePath AS WSTRINGZ
 , BYVAL Locale AS DWORD
 , BYVAL Flags AS DWORD
 ) AS DWORD ' EVT_HANDLE
DECLARE FUNCTION EvtGetPublisherMetadataProperty LIB "wevtapi.dll" ALIAS "EvtGetPublisherMetadataProperty" ( BYVAL PublisherMetadata AS QUAD , BYVAL PropertyId AS LONG , BYVAL Flags AS QUAD , BYVAL PublisherMetadataPropertyBufferSize AS QUAD , BYREF PublisherMetadataPropertyBuffer AS EVT_VARIANT , BYREF PublisherMetadataPropertyBufferUsed AS QUAD ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Event Metadata Configuratin
'//
'////////////////////////////////////////////////////////////////////////////////
' enum EVT_EVENT_METADATA_PROPERTY_ID
%EQUATE `EventMetadataEventID = 0 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventVersion = 1 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventChannel = 2 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventLevel = 3 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventOpcode = 4 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventTask = 5 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventKeyword = 6 ' // EvtVarTypeUInt64
%EQUATE `EventMetadataEventMessageID = 7 ' // EvtVarTypeUInt32
%EQUATE `EventMetadataEventTemplate = 8 ' // EvtVarTypeString
%EQUATE `EvtEventMetadataPropertyIdEND = 9
DECLARE FUNCTION EvtOpenEventMetadataEnum LIB "wevtapi.dll" ALIAS "EvtOpenEventMetadataEnum" ( BYVAL PublisherMetadata AS QUAD , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtNextEventMetadata LIB "wevtapi.dll" ALIAS "EvtNextEventMetadata" ( BYVAL EventMetadataEnum AS QUAD , BYVAL Flags AS QUAD ) AS QUAD ' EVT_HANDLE
DECLARE FUNCTION EvtGetEventMetadataProperty LIB "wevtapi.dll" ALIAS "EvtGetEventMetadataProperty" ( BYVAL EventMetadata AS QUAD , BYVAL PropertyId AS LONG , BYVAL Flags AS QUAD , BYVAL EventMetadataPropertyBufferSize AS QUAD , BYREF EventMetadataPropertyBuffer AS EVT_VARIANT , BYREF EventMetadataPropertyBufferUsed AS QUAD ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Array Access
'//
'////////////////////////////////////////////////////////////////////////////////
'typedef HANDLE EVT_OBJECT_ARRAY_PROPERTY_HANDLE;
DECLARE FUNCTION EvtGetObjectArraySize LIB "wevtapi.dll" ALIAS "EvtGetObjectArraySize" ( BYVAL ObjectArray AS QUAD , BYREF ObjectArraySize AS QUAD ) AS LONG
DECLARE FUNCTION EvtGetObjectArrayProperty LIB "wevtapi.dll" ALIAS "EvtGetObjectArrayProperty" ( BYVAL ObjectArray AS QUAD
 , BYVAL PropertyId AS DWORD
 , BYVAL ArrayIndex AS DWORD
 , BYVAL Flags AS DWORD
 , BYVAL PropertyValueBufferSize AS DWORD
 , BYREF PropertyValueBuffer AS EVT_VARIANT
 , BYREF PropertyValueBufferUsed AS DWORD
 ) AS LONG
'/////////////////////////////////////////////////////////////////////////////
'//
'// Misc Event Consumer Functions
'//
'////////////////////////////////////////////////////////////////////////////
' enum EVT_QUERY_PROPERTY_ID
'//
'// list of channels or logfiles indentified in the query. Variant will be
'// array of EvtVarTypeString.
'//
%EQUATE `EvtQueryNames = 0
'//
'// Array of EvtVarTypeUInt32, indicating creation status ( Win32 error
'// code ) for the list of names returned by the EvtQueryNames
'// property.
'//
%EQUATE `EvtQueryStatuses = 1
%EQUATE `EvtQueryPropertyIdEND = 2
' enum EVT_EVENT_PROPERTY_ID
%EQUATE `EvtEventQueryIDs = 0
%EQUATE `EvtEventPath = 1
%EQUATE `EvtEventPropertyIdEND = 2
DECLARE FUNCTION EvtGetQueryInfo LIB "wevtapi.dll" ALIAS "EvtGetQueryInfo" ( BYVAL QueryOrSubscription AS QUAD , BYVAL PropertyId AS LONG , BYVAL PropertyValueBufferSize AS QUAD , BYREF PropertyValueBuffer AS EVT_VARIANT , BYREF PropertyValueBufferUsed AS QUAD ) AS LONG
DECLARE FUNCTION EvtCreateBookmark LIB "wevtapi.dll" ALIAS "EvtCreateBookmark" ( OPTIONAL BYREF BookmarkXml AS WSTRINGZ
 ) AS DWORD ' EVT_HANDLE
DECLARE FUNCTION EvtUpdateBookmark LIB "wevtapi.dll" ALIAS "EvtUpdateBookmark" ( BYVAL Bookmark AS QUAD , BYVAL Event AS QUAD ) AS LONG
DECLARE FUNCTION EvtGetEventInfo LIB "wevtapi.dll" ALIAS "EvtGetEventInfo" ( BYVAL Event AS QUAD
 , BYVAL PropertyId AS LONG
 , BYVAL PropertyValueBufferSize AS DWORD
 , BYREF PropertyValueBuffer AS EVT_VARIANT
 , BYREF PropertyValueBufferUsed AS DWORD
 ) AS LONG
'////////////////////////////////////////////////////////////////////////////////
'//
'// Access Control Permissions
'//
'////////////////////////////////////////////////////////////////////////////////
%EQUATE `EVT_READ_ACCESS = &H1
%EQUATE `EVT_WRITE_ACCESS = &H2
%EQUATE `EVT_CLEAR_ACCESS = &H4
%EQUATE `EVT_ALL_ACCESS = &H7
'#endif // WINVER >= _WIN32_WINNT_LONGHORN
#ENDIF
