C# Reader.EventLogHandle类代码示例

 internal EventLogRecord(EventLogHandle handle, EventLogSession session, ProviderMetadataCachedInformation cachedMetadataInfo) {
     this.cachedMetadataInformation = cachedMetadataInfo;
     this.handle = handle;
     this.session = session;
     systemProperties = new NativeWrapper.SystemProperties();
     syncObject = new object();
 }

 public EventLogSession(string server, string domain, string user, SecureString password, SessionAuthentication logOnType)
 {
     this.renderContextHandleSystem = EventLogHandle.Zero;
     this.renderContextHandleUser = EventLogHandle.Zero;
     this.handle = EventLogHandle.Zero;
     EventLogPermissionHolder.GetEventLogPermission().Demand();
     if (server == null)
     {
         server = "localhost";
     }
     this.syncObject = new object();
     this.server = server;
     this.domain = domain;
     this.user = user;
     this.logOnType = logOnType;
     Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin login = new Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin {
         Server = this.server,
         User = this.user,
         Domain = this.domain,
         Flags = (int) this.logOnType,
         Password = CoTaskMemUnicodeSafeHandle.Zero
     };
     try
     {
         if (password != null)
         {
             login.Password.SetMemory(Marshal.SecureStringToCoTaskMemUnicode(password));
         }
         this.handle = NativeWrapper.EvtOpenSession(Microsoft.Win32.UnsafeNativeMethods.EvtLoginClass.EvtRpcLogin, ref login, 0, 0);
     }
     finally
     {
         login.Password.Close();
     }
 }

 public static void EvtSeek(
                     EventLogHandle resultSet,
                     long position,
                     EventLogHandle bookmark,
                     int timeout,
                     UnsafeNativeMethods.EvtSeekFlags flags) {
     bool status = UnsafeNativeMethods.EvtSeek(resultSet, position, bookmark, timeout, flags);
     int win32Error = Marshal.GetLastWin32Error();
     if (!status)
         EventLogException.Throw(win32Error);
 }

 public EventLogConfiguration(string logName, EventLogSession session)
 {
     this.handle = EventLogHandle.Zero;
     EventLogPermissionHolder.GetEventLogPermission().Demand();
     if (session == null)
     {
         session = EventLogSession.GlobalSession;
     }
     this.session = session;
     this.channelName = logName;
     this.handle = NativeWrapper.EvtOpenChannelConfig(this.session.Handle, this.channelName, 0);
 }

 public static EventLogHandle EvtQuery(
                     EventLogHandle session,
                     string path,
                     string query,
                     int flags) {
     if (s_platformNotSupported)
         throw new System.PlatformNotSupportedException();
     EventLogHandle handle = UnsafeNativeMethods.EvtQuery(session, path, query, flags);
     int win32Error = Marshal.GetLastWin32Error();
     if (handle.IsInvalid)
         EventLogException.Throw(win32Error);
     return handle;
 }

 public string GetFormatDescription(string ProviderName, EventLogHandle eventHandle)
 {
     string str;
     lock (this)
     {
         ProviderMetadataId key = new ProviderMetadataId(ProviderName, CultureInfo.CurrentCulture);
         try
         {
             str = NativeWrapper.EvtFormatMessageRenderName(this.GetProviderMetadata(key).Handle, eventHandle, Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageEvent);
         }
         catch (EventLogNotFoundException)
         {
             str = null;
         }
     }
     return str;
 }

 public EventLogReader(EventLogQuery eventQuery, EventBookmark bookmark)
 {
     if (eventQuery == null)
     {
         throw new ArgumentNullException("eventQuery");
     }
     string logfile = null;
     if (eventQuery.ThePathType == PathType.FilePath)
     {
         logfile = eventQuery.Path;
     }
     this.cachedMetadataInformation = new ProviderMetadataCachedInformation(eventQuery.Session, logfile, 50);
     this.eventQuery = eventQuery;
     this.batchSize = 0x40;
     this.eventsBuffer = new IntPtr[this.batchSize];
     int flags = 0;
     if (this.eventQuery.ThePathType == PathType.LogName)
     {
         flags |= 1;
     }
     else
     {
         flags |= 2;
     }
     if (this.eventQuery.ReverseDirection)
     {
         flags |= 0x200;
     }
     if (this.eventQuery.TolerateQueryErrors)
     {
         flags |= 0x1000;
     }
     EventLogPermissionHolder.GetEventLogPermission().Demand();
     this.handle = NativeWrapper.EvtQuery(this.eventQuery.Session.Handle, this.eventQuery.Path, this.eventQuery.Query, flags);
     EventLogHandle bookmarkHandleFromBookmark = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark);
     if (!bookmarkHandleFromBookmark.IsInvalid)
     {
         using (bookmarkHandleFromBookmark)
         {
             NativeWrapper.EvtSeek(this.handle, 1L, bookmarkHandleFromBookmark, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark);
         }
     }
 }

 internal ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo, string logFilePath)
 {
     this.handle = EventLogHandle.Zero;
     this.defaultProviderHandle = EventLogHandle.Zero;
     EventLogPermissionHolder.GetEventLogPermission().Demand();
     if (targetCultureInfo == null)
     {
         targetCultureInfo = CultureInfo.CurrentCulture;
     }
     if (session == null)
     {
         session = EventLogSession.GlobalSession;
     }
     this.session = session;
     this.providerName = providerName;
     this.cultureInfo = targetCultureInfo;
     this.logFilePath = logFilePath;
     this.handle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, this.providerName, this.logFilePath, this.cultureInfo.LCID, 0);
     this.syncObject = new object();
 }

 public static string EvtFormatMessageRenderName(EventLogHandle pmHandle, EventLogHandle eventHandle, Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessageFlags flag)
 {
     int num;
     EventLogPermissionHolder.GetEventLogPermission().Demand();
     StringBuilder buffer = new StringBuilder(null);
     bool flag2 = Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, 0, buffer, out num);
     int errorCode = Marshal.GetLastWin32Error();
     if (!flag2 && (errorCode != 0x3ab5))
     {
         switch (errorCode)
         {
             case 0x3ab9:
             case 0x3afc:
             case 0x3ab3:
             case 0x3ab4:
             case 0x717:
                 return null;
         }
         if (errorCode != 0x7a)
         {
             EventLogException.Throw(errorCode);
         }
     }
     buffer.EnsureCapacity(num);
     flag2 = Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, num, buffer, out num);
     errorCode = Marshal.GetLastWin32Error();
     if (!flag2 && (errorCode != 0x3ab5))
     {
         switch (errorCode)
         {
             case 0x3ab9:
             case 0x3afc:
             case 0x3ab3:
             case 0x3ab4:
             case 0x717:
                 return null;
         }
         EventLogException.Throw(errorCode);
     }
     return buffer.ToString();
 }

        internal void StartSubscribing() {

            if (this.isSubscribing)
                throw new InvalidOperationException();

            int flag = 0;
            if (bookmark != null)
                flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAfterBookmark;
            else if (this.readExistingEvents)
                flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAtOldestRecord;
            else
                flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeToFutureEvents;

            if (this.eventQuery.TolerateQueryErrors)
                flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeTolerateQueryErrors;

            EventLogPermissionHolder.GetEventLogPermission().Demand();

            this.callbackThreadId = -1;
            this.unregisterDoneHandle = new AutoResetEvent(false);
            this.subscriptionWaitHandle = new AutoResetEvent(false);

            EventLogHandle bookmarkHandle = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark);

            using (bookmarkHandle) {

                handle = NativeWrapper.EvtSubscribe(this.eventQuery.Session.Handle,
                    this.subscriptionWaitHandle.SafeWaitHandle,
                    this.eventQuery.Path,
                    this.eventQuery.Query,
                    bookmarkHandle,
                    IntPtr.Zero,
                    IntPtr.Zero,
                    flag);
            }

            this.isSubscribing = true;

            RequestEvents();

            this.registeredWaitHandle = ThreadPool.RegisterWaitForSingleObject(
                this.subscriptionWaitHandle,
                new WaitOrTimerCallback(SubscribedEventsAvailableCallback),
                null,
                -1,
                false);          
        }

 internal void StartSubscribing()
 {
     if (this.isSubscribing)
     {
         throw new InvalidOperationException();
     }
     int flags = 0;
     if (this.bookmark != null)
     {
         flags |= 3;
     }
     else if (this.readExistingEvents)
     {
         flags |= 2;
     }
     else
     {
         flags |= 1;
     }
     if (this.eventQuery.TolerateQueryErrors)
     {
         flags |= 0x1000;
     }
     EventLogPermissionHolder.GetEventLogPermission().Demand();
     this.callbackThreadId = -1;
     this.unregisterDoneHandle = new AutoResetEvent(false);
     this.subscriptionWaitHandle = new AutoResetEvent(false);
     EventLogHandle bookmarkHandleFromBookmark = EventLogRecord.GetBookmarkHandleFromBookmark(this.bookmark);
     using (bookmarkHandleFromBookmark)
     {
         this.handle = NativeWrapper.EvtSubscribe(this.eventQuery.Session.Handle, this.subscriptionWaitHandle.SafeWaitHandle, this.eventQuery.Path, this.eventQuery.Query, bookmarkHandleFromBookmark, IntPtr.Zero, IntPtr.Zero, flags);
     }
     this.isSubscribing = true;
     this.RequestEvents();
     this.registeredWaitHandle = ThreadPool.RegisterWaitForSingleObject(this.subscriptionWaitHandle, new WaitOrTimerCallback(this.SubscribedEventsAvailableCallback), null, -1, false);
 }

 public static string EvtNextPublisherId(EventLogHandle handle, ref bool finish)
 {
     int num;
     StringBuilder publisherIdBuffer = new StringBuilder(null);
     bool flag = Microsoft.Win32.UnsafeNativeMethods.EvtNextPublisherId(handle, 0, publisherIdBuffer, out num);
     int errorCode = Marshal.GetLastWin32Error();
     if (!flag)
     {
         if (errorCode == 0x103)
         {
             finish = true;
             return null;
         }
         if (errorCode != 0x7a)
         {
             EventLogException.Throw(errorCode);
         }
     }
     publisherIdBuffer.EnsureCapacity(num);
     flag = Microsoft.Win32.UnsafeNativeMethods.EvtNextPublisherId(handle, num, publisherIdBuffer, out num);
     errorCode = Marshal.GetLastWin32Error();
     if (!flag)
     {
         EventLogException.Throw(errorCode);
     }
     return publisherIdBuffer.ToString();
 }

 public static EventLogHandle EvtNextEventMetadata(EventLogHandle eventMetadataEnum, int flags)
 {
     EventLogHandle handle = Microsoft.Win32.UnsafeNativeMethods.EvtNextEventMetadata(eventMetadataEnum, flags);
     int errorCode = Marshal.GetLastWin32Error();
     if (!handle.IsInvalid)
     {
         return handle;
     }
     if (errorCode != 0x103)
     {
         EventLogException.Throw(errorCode);
     }
     return null;
 }

 public static bool EvtNext(EventLogHandle queryHandle, int eventSize, IntPtr[] events, int timeout, int flags, ref int returned)
 {
     bool flag = Microsoft.Win32.UnsafeNativeMethods.EvtNext(queryHandle, eventSize, events, timeout, flags, ref returned);
     int errorCode = Marshal.GetLastWin32Error();
     if (!flag && (errorCode != 0x103))
     {
         EventLogException.Throw(errorCode);
     }
     return (errorCode == 0);
 }

 public static object EvtGetQueryInfo(EventLogHandle handle, Microsoft.Win32.UnsafeNativeMethods.EvtQueryPropertyId enumType)
 {
     object obj2;
     IntPtr zero = IntPtr.Zero;
     int bufferRequired = 0;
     try
     {
         bool flag = Microsoft.Win32.UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, 0, IntPtr.Zero, ref bufferRequired);
         int errorCode = Marshal.GetLastWin32Error();
         if (!flag && (errorCode != 0x7a))
         {
             EventLogException.Throw(errorCode);
         }
         zero = Marshal.AllocHGlobal(bufferRequired);
         flag = Microsoft.Win32.UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, bufferRequired, zero, ref bufferRequired);
         errorCode = Marshal.GetLastWin32Error();
         if (!flag)
         {
             EventLogException.Throw(errorCode);
         }
         Microsoft.Win32.UnsafeNativeMethods.EvtVariant val = (Microsoft.Win32.UnsafeNativeMethods.EvtVariant) Marshal.PtrToStructure(zero, typeof(Microsoft.Win32.UnsafeNativeMethods.EvtVariant));
         obj2 = ConvertToObject(val);
     }
     finally
     {
         if (zero != IntPtr.Zero)
         {
             Marshal.FreeHGlobal(zero);
         }
     }
     return obj2;
 }