3.1.4.22 ElfrDeregisterEventSource (Opnum 3)

  • Article

The ElfrDeregisterEventSource (Opnum 3) method instructs the server to close a handle to the event log, freeing resources on the server that maintained an association between the handle and the corresponding event log. This handle MUST have been obtained via the ElfrRegisterEventSourceW (section 3.1.4.5) method or the ElfrRegisterEventSourceA (section 3.1.4.6) method.

 NTSTATUS ElfrDeregisterEventSource(
   [in, out] IELF_HANDLE* LogHandle
 );

LogHandle: Handle to an event log. This parameter is a server context handle, as specified in section 2.2.6.

Return Values: The method MUST return STATUS_SUCCESS (0x00000000) on success; otherwise, it MUST return an implementation-based, nonzero NTSTATUS value specified in [MS-ERREF].

In response to this request from the client, the server MUST first check that the handle is valid. The server MUST fail the operation with the error STATUS_INVALID_HANDLE (0xC0000008) if the handle is invalid. The server MUST treat a handle opened by the ElfrRegisterEventSourceW (section 3.1.4.5) method or the ElfrRegisterEventSourceA (section 3.1.4.6) method as valid. The server MAY add a flag to the handle returned by ElfrRegisterEventSourceW (section 3.1.4.5) or ElfrRegisterEventSourceA (section 3.1.4.6) and then use it to check if the handle that is passed in the ElfrDeregisterEventSource method has come from one of those two methods.<41>

If the handle is valid, the server MUST free the resources taken by this handle in the server.