3.1.4.6 ElfrRegisterEventSourceA (Opnum 15)

The ElfrRegisterEventSourceA (Opnum 15) method instructs the server to return a server context handle to an event log for writing. The caller MUST have permission to write to the file containing the event log for this to succeed. The module name argument specifies the event source, which is used to determine the relevant event log, as specified in the following sections.

 NTSTATUS ElfrRegisterEventSourceA(
   [in] EVENTLOG_HANDLE_A UNCServerName,
   [in] PRPC_STRING ModuleName,
   [in] PRPC_STRING RegModuleName,
   [in] unsigned long MajorVersion,
   [in] unsigned long MinorVersion,
   [out] IELF_HANDLE* LogHandle
 );

UNCServerName: A server interface handle. A pointer to an ANSI string (see [MSDN-ANSI]) specifying the server, as specified in section 2.2.7. The client MUST map this string to an RPC binding handle, and the server MUST ignore this argument, as specified in [C706] sections 4.3.5 and 5.1.5.2.

ModuleName: Specifies the event source, as defined in section 1.8.3 and specified in section 2.2.12, for which a handle is needed.

RegModuleName: This parameter MUST be ignored by the server. Clients MUST specify an empty string.

MajorVersion: Major version of the client. This value MUST be set to 1.

MinorVersion: Minor version of the client. This value MUST be set to 1.

LogHandle: Pointer to an event log handle. This parameter is a server context handle, as specified in section 2.2.6.

Return Values: The method MUST return STATUS_SUCCESS (0x00000000) on success; otherwise, it MUST return an implementation-based, nonzero NTSTATUS value specified in [MS-ERREF].

This is identical to the ElfrRegisterEventSourceW (section 3.1.4.5) method except that the ModuleName, RegModuleName, and the UNCServerName parameters are ANSI strings in this case.