3.1.4.10 ElfrClearELFA (Opnum 12)

  • Article

The ElfrClearELFA (Opnum 12) method instructs the server to clear an event log, and, optionally, to back up the event log before the clear operation takes place. 

 NTSTATUS ElfrClearELFA(
   [in] IELF_HANDLE LogHandle,
   [in, unique] PRPC_STRING BackupFileName
 );

LogHandle: Handle to the event log to be cleared. This parameter is a server context handle, as specified in section 2.2.6. This handle MUST NOT be one obtained via the ElfrOpenBELA (section 3.1.4.2) method or the ElfrOpenBELW (section 3.1.4.1) method.

BackupFileName: Provides an ANSI string (as specified in section 2.2.12) that points to an NT Object Path of a file (as specified in section 2.2.4.1), in which a current copy of the event log is to be placed. If this is NULL or empty, the server MUST NOT create a backup as part of this method.

Return Values: The method MUST return STATUS_SUCCESS (0x00000000) on success; otherwise, it MUST return an implementation-based, nonzero NTSTATUS value specified in [MS-ERREF].

The ElfrClearELFA and ElfrClearELFW (section 3.1.4.9) methods are identical in functionality. The difference between the two methods is that the ElfrClearELFA method specifies BackupFileName as an ANSI string. The ElfrClearELFW method specifies BackupFileName as a UNICODE string.