3.1.4.26 EvtRpcGetPublisherResourceMetadata (Opnum 25)
The EvtRpcGetPublisherResourceMetadata (Opnum 25) method obtains information from the publisher metadata.
-
error_status_t EvtRpcGetPublisherResourceMetadata( [in, context_handle] PCONTEXT_HANDLE_PUBLISHER_METADATA handle, [in] DWORD propertyId, [in] DWORD flags, [out] EvtRpcVariantList* pubMetadataProps );
handle: A handle to an event log. This handle is returned by the EvtRpcGetPublisherMetadata (Opnum 24) method. This parameter is an RPC context handle, as specified in [C706], Context Handles.
propertyId: Type of information as specified in the following table.
-
Value
Meaning
0x00000004
Publisher help link.
0x00000005
Publisher friendly name.
0x0000000C
Level information.
0x00000010
Task information.
0x00000015
Opcode information.
0x00000019
Keyword information.
flags: A 32-bit unsigned integer that MUST be set to zero when sent and MAY be ignored on receipt.<50>
pubMetadataProps: Pointer to an EvtRpcVariantList (section 2.2.9) structure. This list MUST contain multiple entries.
Return Values: The method MUST return ERROR_SUCCESS (0x00000000) on success; otherwise, it MUST return an implementation-specific nonzero value as specified in [MS-ERREF].
In response to this request from the client, the server MUST first validate the handle. The server SHOULD save the context handle value that it creates in the EvtRpcGetPublisherMetadata method (as specified in section 3.1.4.25) in its handle table and compare it with the handle passed here to perform that check.<51> The server MUST return ERROR_INVALID_PARAMETER (0x00000057) if the handle is invalid.
The server MUST return an error if propertyID is anything other than 0x00000004, 0x00000005, 0x0000000C, 0x00000010, 0x00000015, or 0x00000019.
If all the above checks succeed, the server MUST attempt to return a list of properties for the publisher specified by the handle. If the publisher does not have metadata, this method SHOULD fail with the error ERROR_INVALID_DATA (0x0000000D).<52> Note that any one publisher that does have metadata can optionally specify only a subset of the metadata described herein. For example, not all publishers with metadata specify help links or keywords. For those cases, the server MUST return ERROR_SUCCESS (0x00000000) along with a complete EvtRpcVariantList having the corresponding entries set to EvtVarTypeNull.<53>
The EvtRpcVariantList (for more information, see section 2.2.9) MUST contain 29 EvtRpcVariants whenever this function returns success. As indicated below, not all of those EvtRpcVariant entries are used, and all unused entries MUST be set to EvtVarTypeNull.
The set of entries used depends on the value specified by the propertyID parameter. For the sake of brevity, the unused entries are not shown.
Note The indexes referenced below are 0-based; for example, index 4 refers to the fifth variant that is returned in the EvtRpcVariantList.
When propertyID = 0x00000004, the following entries MUST be set in pubMetadataProps.
To do this, the server SHOULD get the helperlink string from the publisher resource file (as specified in section 3.1.1.14).
|
Index |
Type |
Description |
|---|---|---|
|
4 |
EvtVarTypeString |
HelpLink |
When propertyID = 0x00000005, the following entries MUST be set in pubMetadataProps.
To do this, the server gets the messageId of the publisher name from the resource file (as specified in the section 3.1.1.14).
|
Index |
Type |
Description |
|---|---|---|
|
5 |
EvtVarTypeUInt32 |
PublisherMessageID |
When propertyID = 0x0000000C, the following entries MUST be set in pubMetadataProps.
To do this, the server SHOULD get all the levels' names, values, and messageId and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).
|
Index |
Type |
Description |
|---|---|---|
|
13 |
EvtVarTypeStringArray |
LevelName |
|
14 |
EvtVarTypeUInt32Array |
LevelValue |
|
15 |
EvtVarTypeUInt32Array |
LevelMessageID |
When propertyID = 0x00000010, the following entries MUST be set in pubMetadataProps.
To do this, the server SHOULD get all the tasks' names, values, and messageIds and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).
|
Index |
Type |
Description |
|---|---|---|
|
17 |
EvtVarTypeStringArray |
TaskName |
|
18 |
EvtVarTypeGuidArray |
TaskEventGuid |
|
19 |
EvtVarTypeUInt32Array |
TaskValue |
|
20 |
EvtVarTypeUInt32Array |
TaskMessageID |
When propertyID = 0x00000015, the following entries MUST be set in pubMetadataProps.
To do this, the server SHOULD get all the Opcodes' names, values, and messageIds and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).
|
Index |
Type |
Description |
|---|---|---|
|
22 |
EvtVarTypeStringArray |
OpcodeName |
|
23 |
EvtVarTypeUInt32Array |
OpcodeValue |
|
24 |
EvtVarTypeUInt32Array |
OpcodeMessageID |
When propertyID = 0x00000019, the following entries MUST be set in pubMetadataProps.
To do this, the server SHOULD get all the Keywords' names, values, and messageIds and pack them into the array from the publisher resource file (as specified in the section 3.1.1.14).
|
Index |
Type |
Description |
|---|---|---|
|
26 |
EvtVarTypeStringArray |
KeywordName |
|
27 |
EvtVarTypeUInt64Array |
KeywordValue |
|
28 |
EvtVarTypeUInt32Array |
KeywordMessageID |
The server MUST NOT update its state.
The server MUST return a value indicating success or failure for this operation.