3.1.4.32 EvtRpcMessageRenderDefault (Opnum 10)

The EvtRpcMessageRenderDefault (Opnum 10) method is used by a client to get localized strings for common values of opcodes, tasks, or keywords, as specified in section 3.1.4.31.

 error_status_t EvtRpcMessageRenderDefault(
   /* [in] RPC_BINDING_HANDLE binding, {the binding handle will be generated by MIDL} */
   [in, range(1, MAX_RPC_EVENT_ID_SIZE)] 
     DWORD sizeEventId,
   [in, size_is(sizeEventId)] BYTE *eventId,
   [in] DWORD messageId,
   [in] EvtRpcVariantList *values,
   [in] DWORD flags,
   [in] DWORD maxSizeString,
   [out] DWORD *actualSizeString,
   [out] DWORD *neededSizeString,
   [out, size_is(,*actualSizeString), range(0, MAX_RPC_RENDERED_STRING_SIZE)] 
     BYTE** string,
   [out] RpcInfo *error
 );

binding: An RPC binding handle as specified in section 2.2.21.

sizeEventId: A 32-bit unsigned integer that contains the size in bytes of the eventId field.

eventId: A pointer to an EVENT_DESCRIPTOR structure, as specified in [MS-DTYP] section 2.3.1.

messageId: A 32-bit unsigned integer that specifies the required message. This is an alternative to using the eventID parameter that can be used by a client application that has obtained the value through some method outside those documented by this protocol. The server MUST ignore this value unless the flags value is set to EvtFormatMessageId, in which case the server MUST use this value to determine the required message and ignore the eventID parameter.

values: An array of strings to be used as substitution values for event description strings. Substitution values MUST be ignored by the server except when the flags are set to either EvtFormatMessageEvent or EvtFormatMessageId.

flags: This field MUST be set to a value from the following table, which indicates the action that the server is requested to perform.

Value	Meaning
EvtFormatMessageEvent 0x00000001	Locate the message for the event corresponding to eventId, and then insert the values specified by the values parameter.
EvtFormatMessageLevel 0x00000002	Extract the level field from eventId, and then return the localized name for that level.
EvtFormatMessageTask 0x00000003	Extract the task field from eventId, and then return the localized name for that task.
EvtFormatMessageOpcode 0x00000004	Extract the opcode field from eventId, and then return the localized name for that opcode.
EvtFormatMessageKeyword 0x00000005	Extract the keyword field from eventId, and then return the localized name for that keyword.
EvtFormatMessageId 0x00000008	Locate the message for the event corresponding to the messageId parameter, and then insert the values specified by the values parameter.

maxSizeString: A 32-bit unsigned integer that contains the maximum size in bytes allowed for the string field.

actualSizeString: A pointer to a 32-bit unsigned integer that contains the actual size of the resulting description string returned in the string. It MUST be set to the size in bytes of the string returned in the string parameter, including the NULL ('\0') terminating character. If the description string cannot be retrieved, actualSizeString MUST be set to zero.

neededSizeString: A pointer to a 32-bit unsigned integer that contains the size in bytes of the fully instantiated description string, even if the length of the description string is greater than maxSizeString. The returned value MUST be zero when the description string cannot be computed by the server.

string: A buffer in which to return either a null-terminated string or multiple null-terminated strings, terminated by a double NULL in the case of keywords. In the case of failure, the client MUST ignore this value.

error:  A pointer to an RpcInfo (section 2.2.1) structure in which to place error information in the case of a failure. The RpcInfo (section 2.2.1) structure fields MUST be set to nonzero values if the error is related to loading the necessary resource. All nonzero values MUST be treated the same. If the method succeeds, the server MUST set all of the values in the structure to 0.

Return Values:  The method MUST return the following value on success.

ERROR_SUCCESS (0x00000000)

The method MUST return ERROR_INSUFFICIENT_BUFFER (0x0000007A) if maxSizeString is too small to hold the result string. In that case, neededSizeString MUST be set to the necessary size.

Otherwise, the method MUST return a different implementation-specific nonzero value as specified in [MS-ERREF].

This method is the same as the EvtRpcMessageRender (section 3.1.4.31) method, except that this method always uses the server's default strings (default strings come from the server's default publisher, so a publisher handle is not required), whereas the EvtRpcMessageRender (section 3.1.4.31) method uses only the default strings in the case of level, task, opcode, and keyword values that fall in certain ranges. Therefore it takes only 6 possible format flags. The server MUST fail the method with ERROR_INVALID_PARAMETER (0x00000057) for any other flags than the 6 values given in the flags table.