Share via

3.2.4.7 IConfigurationDataCollector

  • Article

The IConfigurationDataCollector is used to collect computer settings.

The following properties MUST be implemented by the objects that implement the IConfigurationDataCollector interface.

Property

Read/write

Description

FileMaxCount

RW

Specifies the maximum number of files to collect. If set to zero or not set, there is no maximum. Any unsigned long is a valid value for this property.

FileMaxRecursiveDepth

RW

Specifies the maximum depth in a file system hierarchy that a recursive file collection MUST attempt. If set to zero, the maximum depth is 30. Any unsigned long is a valid value for this property.

FileMaxTotalSize

RW

Specifies the maximum size, in megabytes, of all files to collect. If set to zero or not set, there is no maximum size. Any unsigned long is a valid value for this property.

Files

RW

List of paths to files which will be copied to the output directory. Any arbitrary files can be specified. Absolute, relative, and UncPaths are supported. The '*' and '?' wildcards can be used, and collection can be made recursive by using two backslashes ("\\") for the last folder delimiter. If a specified file is not found, an error is added to the output file but collection continues.

ManagementQueries

RW

List of Windows Management Instrumentation (WMI) queries whose results MUST be collected. The syntax for specifying the queries is "namespace:WQL select statement". If a specified query cannot be executed, an error is added to the output file but collection continues. The format of ManagementQueries is specified in [MS-WMI] section 2.

QueryNetworkAdapters

RW

Specifies whether network adapter information MUST be queried. If set to TRUE, the installed network adapters are enumerated along with their IP addresses and offload capabilities.

When the client sets this property to VARIANT_TRUE, the server SHOULD retrieve the network adapter information and store it locally on the server. The PLA Protocol has no knowledge of what information is captured by the server and written to an XML file, and neither the contents of the XML file nor whether the server was successful in writing the XML file can be retrieved by the client using the PLA Protocol. Only the VARIANT_BOOL, which indicates whether the server MUST query for network adapter information, is transferred across the wire. If the client wants to read the network adapter information from the server, it needs to use other means or protocols. Whether the server queries for network adapter information, and what information it queries, has no impact on the behavior of the PLA Protocol. For more information about how VARIANT_BOOL types are transferred over the wire, please see [MS-OAUT].<18>

RegistryKeys

RW

List of registry keys to be collected. If a specified registry key cannot be queried, an error is added to the output file and collection continues. The PLA Protocol allows users to log registry keys to understand the configured status of a remote system. Registry keys are used to refer to state information that is stored on the system about an application, driver, or the system. For example, what default settings the user has saved for an application might be associated with a particular registry key; to retrieve that information, the registry key is specified. The format used for the registry keys is specified in [MS-RRP] section 3.1.1.1.

RegistryMaxRecursiveDepth

RW

 Specifies the maximum depth in the registry hierarchy that a recursive registry key collection MUST attempt. The maximum depth is relative to the depth of the starting key, not absolute. If this value is set to 0, or is not set, then registry keys at any depth will be collected. Any unsigned long is a valid value for this property.

SystemStateFile

RW

Specifies the name of the file where the system state will be saved. The system state is a set of kernel events generated by taking a snapshot of the Circular Kernel Context Logger. The events of the Circular Kernel Context Logger include process events, thread events, disk operations, and other kernel information that provide an indication of what action the operating system was performing when the event was raised. Events for the Circular Kernel Context Logger remain in the operating system memory and are only written to file when a snapshot is taken of the Circular Kernel Context Logger. This property indicates the name of the file to which the contents of the Circular Kernel Context Logger will be written; the file will reside on the local system. The file name needs to be a file name only and cannot include the path to the file.

A data collector can be represented as an XML file, which can be used to serialize (using Xml (Get) 3.2.4.5.21) and deserialize (using SetXml 3.2.4.5.22)it (the full XML specification is available in section 3.2.4.19). The format of the XML that defines a configuration data collector is as follows: 

 <ConfigurationDataCollector>
   <!-- elements for DataCollectorType -->
   <Files/>
  <FileMaxCount/>  
     <FileMaxRecursiveDepth/>  
     <FileMaxTotalSize/>  
  <Name/> 
  <ManagementQuery/>    
   <QueryNetworkAdapters/>   
   <RegistryKey/>   
   <SystemStateFile/>
 </ConfigurationDataCollector>  
  
 

Note that the example does not show the property elements inherited from IDataCollector that the caller also needs to specify.

Methods in RPC Opnum Order

Method

Description

FileMaxCount (Get)

Retrieves the FileMaxCount property.

Opnum: 32

FileMaxCount (Put)

Sets the FileMaxCount property.

Opnum: 33

FileMaxRecursiveDepth (Get)

Retrieves the FileMaxRecursiveDepth property.

Opnum: 34

FileMaxRecursiveDepth (Put)

Sets the FileMaxRecursiveDepth property.

Opnum: 35

FileMaxTotalSize (Get)

Retrieves the FileMaxTotalSize property.

Opnum: 36

FileMaxTotalSize (Put)

Sets the FileMaxTotalSize property.

Opnum: 37

Files (Get)

Retrieves the Files property.

Opnum: 38

Files (Put)

Sets the Files property.

Opnum: 39

ManagementQueries (Get)

Sets the ManagementQueries property.

Opnum: 40

ManagementQueries (Put)

Retrieves the ManagementQueries property.

Opnum: 41

QueryNetworkAdapters (Get)

Retrieves the QueryNetworkAdapters property.

Opnum: 42

QueryNetworkAdapters (Put)

Sets the QueryNetworkAdapters property.

Opnum: 43

RegistryKeys (Get)

Retrieves the RegistryKeys property.

Opnum: 44

RegistryKeys (Put)

Sets the RegistryKeys property.

Opnum: 45

RegistryMaxRecursiveDepth (Get)

Retrieves the RegistryMaxRecursiveDepth property.

Opnum: 46

RegistryMaxRecursiveDepth (Put)

Sets the RegistryMaxRecursiveDepth property.

Opnum: 47

SystemStateFile (Get)

Retrieves the SystemStateFile property.

Opnum: 48

SystemStateFile (Put)

Sets the SystemStateFile property.

Opnum: 49

Opnums 0, 1, and 2 are reserved for the IUnknown interface. Opnums 3, 4, 5, and 6 are reserved for the IDispatch interface. Opnums 7–31 are used by IDataCollector.