762 lines
20 KiB
C
762 lines
20 KiB
C
|
/*++
|
||
|
|
|
||
|
|
Copyright (c) 1992 Microsoft Corporation
|
||
|
|
|
||
|
|
Module Name:
|
||
|
|
|
||
|
|
pdhp.h
|
||
|
|
|
||
|
|
Abstract:
|
||
|
|
|
||
|
|
PDH private APIs. Converts WMI event trace data to perf counters
|
||
|
|
|
||
|
|
Author:
|
||
|
|
|
||
|
|
Melur Raghuraman (mraghu) 03-Oct-1997
|
||
|
|
|
||
|
|
Environment:
|
||
|
|
|
||
|
|
Revision History:
|
||
|
|
|
||
|
|
|
||
|
|
--*/
|
||
|
|
|
||
|
|
#ifndef __PDHP__
|
||
|
|
#define __PDHP__
|
||
|
|
|
||
|
|
#include <wchar.h>
|
||
|
|
#include <pdh.h>
|
||
|
|
|
||
|
|
#ifdef __cplusplus
|
||
|
|
extern "C" {
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/*****************************************************************************\
|
||
|
|
Private Pdh Section
|
||
|
|
\*****************************************************************************/
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _PDH_RELOG_INFO_A {
|
||
|
|
LPSTR strLog;
|
||
|
|
DWORD dwFileFormat;
|
||
|
|
DWORD dwFlags;
|
||
|
|
PDH_TIME_INFO TimeInfo;
|
||
|
|
FILETIME ftInterval;
|
||
|
|
ULONG Reserved1;
|
||
|
|
ULONG Reserved2;
|
||
|
|
} PDH_RELOG_INFO_A, *PPDH_RELOG_INFO_A;
|
||
|
|
|
||
|
|
typedef struct _PDH_RELOG_INFO_W {
|
||
|
|
LPWSTR strLog;
|
||
|
|
DWORD dwFileFormat;
|
||
|
|
DWORD dwFlags;
|
||
|
|
PDH_TIME_INFO TimeInfo;
|
||
|
|
FILETIME ftInterval;
|
||
|
|
ULONG Reserved1;
|
||
|
|
ULONG Reserved2;
|
||
|
|
} PDH_RELOG_INFO_W, *PPDH_RELOG_INFO_W;
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhRelogA(
|
||
|
|
HLOG hLogIn,
|
||
|
|
PPDH_RELOG_INFO_A pRelogInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhRelogW(
|
||
|
|
HLOG hLogIn,
|
||
|
|
PPDH_RELOG_INFO_W pRelogInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
#ifdef UNICODE
|
||
|
|
#define PdhRelog PdhRelogW
|
||
|
|
#define PDH_RELOG_INFO PDH_RELOG_INFO_W
|
||
|
|
#define PPDH_RELOG_INFO PPDH_RELOG_INFO_W
|
||
|
|
#else
|
||
|
|
#define PdhRelog PdhRelogA
|
||
|
|
#define PDH_RELOG_INFO PDH_RELOG_INFO_A
|
||
|
|
#define PPDH_RELOG_INFO PPDH_RELOG_INFO_A
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/*****************************************************************************\
|
||
|
|
Performance Logs and Alerts Section
|
||
|
|
\*****************************************************************************/
|
||
|
|
|
||
|
|
|
||
|
|
#ifdef UNICODE
|
||
|
|
#define PdhPlaStart PdhPlaStartW
|
||
|
|
#define PdhPlaStop PdhPlaStopW
|
||
|
|
#define PdhPlaSchedule PdhPlaScheduleW
|
||
|
|
#define PdhPlaCreate PdhPlaCreateW
|
||
|
|
#define PdhPlaDelete PdhPlaDeleteW
|
||
|
|
#define PdhPlaAddItem PdhPlaAddItemW
|
||
|
|
#define PdhPlaSetItemList PdhPlaSetItemListW
|
||
|
|
#define PdhPlaRemoveAllItems PdhPlaRemoveAllItemsW
|
||
|
|
#define PdhPlaGetInfo PdhPlaGetInfoW
|
||
|
|
#define PdhPlaSetInfo PdhPlaSetInfoW
|
||
|
|
#define PdhPlaSetRunAs PdhPlaSetRunAsW
|
||
|
|
#define PdhPlaEnumCollections PdhPlaEnumCollectionsW
|
||
|
|
#define PdhPlaValidateInfo PdhPlaValidateInfoW
|
||
|
|
#define PDH_PLA_INFO PDH_PLA_INFO_W
|
||
|
|
#define PPDH_PLA_INFO PPDH_PLA_INFO_W
|
||
|
|
#define PDH_PLA_ITEM PDH_PLA_ITEM_W
|
||
|
|
#define PPDH_PLA_ITEM PPDH_PLA_ITEM_W
|
||
|
|
#define PdhTranslate009Counter PdhTranslate009CounterW
|
||
|
|
#define PdhTranslateLocaleCounter PdhTranslateLocaleCounterW
|
||
|
|
#define PdhAdd009Counter PdhAdd009CounterW
|
||
|
|
#define PdhGetLogFileType PdhGetLogFileTypeW
|
||
|
|
#define PdhPlaGetLogFileName PdhPlaGetLogFileNameW
|
||
|
|
#define PdhPlaGetSchedule PdhPlaGetScheduleW
|
||
|
|
#define PdhiPlaFormatBlanks PdhiPlaFormatBlanksW
|
||
|
|
#else
|
||
|
|
#define PdhPlaStart PdhPlaStartA
|
||
|
|
#define PdhPlaStop PdhPlaStopA
|
||
|
|
#define PdhPlaSchedule PdhPlaScheduleW
|
||
|
|
#define PdhPlaCreate PdhPlaCreateA
|
||
|
|
#define PdhPlaDelete PdhPlaDeleteA
|
||
|
|
#define PdhPlaAddItem PdhPlaAddItemA
|
||
|
|
#define PdhPlaSetItemList PdhPlaSetItemListA
|
||
|
|
#define PdhPlaRemoveAllItems PdhPlaRemoveAllItemA
|
||
|
|
#define PdhPlaGetInfo PdhPlaGetInfoA
|
||
|
|
#define PdhPlaSetInfo PdhPlaSetInfoA
|
||
|
|
#define PdhPlaSetRunAs PdhPlaSetRunAsA
|
||
|
|
#define PdhPlaEnumCollections PdhPlaEnumCollectionsA
|
||
|
|
#define PdhPlaValidateInfo PdhPlaValidateInfoA
|
||
|
|
#define PDH_PLA_INFO PDH_PLA_INFO_A
|
||
|
|
#define PPDH_PLA_INFO PPDH_PLA_INFO_A
|
||
|
|
#define PDH_PLA_ITEM PDH_PLA_ITEM_A
|
||
|
|
#define PPDH_PLA_ITEM PPDH_PLA_ITEM_A
|
||
|
|
#define PdhTranslate009Counter PdhTranslate009CounterA
|
||
|
|
#define PdhTranslateLocaleCounter PdhTranslateLocaleCounterA
|
||
|
|
#define PdhAdd009Counter PdhAdd009CounterA
|
||
|
|
#define PdhGetLogFileType PdhGetLogFileTypeA
|
||
|
|
#define PdhPlaGetLogFileName PdhPlaGetLogFileNameA
|
||
|
|
#define PdhPlaGetSchedule PdhPlaGetScheduleA
|
||
|
|
#define PdhiPlaFormatBlanks PdhiPlaFormatBlanksA
|
||
|
|
#endif
|
||
|
|
|
||
|
|
// wDataType values
|
||
|
|
#define PLA_TT_DTYPE_DATETIME ((WORD)0x0001)
|
||
|
|
#define PLA_TT_DTYPE_UNITS ((WORD)0x0002)
|
||
|
|
|
||
|
|
// dwMode values
|
||
|
|
#define PLA_AUTO_MODE_NONE ((DWORD)0x00000000) // Manual
|
||
|
|
#define PLA_AUTO_MODE_SIZE ((DWORD)0x00000001) // Size
|
||
|
|
#define PLA_AUTO_MODE_AT ((DWORD)0x00000002) // Time
|
||
|
|
#define PLA_AUTO_MODE_AFTER ((DWORD)0x00000003) // Value & unit type
|
||
|
|
#define PLA_AUTO_MODE_CALENDAR ((DWORD)0x00000004) // Schedule Calender
|
||
|
|
|
||
|
|
// wTimeType values
|
||
|
|
#define PLA_TT_TTYPE_START ((WORD)0x0001)
|
||
|
|
#define PLA_TT_TTYPE_STOP ((WORD)0x0002)
|
||
|
|
#define PLA_TT_TTYPE_RESTART ((WORD)0x0003)
|
||
|
|
#define PLA_TT_TTYPE_SAMPLE ((WORD)0x0004)
|
||
|
|
#define PLA_TT_TTYPE_LAST_MODIFIED ((WORD)0x0005)
|
||
|
|
#define PLA_TT_TTYPE_CREATENEWFILE ((WORD)0x0006)
|
||
|
|
#define PLA_TT_TTYPE_REPEAT_SCHEDULE ((WORD)0x0007)
|
||
|
|
|
||
|
|
// dwUnitType values
|
||
|
|
#define PLA_TT_UTYPE_SECONDS ((DWORD)0x00000001)
|
||
|
|
#define PLA_TT_UTYPE_MINUTES ((DWORD)0x00000002)
|
||
|
|
#define PLA_TT_UTYPE_HOURS ((DWORD)0x00000003)
|
||
|
|
#define PLA_TT_UTYPE_DAYS ((DWORD)0x00000004)
|
||
|
|
#define PLA_TT_UTYPE_DAYSOFWEEK ((DWORD)0x00000005)
|
||
|
|
|
||
|
|
#pragma warning ( disable : 4201 )
|
||
|
|
|
||
|
|
typedef struct _PLA_TIME_INFO {
|
||
|
|
WORD wDataType;
|
||
|
|
WORD wTimeType;
|
||
|
|
DWORD dwAutoMode;
|
||
|
|
union {
|
||
|
|
LONGLONG llDateTime; // filetime stored as a LONGLONG
|
||
|
|
struct {
|
||
|
|
DWORD dwValue;
|
||
|
|
DWORD dwUnitType;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
} PLA_TIME_INFO, *PPLA_TIME_INFO;
|
||
|
|
|
||
|
|
typedef struct _PDH_PLA_ITEM_W {
|
||
|
|
DWORD dwType;
|
||
|
|
union {
|
||
|
|
LPWSTR strCounters;
|
||
|
|
struct {
|
||
|
|
LPWSTR strProviders;
|
||
|
|
LPWSTR strFlags;
|
||
|
|
LPWSTR strLevels;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
} PDH_PLA_ITEM_W, *PPDH_PLA_ITEM_W;
|
||
|
|
|
||
|
|
typedef struct _PDH_PLA_ITEM_A {
|
||
|
|
DWORD dwType;
|
||
|
|
union {
|
||
|
|
LPSTR strCounters;
|
||
|
|
struct {
|
||
|
|
LPSTR strProviders;
|
||
|
|
LPSTR strFlags;
|
||
|
|
LPSTR strLevels;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
} PDH_PLA_ITEM_A, *PPDH_PLA_ITEM_A;
|
||
|
|
|
||
|
|
#pragma warning ( default : 4201 )
|
||
|
|
|
||
|
|
// Generic Fields
|
||
|
|
#define PLA_INFO_FLAG_USER 0x00000001
|
||
|
|
#define PLA_INFO_FLAG_FORMAT 0x00000002
|
||
|
|
#define PLA_INFO_FLAG_MAXLOGSIZE 0x00000004
|
||
|
|
#define PLA_INFO_FLAG_RUNCOMMAND 0x00000008
|
||
|
|
#define PLA_INFO_FLAG_FILENAME 0x00000010
|
||
|
|
#define PLA_INFO_FLAG_AUTOFORMAT 0x00000020
|
||
|
|
#define PLA_INFO_FLAG_DATASTORE 0x00000040
|
||
|
|
#define PLA_INFO_FLAG_REPEAT 0x00000080
|
||
|
|
#define PLA_INFO_FLAG_STATUS 0x00000100
|
||
|
|
#define PLA_INFO_FLAG_TYPE 0x00000200
|
||
|
|
#define PLA_INFO_FLAG_BEGIN 0x00000400
|
||
|
|
#define PLA_INFO_FLAG_END 0x00000800
|
||
|
|
#define PLA_INFO_FLAG_CRTNEWFILE 0x00001000
|
||
|
|
#define PLA_INFO_FLAG_DEFAULTDIR 0x00002000
|
||
|
|
#define PLA_INFO_FLAG_SRLNUMBER 0x00004000
|
||
|
|
#define PLA_INFO_FLAG_SQLNAME 0x00008000
|
||
|
|
#define PLA_INFO_FLAG_ALL 0xFFFFFFFF
|
||
|
|
|
||
|
|
// Trace Fields
|
||
|
|
#define PLA_INFO_FLAG_BUFFERSIZE 0x00010000
|
||
|
|
#define PLA_INFO_FLAG_LOGGERNAME 0x00020000
|
||
|
|
#define PLA_INFO_FLAG_MODE 0x00040000
|
||
|
|
#define PLA_INFO_FLAG_MINBUFFERS 0x00080000
|
||
|
|
#define PLA_INFO_FLAG_MAXBUFFERS 0x00100000
|
||
|
|
#define PLA_INFO_FLAG_FLUSHTIMER 0x00200000
|
||
|
|
#define PLA_INFO_FLAG_PROVIDERS 0x00400000
|
||
|
|
#define PLA_INFO_FLAG_TRACE 0x00FFFFFF
|
||
|
|
|
||
|
|
// Performance Fields
|
||
|
|
#define PLA_INFO_FLAG_INTERVAL 0x01000000
|
||
|
|
#define PLA_INFO_FLAG_COUNTERS 0x02000000
|
||
|
|
#define PLA_INFO_FLAG_PERF 0xFF00FFFF
|
||
|
|
|
||
|
|
#define PLA_INFO_CREATE_FILENAME \
|
||
|
|
(PLA_INFO_FLAG_FORMAT| \
|
||
|
|
PLA_INFO_FLAG_FILENAME| \
|
||
|
|
PLA_INFO_FLAG_AUTOFORMAT| \
|
||
|
|
PLA_INFO_FLAG_TYPE| \
|
||
|
|
PLA_INFO_FLAG_CRTNEWFILE| \
|
||
|
|
PLA_INFO_FLAG_DEFAULTDIR| \
|
||
|
|
PLA_INFO_FLAG_SRLNUMBER| \
|
||
|
|
PLA_INFO_FLAG_SQLNAME| \
|
||
|
|
PLA_INFO_FLAG_STATUS ) \
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _PDH_PLA_INFO_W {
|
||
|
|
DWORD dwMask;
|
||
|
|
LPWSTR strUser;
|
||
|
|
LPWSTR strPassword;
|
||
|
|
DWORD dwType;
|
||
|
|
DWORD dwMaxLogSize;
|
||
|
|
DWORD dwFlags;
|
||
|
|
DWORD dwLogQuota;
|
||
|
|
LPWSTR strLogFileCaption;
|
||
|
|
LPWSTR strDefaultDir;
|
||
|
|
LPWSTR strBaseFileName;
|
||
|
|
LPWSTR strSqlName;
|
||
|
|
DWORD dwFileFormat;
|
||
|
|
DWORD dwAutoNameFormat;
|
||
|
|
DWORD dwLogFileSerialNumber;
|
||
|
|
LPWSTR strCommandFileName;
|
||
|
|
DWORD dwDatastoreAttributes;
|
||
|
|
PLA_TIME_INFO ptLogBeginTime;
|
||
|
|
PLA_TIME_INFO ptLogEndTime;
|
||
|
|
PLA_TIME_INFO ptCreateNewFile;
|
||
|
|
PLA_TIME_INFO ptRepeat;
|
||
|
|
DWORD dwStatus;
|
||
|
|
DWORD dwReserved1;
|
||
|
|
DWORD dwReserved2;
|
||
|
|
union {
|
||
|
|
struct {
|
||
|
|
PDH_PLA_ITEM_W piCounterList;
|
||
|
|
DWORD dwAutoNameInterval;
|
||
|
|
DWORD dwAutoNameUnits;
|
||
|
|
PLA_TIME_INFO ptSampleInterval;
|
||
|
|
} Perf;
|
||
|
|
struct {
|
||
|
|
PDH_PLA_ITEM_W piProviderList;
|
||
|
|
LPWSTR strLoggerName;
|
||
|
|
DWORD dwMode;
|
||
|
|
DWORD dwNumberOfBuffers;
|
||
|
|
DWORD dwMaximumBuffers;
|
||
|
|
DWORD dwMinimumBuffers;
|
||
|
|
DWORD dwBufferSize;
|
||
|
|
DWORD dwFlushTimer;
|
||
|
|
} Trace;
|
||
|
|
};
|
||
|
|
} PDH_PLA_INFO_W, *PPDH_PLA_INFO_W;
|
||
|
|
|
||
|
|
typedef struct _PDH_PLA_INFO_A {
|
||
|
|
DWORD dwMask;
|
||
|
|
// NOT YET IMPLEMENTED
|
||
|
|
} PDH_PLA_INFO_A, *PPDH_PLA_INFO_A;
|
||
|
|
|
||
|
|
typedef struct _PLA_VERSION_ {
|
||
|
|
DWORD dwMajorVersion;
|
||
|
|
DWORD dwMinorVersion;
|
||
|
|
DWORD dwBuild;
|
||
|
|
DWORD dwSubBuild;
|
||
|
|
} PLA_VERSION, *PPLA_VERSION;
|
||
|
|
|
||
|
|
HRESULT
|
||
|
|
PdhiPlaFormatBlanksA(
|
||
|
|
LPSTR strComputer,
|
||
|
|
LPSTR strFormat
|
||
|
|
);
|
||
|
|
|
||
|
|
HRESULT
|
||
|
|
PdhiPlaFormatBlanksW(
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPWSTR strFormat
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaGetScheduleA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
LPDWORD pdwTypeStart,
|
||
|
|
LPDWORD pdwTypeStop,
|
||
|
|
PPDH_TIME_INFO pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaGetScheduleW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPDWORD pdwTypeStart,
|
||
|
|
LPDWORD pdwTypeStop,
|
||
|
|
PPDH_TIME_INFO pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PlaTimeInfoToMilliSeconds(
|
||
|
|
PLA_TIME_INFO* pTimeInfo,
|
||
|
|
LONGLONG* pllmsecs
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaValidateInfoA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_A pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaValidateInfoW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_W pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetRunAsA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
LPSTR strUser,
|
||
|
|
LPSTR strPassword
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetRunAsW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPWSTR strUser,
|
||
|
|
LPWSTR strPassword
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaScheduleA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
DWORD fType,
|
||
|
|
PPDH_TIME_INFO pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaScheduleW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
DWORD fType,
|
||
|
|
PPDH_TIME_INFO pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaStartA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaStartW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaStopA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaStopW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaCreateA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_A pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaCreateW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_W pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaDeleteA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaDeleteW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaAddItemA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
PPDH_PLA_ITEM_A pItem
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaAddItemW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_ITEM_W pItem
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetItemListA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
PPDH_PLA_ITEM_A pItems
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetItemListW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_ITEM_W pItems
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaRemoveAllItemsA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaRemoveAllItemsW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaGetInfoA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
LPDWORD pdwBufferSize,
|
||
|
|
PPDH_PLA_INFO_A pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaGetInfoW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPDWORD pdwBufferSize,
|
||
|
|
PPDH_PLA_INFO_W pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetInfoA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_A pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetInfoW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_W pInfo
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetRunAsA(
|
||
|
|
LPSTR strName,
|
||
|
|
LPSTR strComputer,
|
||
|
|
LPSTR strUser,
|
||
|
|
LPSTR strPassword
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaSetRunAsW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPWSTR strUser,
|
||
|
|
LPWSTR strPassword
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhiPlaSetRunAs(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPWSTR strUser,
|
||
|
|
LPWSTR strPassword
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhiPlaRunAs(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
HANDLE* hToken
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhiPlaGetVersion(
|
||
|
|
LPCWSTR strComputer,
|
||
|
|
PPLA_VERSION pVersion
|
||
|
|
);
|
||
|
|
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaEnumCollectionsA(
|
||
|
|
LPSTR strComputer,
|
||
|
|
LPDWORD pdwBufferSize,
|
||
|
|
LPSTR mszCollections
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaEnumCollectionsW(
|
||
|
|
LPWSTR strComputer,
|
||
|
|
LPDWORD pdwBufferSize,
|
||
|
|
LPWSTR mszCollections
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaGetLogFileNameA(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_A pInfo,
|
||
|
|
DWORD dwFlags,
|
||
|
|
LPDWORD pdwBufferSize,
|
||
|
|
LPWSTR strFileName
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhPlaGetLogFileNameW(
|
||
|
|
LPWSTR strName,
|
||
|
|
LPWSTR strComputer,
|
||
|
|
PPDH_PLA_INFO_W pInfo,
|
||
|
|
DWORD dwFlags,
|
||
|
|
LPDWORD pdwBufferSize,
|
||
|
|
LPWSTR strFileName
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhTranslate009CounterW(
|
||
|
|
IN LPWSTR szLocalePath,
|
||
|
|
IN LPWSTR pszFullPathName,
|
||
|
|
IN LPDWORD pcchPathLength);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhTranslate009CounterA(
|
||
|
|
IN LPSTR szLocalePath,
|
||
|
|
IN LPSTR pszFullPathName,
|
||
|
|
IN LPDWORD pcchPathLength);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhTranslateLocaleCounterW(
|
||
|
|
IN LPWSTR sz009Path,
|
||
|
|
IN LPWSTR pszFullPathName,
|
||
|
|
IN LPDWORD pcchPathLength);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhTranslateLocaleCounterA(
|
||
|
|
IN LPSTR sz009Path,
|
||
|
|
IN LPSTR pszFullPathName,
|
||
|
|
IN LPDWORD pcchPathLength);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhAdd009CounterW(
|
||
|
|
IN HQUERY hQuery,
|
||
|
|
IN LPWSTR szFullPath,
|
||
|
|
IN DWORD_PTR dwUserData,
|
||
|
|
OUT HCOUNTER * phCounter);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhAdd009CounterA(
|
||
|
|
IN HQUERY hQuery,
|
||
|
|
IN LPSTR szFullPath,
|
||
|
|
IN DWORD_PTR dwUserData,
|
||
|
|
OUT HCOUNTER * phCounter);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhGetLogFileTypeW(
|
||
|
|
IN LPCWSTR LogFileName,
|
||
|
|
IN LPDWORD LogFileType);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhGetLogFileTypeA(
|
||
|
|
IN LPCSTR LogFileName,
|
||
|
|
IN LPDWORD LogFileType);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhListLogFileHeaderW (
|
||
|
|
IN LPCWSTR szFileName,
|
||
|
|
IN LPWSTR mszHeaderList,
|
||
|
|
IN LPDWORD pcchHeaderListSize
|
||
|
|
);
|
||
|
|
|
||
|
|
PDH_FUNCTION
|
||
|
|
PdhListLogFileHeaderA (
|
||
|
|
IN LPCSTR szFileName,
|
||
|
|
IN LPSTR mszHeaderList,
|
||
|
|
IN LPDWORD pcchHeaderListSize
|
||
|
|
);
|
||
|
|
|
||
|
|
#define PLA_SECONDS_IN_DAY 86400
|
||
|
|
#define PLA_SECONDS_IN_HOUR 3600
|
||
|
|
#define PLA_SECONDS_IN_MINUTE 60
|
||
|
|
#define _PLA_CONFIG_DLL_NAME_W_ L"SmLogCfg.dll"
|
||
|
|
#define _PLA_SERVICE_EXE_NAME_W_ L"SmLogSvc.exe"
|
||
|
|
|
||
|
|
// Communication between smlogcfg and smlogsvc
|
||
|
|
|
||
|
|
#define PLA_MAX_AUTO_NAME_LEN ((DWORD)0x0000000B)
|
||
|
|
#define PLA_MAX_COLLECTION_NAME ((DWORD)(_MAX_FNAME - PLA_MAX_AUTO_NAME_LEN - 1))
|
||
|
|
|
||
|
|
#define PLA_FILENAME_USE_SUBEXT 0x00000001
|
||
|
|
#define PLA_FILENAME_GET_SUBFMT 0x00000002
|
||
|
|
#define PLA_FILENAME_GET_SUBXXX 0x00000004
|
||
|
|
#define PLA_FILENAME_CREATEONLY 0x00000008
|
||
|
|
#define PLA_FILENAME_CURRENTLOG 0x00000010
|
||
|
|
|
||
|
|
#define PLA_SERVICE_CONTROL_SYNCHRONIZE 128
|
||
|
|
#define PLA_QUERY_STOPPED ((DWORD)0x00000000)
|
||
|
|
#define PLA_QUERY_RUNNING ((DWORD)0x00000001)
|
||
|
|
#define PLA_QUERY_START_PENDING ((DWORD)0x00000002)
|
||
|
|
|
||
|
|
#define PLA_NEW_LOG ((DWORD)0xFFFFFFFF)
|
||
|
|
#define PLA_FIRST_LOG_TYPE ((DWORD)0x00000000)
|
||
|
|
#define PLA_COUNTER_LOG ((DWORD)0x00000000)
|
||
|
|
#define PLA_TRACE_LOG ((DWORD)0x00000001)
|
||
|
|
#define PLA_ALERT ((DWORD)0x00000002)
|
||
|
|
#define PLA_LAST_LOG_TYPE ((DWORD)0x00000002)
|
||
|
|
#define PLA_NUM_LOG_TYPES ((DWORD)0x00000003)
|
||
|
|
|
||
|
|
// Sysmon log output file configuration definitions
|
||
|
|
|
||
|
|
#define PLA_DATASTORE_APPEND_MASK ((DWORD)0x000000F)
|
||
|
|
#define PLA_DATASTORE_OVERWRITE ((DWORD)0x0000001)
|
||
|
|
#define PLA_DATASTORE_APPEND ((DWORD)0x0000002)
|
||
|
|
|
||
|
|
#define PLA_DATASTORE_SIZE_MASK ((DWORD)0x00000F0)
|
||
|
|
#define PLA_DATASTORE_SIZE_ONE_RECORD ((DWORD)0x0000010)
|
||
|
|
#define PLA_DATASTORE_SIZE_KB ((DWORD)0x0000020)
|
||
|
|
#define PLA_DATASTORE_SIZE_MB ((DWORD)0x0000040)
|
||
|
|
|
||
|
|
#define PLA_FIRST_FILE_TYPE ((DWORD)0x00000000)
|
||
|
|
#define PLA_CSV_FILE ((DWORD)0x00000000)
|
||
|
|
#define PLA_TSV_FILE ((DWORD)0x00000001)
|
||
|
|
#define PLA_BIN_FILE ((DWORD)0x00000002)
|
||
|
|
#define PLA_BIN_CIRC_FILE ((DWORD)0x00000003)
|
||
|
|
#define PLA_CIRC_TRACE_FILE ((DWORD)0x00000004)
|
||
|
|
#define PLA_SEQ_TRACE_FILE ((DWORD)0x00000005)
|
||
|
|
#define PLA_SQL_LOG ((DWORD)0x00000006)
|
||
|
|
#define PLA_NUM_FILE_TYPES ((DWORD)0x00000007)
|
||
|
|
|
||
|
|
#define PLA_SLF_NAME_NONE ((DWORD)0xFFFFFFFF)
|
||
|
|
#define PLA_SLF_NAME_FIRST_AUTO ((DWORD)0x00000000)
|
||
|
|
#define PLA_SLF_NAME_MMDDHH ((DWORD)0x00000000)
|
||
|
|
#define PLA_SLF_NAME_NNNNNN ((DWORD)0x00000001)
|
||
|
|
#define PLA_SLF_NAME_YYYYDDD ((DWORD)0x00000002)
|
||
|
|
#define PLA_SLF_NAME_YYYYMM ((DWORD)0x00000003)
|
||
|
|
#define PLA_SLF_NAME_YYYYMMDD ((DWORD)0x00000004)
|
||
|
|
#define PLA_SLF_NAME_YYYYMMDDHH ((DWORD)0x00000005)
|
||
|
|
#define PLA_SLF_NAME_MMDDHHMM ((DWORD)0x00000006)
|
||
|
|
#define PLA_SLF_NUM_AUTO_NAME_TYPES ((DWORD)0x00000007)
|
||
|
|
|
||
|
|
// Sysmon log query types and constants
|
||
|
|
|
||
|
|
// Constants
|
||
|
|
#define PLA_DISK_MAX_SIZE ((DWORD)-1)
|
||
|
|
|
||
|
|
#define PLA_LOG_SIZE_UNIT_MB (1024*1024)
|
||
|
|
#define PLA_LOG_SIZE_UNIT_KB 1024
|
||
|
|
|
||
|
|
#define PLA_TLI_ENABLE_BUFFER_FLUSH ((DWORD)0x00000001)
|
||
|
|
#define PLA_TLI_ENABLE_KERNEL_TRACE ((DWORD)0x00000002)
|
||
|
|
#define PLA_TLI_ENABLE_MEMMAN_TRACE ((DWORD)0x00000004)
|
||
|
|
#define PLA_TLI_ENABLE_FILEIO_TRACE ((DWORD)0x00000008)
|
||
|
|
#define PLA_TLI_ENABLE_PROCESS_TRACE ((DWORD)0x00000010)
|
||
|
|
#define PLA_TLI_ENABLE_THREAD_TRACE ((DWORD)0x00000020)
|
||
|
|
#define PLA_TLI_ENABLE_DISKIO_TRACE ((DWORD)0x00000040)
|
||
|
|
#define PLA_TLI_ENABLE_NETWORK_TCPIP_TRACE ((DWORD)0x00000080)
|
||
|
|
|
||
|
|
#define PLA_TLI_ENABLE_MASK ((DWORD)0x000000FF)
|
||
|
|
#define PLA_TLI_ENABLE_KERNEL_MASK ((DWORD)0x000000FE)
|
||
|
|
|
||
|
|
// alert action flags
|
||
|
|
#define PLA_ALRT_ACTION_LOG_EVENT ((DWORD)0x00000001)
|
||
|
|
#define PLA_ALRT_ACTION_SEND_MSG ((DWORD)0x00000002)
|
||
|
|
#define PLA_ALRT_ACTION_EXEC_CMD ((DWORD)0x00000004)
|
||
|
|
#define PLA_ALRT_ACTION_START_LOG ((DWORD)0x00000008)
|
||
|
|
#define PLA_ALRT_ACTION_MASK ((DWORD)0x0000000F)
|
||
|
|
|
||
|
|
#define PLA_ALRT_CMD_LINE_SINGLE ((DWORD)0x00000100)
|
||
|
|
#define PLA_ALRT_CMD_LINE_A_NAME ((DWORD)0x00000200)
|
||
|
|
#define PLA_ALRT_CMD_LINE_C_NAME ((DWORD)0x00000400)
|
||
|
|
#define PLA_ALRT_CMD_LINE_D_TIME ((DWORD)0x00000800)
|
||
|
|
#define PLA_ALRT_CMD_LINE_L_VAL ((DWORD)0x00001000)
|
||
|
|
#define PLA_ALRT_CMD_LINE_M_VAL ((DWORD)0x00002000)
|
||
|
|
#define PLA_ALRT_CMD_LINE_U_TEXT ((DWORD)0x00004000)
|
||
|
|
#define PLA_ALRT_CMD_LINE_MASK ((DWORD)0x00007F00)
|
||
|
|
|
||
|
|
#define PLA_ALRT_DEFAULT_ACTION ((DWORD)0x00000001) // log event is default
|
||
|
|
|
||
|
|
#define PLA_AIBF_UNDER 0L
|
||
|
|
#define PLA_AIBF_OVER ((DWORD)0x00000001) // true when "over" limit is selected
|
||
|
|
#define PLA_AIBF_SEEN ((DWORD)0x00000002) // set when the user has seen this value
|
||
|
|
#define PLA_AIBF_SAVED ((DWORD)0x00000004) // true when user has saved this entry in an edit box
|
||
|
|
|
||
|
|
typedef struct _PLA_ALERT_INFO_BLOCK {
|
||
|
|
DWORD dwSize;
|
||
|
|
LPTSTR szCounterPath;
|
||
|
|
DWORD dwFlags;
|
||
|
|
double dLimit;
|
||
|
|
} PLA_ALERT_INFO_BLOCK, *PPLA_ALERT_INFO_BLOCK;
|
||
|
|
|
||
|
|
#ifdef __cplusplus
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#endif // __PDHP__
|