<div class="content" name="ElfrBackupELFW" uuid="58e4c3bb-26b3-48a8-8e29-3cc56a23fc2b"><p>The ElfrBackupELFW (Opnum 1) method instructs the server to
back up the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a> to
a specified file name.</p><dl>
<dd>
<div><pre> NTSTATUS ElfrBackupELFW(
   [in] IELF_HANDLE LogHandle,
   [in] PRPC_UNICODE_STRING BackupFileName
 );
</pre></div>
</dd></dl><p><b>LogHandle: </b>Handle to an event log. This parameter is
a server context handle, as specified in section <a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a>. This handle MUST
NOT be obtained via the <a href="6dcf59eb-11ca-416f-9cc4-8f6c2979baad" data-linktype="relative-path">ElfrOpenBELA (section 3.1.4.2)</a>
method or the <a href="4db1601c-7bc2-4d5c-8375-c58a6f8fc7e1" data-linktype="relative-path">ElfrOpenBELW (section 3.1.4.1)</a>
method.</p><p><b>BackupFileName: </b>Provides a <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a> string (as
specified in section <a href="40e4e566-b7fb-46e2-b179-893231f39e8d" data-linktype="relative-path">2.2.11</a>)
that points to an <a href="c1550f98-a1ce-426a-9991-7509e7c3787c" data-linktype="relative-path">NT Object
Path</a> of a file, (as specified in section 2.2.4.1), in which a current copy
of the event log is to be placed. This MUST NOT be NULL or empty. The path is
evalutated relative to the server.</p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>.<a id="Appendix_A_Target_25"></a><a aria-label="Product behavior note 25" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_25" data-linktype="relative-path">&lt;25&gt;</a></p><p>In response to this request from the client, the server MUST
first check that the handle is valid. The server MUST fail the operation with
the error STATUS_INVALID_HANDLE (0xC0000008) if the handle is invalid or if the
handle is for a <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_ddd2e7db-ea8f-4488-ac5f-e77d59abe9e4" data-linktype="relative-path">backup event
log</a>. Handles to backup event logs are obtained via the
ElfrOpenBELW (section 3.1.4.1) method or the
ElfrOpenBELA (section 3.1.4.2) method.</p><p>For a description of how the server determines if the handle
is a backup handle, see section <a href="9b7a5f23-0269-4ed7-85ad-a7087af66b44" data-linktype="relative-path">3.1.4.9</a>.</p><p>If the handle is valid, the server MUST validate the <i>BackupFileName</i>
and fail the call if it is not a legal NT Object Path, or if it specifies a
file that already exists, or if the user does not have write access to the
specified file path. The server MAY return STATUS_INVALID_PARAMETER
(0xC000000D) if the <i>BackupFileName</i> is not a legal NT Object Path or the
file already exists, and the server MUST return STATUS_ACCESS_DENIED
(0xC0000022) if the user does not have write access to the file.</p><p>If the checks above are successful, the server MUST attempt
to create a backup of the log associated with the <i>LogHandle</i> parameter.
This operation can fail for implementation errors other than the ones mentioned
in the preceding paragraphs. The return value of this method is of the type
NTSTATUS. Protocol implementers can choose to return other,
implementation-based return values, such as those returned from operating
system components that are used to implement the protocol. Protocol
implementers SHOULD only use return values listed in [MS-ERREF].</p></div>