<div class="content" name="EvtRpcGetNextEventMetadata" uuid="1dcc13e4-62c4-4dcc-85d0-5f01c2153aad"><p>The EvtRpcGetNextEventMetadata (Opnum 27) method gets
details about a possible event and also returns the next event metadata in the
enumeration. It is used to enumerate through the event definitions for the
publisher associated with the handle. The enumeration is in the forward
direction only, and there is no reset functionality. </p><dl>
<dd>
<div><pre> error_status_t EvtRpcGetNextEventMetadata(
   [in, context_handle] PCONTEXT_HANDLE_EVENT_METADATA_ENUM eventMetaDataEnum,
   [in] DWORD flags,
   [in] DWORD numRequested,
   [out] DWORD* numReturned,
   [out, size_is(,*numReturned), range(0, MAX_RPC_EVENT_METADATA_COUNT)] 
     EvtRpcVariantList** eventMetadataInstances
 );
</pre></div>
</dd></dl><p><b>eventMetaDataEnum: </b>A handle to an <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_3145f93d-9fa3-4ace-85ca-58aa53a1ace9" data-linktype="relative-path">event metadata</a> enumerator.
This parameter is an <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a>
context handle, as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a>, Context
Handles. For information on handle security and authentication considerations,
see sections <a href="ef007e79-0549-446f-a928-379f47d57cfd" data-linktype="relative-path">2.2.20</a> and
<a href="f4145058-63b4-4c32-816d-a26b3ea6bd7d" data-linktype="relative-path">5.1</a>. This is the value
which comes from the return parameter <i>eventMetaDataEnum</i> of function <b>EvtRpcGetEventMetadataEnum</b>
(as specified in <a href="13562ef2-5946-401b-ab07-38312e0696a7" data-linktype="relative-path">3.1.4.27</a>).</p><p><b>flags: </b>A 32-bit unsigned integer that MUST be
set to 0x00000000 when sent and MAY be ignored on receipt.<a id="Appendix_A_Target_56"></a><a aria-label="Product behavior note 56" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_56" data-linktype="relative-path">&lt;56&gt;</a></p><p><b>numRequested: </b>A 32-bit unsigned integer that
contains the number of events for which the properties are needed.</p><p><b>numReturned: </b>A pointer to a 32-bit unsigned
integer that contains the number of events for which the properties are
retrieved.</p><p><b>eventMetadataInstances: </b>A pointer to an array
of <a href="14ba9fda-3402-44b2-b1cd-5318a6613a7f" data-linktype="relative-path">EvtRpcVariantList (section 2.2.9)</a>
structures.</p><p><b>Return Values: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-specific
nonzero value as specified in <a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>.</p><p>In response to this request from the client, the server MUST
first validate the handle. The server SHOULD save the context handle value that
it creates in the <b>EvtRpcGetPublisherMetadata</b> method (as specified in
section <a href="0011377c-12f8-4440-8629-568b1ec5bcf2" data-linktype="relative-path">3.1.4.25</a>) in
its handle table and compare it with the handle passed here to perform the
check.<a id="Appendix_A_Target_57"></a><a aria-label="Product behavior note 57" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_57" data-linktype="relative-path">&lt;57&gt;</a> The server MUST return
ERROR_INVALID_PARAMETER (0x00000057) if the handle is invalid.</p><p>The server MUST verify that event metadata entries remain in
the publisher metadata that have not yet been enumerated. As specified in
section <a href="2a5dd9ce-aef8-4a03-b42d-be9393a5a5e8" data-linktype="relative-path">3.1.1.11</a>, the
event metadata context handle (<i>eventsMetaDataEnum</i> parameter) is an event
metadata object in the server. The server SHOULD cast the context handle into
the event metadata object. In the object, the <b>Enumerator</b> field tracks
the delivered entries and remaining entries. If the enumeration has already
returned the metadata for every event, the method SHOULD fail with the error
ERROR_NO_DATA (0x000000E8).<a id="Appendix_A_Target_58"></a><a aria-label="Product behavior note 58" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_58" data-linktype="relative-path">&lt;58&gt;</a> Note that
it is acceptable for a publisher to have no event metadata entries. In this
case, the server MUST respond to the first call to EvtRpcGetNextEventMetadata
with a return code of ERROR_SUCCESS (0x00000000) with numReturned set to zero.
In particular, Windows event publishers that use the legacy protocol documented
in <a href="../ms-even/55b13664-f739-4e4e-bd8d-04eeda59d09f" data-linktype="relative-path">[MS-EVEN]</a>
will not have event metadata associated with them. These include, but are not
limited to, the events reported in the Application, System, and Security logs.</p><p>If the preceding checks succeed, the server MUST attempt to
return the metadata for as many events as are specified in the <i>numRequested</i>,
or until all the event metadata has been returned.</p><p>The server MUST fill an array of
EvtRpcVariantList (section 2.2.9) objects, with an EvtRpcVariantList
for each event&#39;s metadata, and assign the array to the <i>eventMetadataInstances</i>
parameter. The server SHOULD only fail in creation of the array
EvtRpcVariantList due to shortness of memory. In that case, the server SHOULD
return ERROR_OUTOFMEMORY (0x000000E). Each EvtRpcVariantList MUST contain the
following nine EvtVariant entries. </p><table><thead>
  <tr>
   <th>
   <p>Index</p>
   </th>
   <th>
   <p>Type</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0</td>
  <td>EvtVarTypeUInt32</td>
  <td>Event identifier</td>
 </tr><tr>
  <td>1</td>
  <td>EvtVarTypeUInt32</td>
  <td>Version</td>
 </tr><tr>
  <td>2</td>
  <td>EvtVarTypeUInt32</td>
  <td>Channel identifier</td>
 </tr><tr>
  <td>3</td>
  <td>EvtVarTypeUInt32</td>
  <td>Level value of event</td>
 </tr><tr>
  <td>4</td>
  <td>EvtVarTypeUInt32</td>
  <td>Opcode value of event</td>
 </tr><tr>
  <td>5</td>
  <td>EvtVarTypeUInt32</td>
  <td>Task value of event</td>
 </tr><tr>
  <td>6</td>
  <td>EvtVarTypeUInt32</td>
  <td>Keyword value of event</td>
 </tr><tr>
  <td>7</td>
  <td>EvtVarTypeUInt64</td>
  <td>MessageID for event description string</td>
 </tr><tr>
  <td>8</td>
  <td>EvtVarTypeString</td>
  <td>Event definition template</td>
 </tr></tbody></table><p>The preceding nine entries SHOULD be retrieved from the
event information section in the publisher resource file (as specified in
section <a href="df904dfb-00f8-4457-abe0-d7907c64dc71" data-linktype="relative-path">3.1.1.14</a>).</p><p>If the preceding checks succeed and the server successfully
creates the array of <b>EvtRpcVariantList</b> objects, the server MUST update
the cursor value in the event metadata object to keep track of the event
metadata that has already been enumerated. If the checks fail, or if the server
is unable to create the array, the server MUST NOT update anything.</p><p>The server MUST return a value indicating success or failure
for this operation.</p></div>