<div class="content" name="EvtRpcGetLogFileInfo" uuid="fa592a06-b427-41f7-a959-4ea6812c2294"><p>The EvtRpcGetLogFileInfo (Opnum 18) method is used by a
client to get information about a live channel or a <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_ddd2e7db-ea8f-4488-ac5f-e77d59abe9e4" data-linktype="relative-path">backup event log</a>.</p><dl>
<dd>
<div><pre> error_status_t EvtRpcGetLogFileInfo(
   [in, context_handle] PCONTEXT_HANDLE_LOG_HANDLE logHandle,
   [in] DWORD propertyId,
   [in, range(0, MAX_RPC_PROPERTY_BUFFER_SIZE)] 
     DWORD propertyValueBufferSize,
   [out, size_is(propertyValueBufferSize)] 
     BYTE* propertyValueBuffer,
   [out] DWORD* propertyValueBufferLength
 );
</pre></div>
</dd></dl><p><b>logHandle: </b>A handle to an <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a>. This parameter
is an <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a> context
handle, as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a>,
Context Handles. For more information about the server-side object that maps to
this handle, see section <a href="30a294b1-4e95-468a-a90a-185a5ea63ea0" data-linktype="relative-path">3.1.4.19</a>.</p><p><b>propertyId: </b>A 32-bit unsigned integer that
indicates what log file property (as specified in section <a href="77e3552a-90e8-4dae-9612-99ee54ec1f6d" data-linktype="relative-path">3.1.1.6</a>) needs to be
retrieved.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>EvtLogCreationTime 0x00000000</td>
  <td>A FILETIME containing the creation time of the file. This is the creation time of a log file associated with the channel or the creation time of the backup event log file in the server&#39;s file system.</td>
 </tr><tr>
  <td>EvtLogLastAccessTime 0x00000001</td>
  <td>A FILETIME containing the last access time of the file. This is the last access time of a log file associated with the channel or the last access time of the backup event log file in the server&#39;s file system.</td>
 </tr><tr>
  <td>EvtLogLastWriteTime 0x00000002</td>
  <td>A FILETIME containing the last write time of the file. This is the last written time of a log file associated with the channel or the last written time of the backup event log file in the server&#39;s file system.</td>
 </tr><tr>
  <td>EvtLogFileSize 0x00000003</td>
  <td>An unsigned 64-bit integer containing the size of the file. This is the file size of a log file associated with the channel or the file size of the backup event log file in the server&#39;s file system.</td>
 </tr><tr>
  <td>EvtLogAttributes 0x00000004</td>
  <td>An unsigned 32-bit integer containing the attributes of the file. The attributes are implementation-specific, and clients MUST&lt;23&gt; treat all values equally. The attributes are tracked by the server&#39;s file system and SHOULD be able to be retrieved from the file system.</td>
 </tr><tr>
  <td>EvtLogNumberOfLogRecords 0x00000005</td>
  <td>An unsigned 64-bit integer containing the number of records in the file. See the following processing rules for how the server gets this value.</td>
 </tr><tr>
  <td>EvtLogOldestRecordNumber 0x00000006</td>
  <td>An unsigned 64-bit integer containing the oldest record number in the file. See the following processing rules for how the server gets this value.</td>
 </tr><tr>
  <td>EvtLogFull 0x00000007</td>
  <td>A BOOLEAN value; MUST be true if the log is full, and MUST be false otherwise. See the following processing rules for how the server gets this value.</td>
 </tr></tbody></table>
</dd></dl><p><b>propertyValueBufferSize: </b>A 32-bit unsigned
integer that contains the length of caller&#39;s buffer in bytes.</p><p><b>propertyValueBuffer: </b>A byte-array that
contains the buffer for returned data.</p><p><b>propertyValueBufferLength: </b>A pointer to a
32-bit unsigned integer that contains the size in bytes of the returned data.</p><p><b>Return Values: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success. The method MUST return ERROR_INSUFFICIENT_BUFFER
(0x0000007A) if the buffer is too small; otherwise, it MUST return a different
implementation-specific nonzero value as specified in <a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>.</p><p>In response to this request from the client, the server MUST
first validate the handle. The server SHOULD save the log handle value it
creates in the EvtRpcOpenLogHandle (section 3.1.4.19) method in its
handle table (as specified in section <a href="32102cb3-ea77-4171-bd1a-33c8c4d882aa" data-linktype="relative-path">3.1.1.12</a>) so that it can
compare that value with the value in the <i>logHandle</i> parameter to perform the
check. If the values differ, the handle is invalid.<a id="Appendix_A_Target_24"></a><a aria-label="Product behavior note 24" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_24" data-linktype="relative-path">&lt;24&gt;</a> The server MUST fail the
operation if the handle is invalid with the error code ERROR_INVALID_PARAMETER
(0x00000057).</p><p>Next, the server MUST verify the <i>propertyId</i> value as
one specified in the preceding <i>propertyId&#39;s</i> fields table. Otherwise, it
SHOULD return ERROR_INVALID_PARAMETER (0x00000057).</p><p>If <i>propertyValueBufferSize</i> is too small, the server
MUST return the size needed in the <i>propertyValueBufferLength</i> parameter
and fail the method with a return code of ERROR_INSUFFICIENT_BUFFER
(0X0000007A).</p><p>If the preceding checks succeed, the server MUST attempt to
return the request information. The server SHOULD first cast the logHandle into
the log object. The server SHOULD decide if the Channel pointer points to a
live channel or the handle to a backup event log file based on the LogType
field. If it is a live channel, the server SHOULD get the associated log file
path and open the file to get a file handle. If it is a backup event log file,
the log object contains the handle to the file. Then the server SHOULD get the <i>EvtLogCreationTime</i>,
<i>EvtLogLastAccessTime</i>, <i>EvtLogLastWriteTime</i>, <i>EvtLogFileSize</i>,
and <i>EvtLogAttributes</i> information by querying the file system to get the
creation time, last access time, last written time, file size, and file
attributes of the specified log file (if channel is specified, the log file is
the disk file which associates with the channel).</p><p><b>Note</b>  This information is tracked by the
file system automatically and the server does not need to touch any files for
any operation, such as exporting events from the channel or clearing events in
a channel.</p><p>The server keeps the number of event records, the oldest
event record, and the log full flag in its live channel file (log file
associated with the channel) or backup event log file header (as specified in
section 3.1.1.6). The server reads the information directly when returning the
mentioned properties to the client. </p><p>The server MUST pack the return data into a single <a href="1c7b8b86-acc7-4db8-805c-20cc1ea2f7bc" data-linktype="relative-path">BinXmlVariant structure</a>,
as specified in section 2.2.18, and copy it into the buffer that is pointed to
by the <i>propertyValueBuffer</i> parameter. The server MUST NOT update its
state.</p><p>The server MUST return a value indicating success or failure
for this operation.</p></div>