<div class="content"><p> </p><p>The ElfrReportEventW (Opnum 11) method writes events to the <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a></span>;
the server receives these <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_472f97f2-82ec-4623-8e46-d348a7984967" data-linktype="relative-path">events</a></span> from the
client.</p><dl>
<dd>
<div><pre> NTSTATUS ElfrReportEventW(
   [in] IELF_HANDLE LogHandle,
   [in] unsigned long Time,
   [in] unsigned short EventType,
   [in] unsigned short EventCategory,
   [in] unsigned long EventID,
   [in, range(0, 256)] unsigned short NumStrings,
   [in, range(0, 61440)] unsigned long DataSize,
   [in] PRPC_UNICODE_STRING ComputerName,
   [in, unique] PRPC_SID UserSID,
   [in, size_is(NumStrings), unique] 
     PRPC_UNICODE_STRING Strings[*],
   [in, size_is(DataSize), unique] 
     unsigned char* Data,
   [in] unsigned short Flags,
   [in, out, unique] unsigned long* RecordNumber,
   [in, out, unique] unsigned long* TimeWritten
 );
</pre></div>
</dd></dl><p><b>LogHandle: </b>Handle to an event log. This parameter is
a server context handle, as specified in section <span><a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a></span>. This handle
MUST NOT be obtained via the <span><a href="6dcf59eb-11ca-416f-9cc4-8f6c2979baad" data-linktype="relative-path">ElfrOpenBELA (section 3.1.4.2)</a></span>
method or the <span><a href="4db1601c-7bc2-4d5c-8375-c58a6f8fc7e1" data-linktype="relative-path">ElfrOpenBELW (section 3.1.4.1)</a></span>
method. A handle received from either of those two methods will have the backup
flag set, so the server checks this flag before calling this method.</p><p><b>Time: </b>Time at which the event was generated by the <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_efdc035d-100a-4568-a67f-69fb726fadcb" data-linktype="relative-path">event
source</a></span> (not the time at which the event was logged). The time MUST
be expressed as the number of seconds since 00:00:00 on January 1, 1970 (UTC).</p><p><b>EventType: </b>Type of the event, as specified in section
<span><a href="1ed850f9-a1fe-4567-a371-02683c6ed3cb" data-linktype="relative-path">2.2.2</a></span>.</p><p><b>EventCategory: </b><span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_218d3b23-9c27-45d5-a861-7b832d392fc6" data-linktype="relative-path">Event category</a></span>, as
specified in section <span><a href="c1f99c2e-b118-45e1-a414-007272fb9d43" data-linktype="relative-path">1.8.5</a></span>. </p><p><b>EventID: </b><span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_edce565a-e2b7-40df-ab78-cbb3a49ff3bd" data-linktype="relative-path">EventID</a></span>, as
specified in section <span><a href="123d104a-39fd-4f60-8f7b-fbd9a43f88c1" data-linktype="relative-path">3.1.1.4</a></span>. </p><p><b>NumStrings: </b>Number of strings in the array pointed to
by the Strings parameter. A value of zero indicates that no strings are
present.</p><p><b>DataSize: </b>Number of bytes of event-specific raw binary
data to write to the log. This binary data is passed in the <i>Data</i>
parameter. If the <i>DataSize</i> parameter is zero, event-specific data MUST
NOT be present.</p><p><b>ComputerName: </b>A string to assist in identifying the
machine that generated the event. In practice, the name of the computer. There
are no character restrictions on this field&#39;s content (for example, a <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_1769aec9-237e-44ed-9014-1abb3ec6de6e" data-linktype="relative-path">FQDN</a></span>
can be used). The API is not intended to support dynamically changing computer
names. The <i>ComputerName</i> parameter SHOULD<a id="Appendix_A_Target_27"></a><a aria-label="Product behavior note 27" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_27" data-linktype="relative-path">&lt;27&gt;</a> be cached
the first time a client calls the API, and SHOULD use that name on subsequent
calls until the machine is rebooted.</p><p><b>UserSID: </b>Either NULL or a user SID. If this is NULL,
the event is to have a zero length <b>UserSid</b> field.</p><p><b>Strings: </b>Specifies strings containing information
specific to the event. This parameter MUST be a valid pointer. If the <i>NumStrings</i>
parameter is zero, this parameter MUST be NULL. For example, an event relating
to file deletion could use a string to specify the path of the file being
deleted.</p><p><b>Data: </b>Pointer to the buffer that contains the
event-specific binary data. This parameter MUST be a valid pointer (or NULL),
even if the <i>DataSize</i> parameter is zero.</p><p><b>Flags: </b>Unused. MUST be set to zero when sent and MUST
be ignored on receipt.</p><p><b>RecordNumber: </b>Unused. Can be set to any arbitrary
value when sent, and any value sent by the client MUST be ignored on receipt by
the server. </p><p><b>TimeWritten: </b>Unused. Can be set to any arbitrary
value when sent, and any value sent by the client MUST be ignored on receipt by
the server.</p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p>In response to this request from the client, the server MUST
first check that the handle is valid. The server MUST fail the operation with
the error STATUS_INVALID_HANDLE (0xC0000008) if the handle is invalid.</p><p>If the handle comes from the
ElfrOpenBELA (section 3.1.4.2) method or the
ElfrOpenBELW (section 3.1.4.1) method, a backup flag is attached in
the handle. The server MUST check that flag, and if the backup flag is set, the
server MUST return STATUS_INVALID_HANDLE (0xC0000008).</p><p>The server SHOULD check that the <i>EventType</i> and the <i>Time</i>
value are valid as specified.<a id="Appendix_A_Target_28"></a><a aria-label="Product behavior note 28" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_28" data-linktype="relative-path">&lt;28&gt;</a></p><p>The server MUST check that the SID is valid if it is not
NULL, and MUST fail the method if the <i>UserSid</i> is invalid with the error
code STATUS_INVALID_PARAMETER (0xC000000D).<a id="Appendix_A_Target_29"></a><a aria-label="Product behavior note 29" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_29" data-linktype="relative-path">&lt;29&gt;</a></p><p>If the handle is valid, the method MUST attempt to create an
event with the supplied parameters and by setting the <b>TimeWritten</b> and
the <b>RecordNumber</b> fields in the event. The <b>TimeWritten</b> MUST be
obtained from the system clock. The server MUST get the RecordNumber from the
state maintained for the event log. The server can get the last record in the
event log file, read the record number from that record, and use that record
number plus 1 as the new record number. The new record number SHOULD be set to
the value in the event log file header so that the total number of records in
the file is stored. The server SHOULD set the <b>TimeWritten</b> and <b>RecordNumber</b>
parameters to the same values written to the event prior to returning from this
method.<a id="Appendix_A_Target_30"></a><a aria-label="Product behavior note 30" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_30" data-linktype="relative-path">&lt;30&gt;</a></p><p>The server MUST ignore the <i>TimeWritten</i> and <i>RecordNumber</i>
parameters received from the client.</p><p>Note that write access to the event log is verified when the
<span><a href="9b18521f-98cb-44f9-ab5c-84f03b790b44" data-linktype="relative-path">ElfrRegisterEventSourceW (section 3.1.4.5)</a></span>
method is called, and the event log handle is opened successfully. There is no
write access check in the ElfrReportEventW (Opnum 11) method.</p><p>Then the server MUST attempt to store the event source name
in the event. This event source was originally specified when the
ElfrRegisterEventSourceW (section 3.1.4.5) method or the <span><a href="85c31da0-b47f-4776-9024-4f0fb09a046c" data-linktype="relative-path">ElfrRegisterEventSourceA (section 3.1.4.6)</a></span>
method was called. The event source name is attached to the <i>LogHandle</i>
when the ElfrRegisterEventSourceW (section 3.1.4.5) method or the
ElfrRegisterEventSourceA (section 3.1.4.6) method returns. The server
gets the event source name from the <b>LogPublisher</b> object (specified in
section <span><a href="ae50f016-aca2-48da-814b-a89f702025be" data-linktype="relative-path">3.1.1.5</a></span>) that is
contained in the <i>LogHandle</i> that was passed in, and logs it in the event.</p><p>If the above checks all succeed, the server MUST attempt to
copy the event into the event log and attempt to update the log state so that
the record number is incremented for the next write. The server returns
STATUS_LOG_FILE_FULL (0xC0000188) when the live event log file is full (the log
reaches its maximum allowed size and can&#39;t be overwritten) and returns STATUS_DISK_FULL
(0xC000007F) when there is no physical disk space for the new event record.</p><p>The server MUST return a value indicating success or failure
for this operation.</p></div>