<div class="content"><p> </p><p>The ElfrReportEventExA (Opnum 26) method<a id="Appendix_A_Target_36"></a><a aria-label="Product behavior note 36" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_36" data-linktype="relative-path">&lt;36&gt;</a> writes events to the <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a></span>;
the server receives these <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_472f97f2-82ec-4623-8e46-d348a7984967" data-linktype="relative-path">events</a></span> from the
client.</p><dl>
<dd>
<div><pre> NTSTATUS ElfrReportEventExA(
   [in] IELF_HANDLE LogHandle,
   [in] PFILETIME TimeGenerated,
   [in] unsigned short EventType,
   [in] unsigned short EventCategory,
   [in] unsigned long EventID,
   [in, range(0, 256)] unsigned short NumStrings,
   [in, range(0, 61440)] unsigned long DataSize,
   [in] PRPC_STRING ComputerName,
   [in, unique] PRPC_SID UserSID,
   [in, size_is(NumStrings), unique] 
     PRPC_STRING Strings[*],
   [in, size_is(DataSize), unique] 
     unsigned char* Data,
   [in] unsigned short Flags,
   [in, out, unique] unsigned long* RecordNumber
 );
</pre></div>
</dd></dl><p><b>LogHandle: </b>A handle to an event log. This
parameter is a server context handle, as specified in section <span><a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a></span>.
This handle MUST NOT be obtained via the <span><a href="6dcf59eb-11ca-416f-9cc4-8f6c2979baad" data-linktype="relative-path">ElfrOpenBELA (section 3.1.4.2)</a></span>
method or the <span><a href="4db1601c-7bc2-4d5c-8375-c58a6f8fc7e1" data-linktype="relative-path">ElfrOpenBELW (section 3.1.4.1)</a></span>
method. A handle received from either of those two methods will have the backup
flag set, so the server checks this flag before calling this method.</p><p><b>TimeGenerated: </b>The time at which the event was
generated by the <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_efdc035d-100a-4568-a67f-69fb726fadcb" data-linktype="relative-path">event source</a></span>. This
time is represented as a pointer to FILETIME as defined in <span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/2c57429b-fdd4-488f-b5fc-9e4cf020fcdf" data-linktype="relative-path">2.3.3</a></span>.
</p><p><b>EventType: </b>The type of the event, as specified
in section <span><a href="1ed850f9-a1fe-4567-a371-02683c6ed3cb" data-linktype="relative-path">2.2.2</a></span>.</p><p><b>EventCategory: </b>The event category, as
specified in section <span><a href="c1f99c2e-b118-45e1-a414-007272fb9d43" data-linktype="relative-path">1.8.5</a></span>. </p><p><b>EventID: </b>The EventID, as specified in section <span><a href="123d104a-39fd-4f60-8f7b-fbd9a43f88c1" data-linktype="relative-path">3.1.1.4</a></span>.
</p><p><b>NumStrings: </b>The number of strings in the array
pointed to by the <i>Strings</i> parameter. A value of zero indicates that no
strings are present.</p><p><b>DataSize: </b>The number of bytes of
event-specific raw binary data to write to the log. This binary data is passed
in the <i>Data</i> parameter. If the <i>DataSize</i> parameter is zero,
event-specific data MUST NOT be present.</p><p><b>ComputerName: </b>A string to assist in
identifying the machine that generated the event. In practice, the name of the
computer. There are no character restrictions on this field&#39;s content (for
example, a <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_1769aec9-237e-44ed-9014-1abb3ec6de6e" data-linktype="relative-path">FQDN</a></span> can be used).
The API is not intended to support dynamically changing computer names. The <i>ComputerName</i>
parameter is cached the first time a client calls the API, and SHOULD use that
name on subsequent calls until the machine is rebooted.</p><p><b>UserSID: </b>Either NULL or a user SID. If this is
NULL, the event is to have a zero length <b>UserSid</b> field.</p><p><b>Strings: </b>Specifies strings containing
information specific to the event. This parameter MUST be a valid pointer. If
the <i>NumStrings</i> parameter is zero, this parameter MUST be NULL. For
example, an event relating to file deletion could use a string to specify the
path of the file being deleted.</p><p><b>Data: </b>A pointer to the buffer that contains
the event-specific binary data. This parameter MUST be a valid pointer (or
NULL), even if the <i>DataSize</i> parameter is zero.</p><p><b>Flags: </b>Unused. MUST be set to zero when sent
and MUST be ignored on receipt.</p><p><b>RecordNumber: </b>Unused. This can be set to any
arbitrary value when sent. Any value sent by the client MUST be ignored on
receipt by the server. </p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p>This method is identical to the <span><a href="0613d800-c535-4d43-90ba-5682aad0190e" data-linktype="relative-path">ElfrReportEventExW (section 3.1.4.16)</a></span>
method except that the string arguments are ANSI strings in this case. Thus,
the remarks in ElfrReportEventExW (section 3.1.4.16) apply to this
method as well. </p></div>