<div class="content"><p> </p><p>The EvtRpcOpenLogHandle (Opnum 17) method is used by a
client to get information about a channel or a backup <span><a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a></span>.</p><dl>
<dd>
<div><pre> error_status_t EvtRpcOpenLogHandle(
   /* [in] RPC_BINDING_HANDLE binding, {the binding handle will be generated by MIDL} */
   [in, range(1, MAX_RPC_CHANNEL_NAME_LENGTH), string] 
     LPCWSTR channel,
   [in] DWORD flags,
   [out, context_handle] PCONTEXT_HANDLE_LOG_HANDLE* handle,
   [out] RpcInfo* error
 );
</pre></div>
</dd></dl><p><b>binding: </b>An RPC binding handle as specified in
section <span><a href="1285c318-9f8c-4c6a-a963-7999557bf8d8" data-linktype="relative-path">2.2.21</a></span>.</p><p><b>channel: </b>A pointer to a string that contains a
channel or a file path. </p><p><b>flags: </b>MUST be one of the following two
values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>0x00000001</p>
  </td>
  <td>
  <p><i>Channel</i> parameter specifies a channel name. </p>
  </td>
 </tr><tr>
  <td>
  <p>0x00000002</p>
  </td>
  <td>
  <p><i>Channel</i> parameter specifies a file name.</p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>handle: </b>A pointer to a log handle. This
parameter is an <span><a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a></span> context handle,
as specified in <span><a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a></span>, Context
Handles.</p><p><b>error: </b>A pointer to an <span><a href="94a5d4d1-0f80-4af3-b7c6-d61a6aa60b7b" data-linktype="relative-path">RpcInfo (section 2.2.1)</a></span>
structure in which to place error information in the case of a failure. The
server MAY set the suberror fields to supply more comprehensive error
information.<a id="Appendix_A_Target_35"></a><a aria-label="Product behavior note 35" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_35" data-linktype="relative-path">&lt;35&gt;</a> If the method succeeds, the
server MUST set all of the values in the structure to 0.</p><p><b>Return Values: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-specific
nonzero value as specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p>In response to this request from the client, the server MUST
first validate the <i>channel</i> parameter. The server SHOULD search for the
given channel name in its channel table. If the server doesn&#39;t find the name,
the specified channel name is not valid. If the specified channel name is
invalid, the server SHOULD return the error code ERROR_EVT_CHANNEL_NOT_FOUND
(0x00003A9F). If the <i>flags</i> parameter is set to 0x00000001, the server
MUST interpret the <i>channel</i> parameter as a channel name. If the <i>flags</i>
parameter is set to 0x00000002, the server MUST interpret channel as the path
to an existing event log file. The server SHOULD return ERROR_INVALID_PARAMETER
(0x00000057) if the <i>flags</i> parameter is not 0x00000001 or 0x00000002.<a id="Appendix_A_Target_36"></a><a aria-label="Product behavior note 36" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_36" data-linktype="relative-path">&lt;36&gt;</a> The server checks this by
calling the file system to check if the file exists. If the event log file does
not exist on the server, the server SHOULD return the error code
ERROR_FILE_NOT_FOUND (0x00000002).</p><p>Next the server MUST verify that the caller has read access
to the channel or the file and MUST fail the method if the caller does not have
read access. To perform the access check, the server SHOULD first determine the
identity of the caller. Information determining the identity of the caller for
the purpose of performing an access check is specified in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/326c9de1-4602-4d78-848d-8b4e11e6ed80" data-linktype="relative-path">3.2.3.4.2</a></span>.
Then, if the client specifies a channel, the server SHOULD read the channel&#39;s
access property (as specified in section <span><a href="f5ae9a61-6f5e-4751-965e-394349c7d950" data-linktype="relative-path">3.1.4.21</a></span>) as the
security descriptor string. Next, the server SHOULD be able to perform the
write and clear access check using the Access Check algorithm (as specified in <span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/4f1bbcbb-814a-4c70-a11e-2a5b8779a6f9" data-linktype="relative-path">2.5.3.2</a></span>).
The server MUST fail the method with the error code ERROR_ACCESS_DENIED
(0x00000005) if the client does not have read access to the channel or the
file.</p><p>If the preceding checks succeed, the server MUST attempt to
create a CONTEXT_HANDLE_LOG_HANDLE. To perform this operation, the server
SHOULD create a log object as specified in section <span><a href="2a5dd9ce-aef8-4a03-b42d-be9393a5a5e8" data-linktype="relative-path">3.1.1.11</a></span>. This
object is the server-side object for CONTEXT_HANDLE_LOG_HANDLE. The server
SHOULD add the newly created handle to its handle table in order to track it.</p><p>The server SHOULD set the <b>LogType</b> field of the log
object to be either a channel or a backup event log based on the client&#39;s input
flags value. If the type is channel, the server SHOULD try to find the channel
in its channel table and SHOULD fail the method with ERROR_CHANNEL_NOT_FOUND
(0x00003A9F) if the server cannot find the channel. After the channel is found,
the server SHOULD set the <b>Channel</b> field of the log object to be the
pointer that points to the channel entry in the channel table. If the type is
backup event log file, the server SHOULD try to check if the file exists and
SHOULD fail the method with the ERROR_FILE_NOT_FOUND (0x00000002) if the backup
event log file does not exist. If the backup event log file exists, the server
SHOULD try to open the backup event log file (see <span><a href="https://go.microsoft.com/fwlink/?LinkId=215125" data-linktype="external">[PRA-CreateFile]</a></span>)
and set the <b>Channel</b> field of the log object to be the file handle if the
server successfully opens the file. If the server fails to open the file, it
MUST return the error from the <b>CreateFile</b> method that is reporting the
error.</p><p>If any of the preceding checks fail, the server MUST NOT
create the context handle.</p><p>The server MUST return a value indicating success or failure
for this operation.</p></div>