<div class="content"><p> </p><p>The EvtRpcPutChannelConfig (Opnum 21) method is used by a
client to update the configuration for a channel.</p><dl>
<dd>
<div><pre> error_status_t EvtRpcPutChannelConfig(
   /* [in] RPC_BINDING_HANDLE binding, {the binding handle will be generated by MIDL} */
   [in, range(1, MAX_RPC_CHANNEL_NAME_LENGTH), string] 
     LPCWSTR channelPath,
   [in] DWORD flags,
   [in] EvtRpcVariantList* props,
   [out] RpcInfo* error
 );
</pre></div>
</dd></dl><p><b>binding: </b>An RPC binding handle as specified in
section <span><a href="1285c318-9f8c-4c6a-a963-7999557bf8d8" data-linktype="relative-path">2.2.21</a></span>.</p><p><b>channelPath: </b>A pointer to a string that
contains a channel name (this is not a file path as the parameter name might
suggest).</p><p><b>flags: </b>A 32-bit unsigned integer that
indicates what to do depending on the existence of the channel. This MUST be
set to one of the following, and the server SHOULD return
ERROR_INVALID_PARAMETER (0x00000057) if the flag is not one of the following
values.<a id="Appendix_A_Target_40"></a><a aria-label="Product behavior note 40" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_40" data-linktype="relative-path">&lt;40&gt;</a></p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>0x00000000</p>
  </td>
  <td>
  <p>The server MUST open the existing channel entry in its
  channel table or create a new entry if the specified channel is not in the
  table.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x00000001</p>
  </td>
  <td>
  <p>The server MUST open the existing channel entry in its
  channel table. </p>
  </td>
 </tr><tr>
  <td>
  <p>0x00000002</p>
  </td>
  <td>
  <p>Always create a new channel entry in the server&#39;s
  channel table and delete the existing entry.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x00000003</p>
  </td>
  <td>
  <p>Only create a new channel entry in the server&#39;s
  channel table. </p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>props: </b>A pointer to an <span><a href="14ba9fda-3402-44b2-b1cd-5318a6613a7f" data-linktype="relative-path">EvtRpcVariantList (section 2.2.9)</a></span>
structure containing channel properties, as defined in the following table.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Index</p>
   </th>
   <th>
   <p>Type</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>0</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>Enabled. If true, the channel can accept new events.
  If false, any attempts to write events into this channel are automatically
  dropped.</p>
  </td>
 </tr><tr>
  <td>
  <p>1</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Channel Isolation. It defines the default access
  permissions for the channel. Three values are allowed:</p>
  <ul><li><p><span><span>  
  </span></span><span>0: Application. </span></p>
  </li><li><p><span><span>  
  </span></span><span>1: System. </span></p>
  </li><li><p><span><span>  
  </span></span><span>2: Custom. </span></p>
  </li></ul><p> </p>
  <p>The default isolation is Application. The default
  permissions for Application are (shown using SDDL):</p>
  <ul><li><p><span><span>  
  </span></span><span>L&#34;O:BAG:SYD:&#34;</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0xf0007;;;SY)&#34; //
  local system (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x7;;;BA)&#34; //
  built-in admins (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x7;;;SO)&#34; //
  server operators (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;IU)&#34; //
  INTERACTIVE LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;SU)&#34; //
  SERVICES LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;S-1-5-3)&#34;
  // BATCH LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;S-1-5-33)&#34;
  // write restricted service (read,write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;S-1-5-32-573)&#34;;
  // event log readers (read)</span></p>
  </li></ul><p> </p>
  <p>The default permissions for System are (shown using
  SDDL):</p>
  <ul><li><p><span><span>  
  </span></span><span>L&#34;O:BAG:SYD:&#34;</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0xf0007;;;SY)&#34; //
  local system (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x7;;;BA)&#34; //
  built-in admins (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;BO)&#34; //
  backup operators (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x5;;;SO)&#34; //
  server operators (read, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;IU)&#34; //
  INTERACTIVE LOGON (read)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;SU)&#34; //
  SERVICES LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;S-1-5-3)&#34;
  // BATCH LOGON (read)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x2;;;S-1-5-33)&#34;
  // write restricted service (write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;S-1-5-32-573)&#34;;
  // event log readers (read)</span></p>
  </li></ul><p> </p>
  <p>When the Custom value is used, the Access property
  will contain the defined SDDL.</p>
  </td>
 </tr><tr>
  <td>
  <p>2</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Channel Type. One of four values:</p>
  <ul><li><p><span><span>  
  </span></span><span>0: Admin</span></p>
  </li><li><p><span><span>  
  </span></span><span>1: Operational.</span></p>
  </li><li><p><span><span>  
  </span></span><span>2: Analytic</span></p>
  </li><li><p><span><span>  
  </span></span><span>3: Debug</span></p>
  </li></ul><p> </p>
  <p>For more information, see <span><a href="https://go.microsoft.com/fwlink/?LinkId=208452" data-linktype="external">[MSDN-EVTLGCHWINEVTLG]</a></span>.</p>
  </td>
 </tr><tr>
  <td>
  <p>3</p>
  </td>
  <td>
  <p>EvtRpcVarTypeString</p>
  </td>
  <td>
  <p>OwningPublisher. The name of the publisher that
  defines and registers the channel with the system. </p>
  </td>
 </tr><tr>
  <td>
  <p>4</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>ClassicEventlog. If true, the channel represents an
  event log created according to the EventLog Remoting Protocol, not this
  protocol (EventLog Remoting Protocol Version 6.0).</p>
  </td>
 </tr><tr>
  <td>
  <p>5</p>
  </td>
  <td>
  <p>EvtRpcVarTypeString</p>
  </td>
  <td>
  <p>Access. A Security Descriptor Description Language
  (SDDL) string, as specified in <span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>,
  that represents access permissions to the channels. If the <b>isolation</b>
  attribute is set to Application or System, the access descriptor controls
  read access to the file (the write permissions are ignored). If the <b>isolation</b>
  attribute is set to Custom, the access descriptor controls write access to
  the channel and read access to the file.</p>
  </td>
 </tr><tr>
  <td>
  <p>6</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>Retention. If set to true, events can never be
  overwritten unless explicitly cleared. This is the way to configure the logs
  to be circular. If set to false, events are overwritten as needed when the
  event log is full.</p>
  </td>
 </tr><tr>
  <td>
  <p>7</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>AutoBackup. When set to true, the event log file
  associated with the channel is closed as soon as it reaches the maximum size
  specified by the MaxSize property, and a new file is opened to accept new
  events. If the new file reaches maximum size, another new file will be
  generated and the previous new file will be backed up. The events in backed
  up files cannot be queried from this channel in the server unless the client
  specifies the backup log file names in a separate query.</p>
  </td>
 </tr><tr>
  <td>
  <p>8</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt64</p>
  </td>
  <td>
  <p>MaxSize. The value that indicates at which point the
  size (in bytes) of the event log file stops increasing. When the size is
  greater than or equal to this value, the file growth stops.</p>
  </td>
 </tr><tr>
  <td>
  <p>9</p>
  </td>
  <td>
  <p>EvtRpcVarTypeString</p>
  </td>
  <td>
  <p>LogFilePath. The server changes the file path to the
  event log file for the channel.</p>
  </td>
 </tr><tr>
  <td>
  <p>10</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Level. Events with a level property less than or equal
  to this specified value are logged to the channel.</p>
  </td>
 </tr><tr>
  <td>
  <p>11</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt64</p>
  </td>
  <td>
  <p>Keywords. Events with a keyword bit contained in the
  keywords bitmask set are logged to the channel.</p>
  </td>
 </tr><tr>
  <td>
  <p>12</p>
  </td>
  <td>
  <p>EvtRpcVarTypeGuid</p>
  </td>
  <td>
  <p>ControlGuid. A GUID value. The server SHOULD ignore
  this value.<a id="Appendix_A_Target_41"></a><a aria-label="Product behavior note 41" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_41" data-linktype="relative-path">&lt;41&gt;</a></p>
  </td>
 </tr><tr>
  <td>
  <p>19</p>
  </td>
  <td>
  <p>EvtRpcVarTypeStringArray</p>
  </td>
  <td>
  <p>PublisherList. A list of publishers that can raise
  events into the channel. </p>
  </td>
 </tr><tr>
  <td>
  <p>20</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>FileMax. The maximum number of log files associated
  with an analytic or debug channel. When the number of logs reaches the
  specified maximum, the system begins to overwrite the logs, beginning with
  the oldest. A FileMax value of 0 or 1 indicates that only one file is
  associated with this channel. A MaxFile of 0 is the default.</p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>error: </b>A pointer to an <span><a href="94a5d4d1-0f80-4af3-b7c6-d61a6aa60b7b" data-linktype="relative-path">RpcInfo (section 2.2.1)</a></span>
structure in which to place error information in the case of a failure. The RpcInfo (section 2.2.1)
structure fields MUST be set to nonzero values if the error is related to a
particular property. All nonzero values MUST be treated the same. If the method
succeeds, the server MUST set all of the values in the structure to 0.</p><p><b>Return Values: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-specific
nonzero value as specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.<a id="Appendix_A_Target_42"></a><a aria-label="Product behavior note 42" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_42" data-linktype="relative-path">&lt;42&gt;</a></p><p>In response to this request from the client, the server MUST
verify that the <i>channelPath</i> parameter specifies a valid channel name.
The server MUST fail the method if the parameter is invalid with the error
ERROR_INVALID_PARAMETER (0x00000057). The server checks if a channel name is
valid by searching the given name in its channel table.</p><p>Next, the server MUST verify that the caller has write
access to the information and MUST fail the method with the error
ERROR_ACCESS_DENIED (0x00000005) if the caller does not have write access. To
perform the access check, the server SHOULD first determine the identity of the
caller. Information determining the identity of the caller for the purpose of
performing an access check is specified in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/326c9de1-4602-4d78-848d-8b4e11e6ed80" data-linktype="relative-path">3.2.3.4.2</a></span>.
Then, if the client specifies a channel, the server SHOULD read the channel&#39;s
access property (as specified in section <span><a href="f5ae9a61-6f5e-4751-965e-394349c7d950" data-linktype="relative-path">3.1.4.21</a></span>) as the
security descriptor string. Next, the server SHOULD be able to perform the
write and clear access check using the Access Check algorithm (as specified in
[MS-DTYP] section <span><a href="../ms-dtyp/4f1bbcbb-814a-4c70-a11e-2a5b8779a6f9" data-linktype="relative-path">2.5.3.2</a></span>).
</p><p>If the client specifies 0x00000000 for the <i>flags</i>
value, the server MUST try to find the channel entry specified by the <i>channelPath</i>
parameter in its channel table. If the server does not find the channel entry
in the table, it creates a new entry with the parameter <i>channelPath</i> as
the new channel name. The creation of a new channel table entry SHOULD only
fail when there is inadequate memory. The server SHOULD return
ERROR_OUTOFMEMORY (0x0000000E) in that case. When a new channel is created, the
server SHOULD assign the default property values to the channel as in the
following table.</p><table><thead>
  <tr>
   <th>
   <p>Property</p>
   </th>
   <th>
   <p>Default Value</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>Enabled</p>
  </td>
  <td>
  <p>true</p>
  </td>
 </tr><tr>
  <td>
  <p>Isolation</p>
  </td>
  <td>
  <p>0</p>
  </td>
 </tr><tr>
  <td>
  <p>ChannelType</p>
  </td>
  <td>
  <p>0</p>
  </td>
 </tr><tr>
  <td>
  <p>OwningPublisher</p>
  </td>
  <td>
  <p>null</p>
  </td>
 </tr><tr>
  <td>
  <p>Classic</p>
  </td>
  <td>
  <p>false</p>
  </td>
 </tr><tr>
  <td>
  <p>Access</p>
  </td>
  <td>
  <p>&#34;O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)&#34;(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)&#34;</p>
  </td>
 </tr><tr>
  <td>
  <p>Retention</p>
  </td>
  <td>
  <p>false</p>
  </td>
 </tr><tr>
  <td>
  <p>Autobackup</p>
  </td>
  <td>
  <p>false</p>
  </td>
 </tr><tr>
  <td>
  <p>maxSize</p>
  </td>
  <td>
  <p>20 * 1024 * 1024</p>
  </td>
 </tr><tr>
  <td>
  <p>LogFilePath</p>
  </td>
  <td>
  <p>%systemfolder%\winevt\&lt;channelname&gt;.evtx</p>
  </td>
 </tr><tr>
  <td>
  <p>Level</p>
  </td>
  <td>
  <p>0</p>
  </td>
 </tr><tr>
  <td>
  <p>Keywords</p>
  </td>
  <td>
  <p>0xFFFFFFFFFFFFFFFF</p>
  </td>
 </tr><tr>
  <td>
  <p>ControlGuid</p>
  </td>
  <td>
  <p>{00000000-0000-0000-0000-000000000000}</p>
  </td>
 </tr><tr>
  <td>
  <p>BufferSize</p>
  </td>
  <td>
  <p>64K</p>
  </td>
 </tr><tr>
  <td>
  <p>MinBuffers</p>
  </td>
  <td>
  <p>2 * Number of the CPUs.</p>
  </td>
 </tr><tr>
  <td>
  <p>MaxBuffers</p>
  </td>
  <td>
  <p>22 + MinBuffers</p>
  </td>
 </tr><tr>
  <td>
  <p>Latency</p>
  </td>
  <td>
  <p>1</p>
  </td>
 </tr><tr>
  <td>
  <p>ClockType</p>
  </td>
  <td>
  <p>0</p>
  </td>
 </tr><tr>
  <td>
  <p>SidType</p>
  </td>
  <td>
  <p>1</p>
  </td>
 </tr><tr>
  <td>
  <p>PublisherList</p>
  </td>
  <td>
  <p>null</p>
  </td>
 </tr><tr>
  <td>
  <p>FileMax</p>
  </td>
  <td>
  <p>0</p>
  </td>
 </tr></tbody></table><p>If the client specifies 0x00000001 for the <i>flags</i>
value and the specified channel entry is not found in the channel table, the
server MUST return ERROR_NOT_FOUND (0x00000490).</p><p>If the client specifies 0x00000002 for the <i>flags</i>
value, the processing rule is similar to processing rule 1 except that when the
server finds the exiting channel entry, it SHOULD delete it first before
creating a new one. Delete an existing entry SHOULD never fail.</p><p>If the client specifies the 0x00000003 for the <i>flags</i>
value, the server MUST fail the method if the specified channel is already in
the channel table with the error code ERROR_ALREADY_EXISTS (0x000000B7).</p><p>The server SHOULD check if the publisher specified has
already registered in its publisher table when the client tries to update the
owning publisher property. If not, the server SHOULD fail the method with
ERROR_INVALID_PARAMETER (0x00000057).<a id="Appendix_A_Target_43"></a><a aria-label="Product behavior note 43" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_43" data-linktype="relative-path">&lt;43&gt;</a></p><p><b>Note</b>  The configuration properties for <i>BufferSize</i>,
<i>MinBuffers</i>, <i>MaxBuffers</i>, <i>Latency</i>, <i>ClockType</i>, and <i>SIDType</i>
can&#39;t be updated by the client. These properties are maintained by the server
administrator on the physical machine only and cannot be updated through the
remote protocol methods. The server administrator can specify these properties
with any allowable values.<a id="Appendix_A_Target_44"></a><a aria-label="Product behavior note 44" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_44" data-linktype="relative-path">&lt;44&gt;</a> The
server SHOULD make sure the client does not update these properties. The server
SHOULD fail the method with the error ERROR_INVALID_OPERATION (0x000010DD) in
this case.</p><p>If the previous checks succeed, the server MUST attempt to
update the channel&#39;s properties using the value specified in the <i>props</i>
parameter. The server SHOULD proceed in the following manner to update the data
for each channel property:</p><p>The server SHOULD allocate a memory block with the same size
as the EvtRpcVariantList (section 2.2.9) pointed to by the <i>props</i>
parameter. If the memory allocation fails, the server SHOULD return
ERROR_OUTOFMEMORY (0x0000000E). The server then copies all the data in the <i>props</i>
parameter into the new allocated memory block. Before copying the data, the
server SHOULD validate the data as follows:</p><ul><li><p><span><span> 
</span></span>The Isolation property SHOULD be either 0, 1, or 2, if the client
has specified that property.</p>
</li><li><p><span><span> 
</span></span>The Channel type property SHOULD be either 0, 1, 2, or 3, if the
client has specified that property.</p>
</li><li><p><span><span> 
</span></span>The Access property string SHOULD be a valid security descriptor
as specified in section [MS-DTYP], if the client specifies that property. Note
that the only access permissions defined for channels are read, write, and
clear; if a client attempts to specify any other access permissions in the
security descriptor, the server SHOULD ignore them.</p>
</li><li><p><span><span> 
</span></span>The LogFilePath property MUST be a valid file path string for the
server&#39;s file system, if the client specifies that property.</p>
</li><li><p><span><span> 
</span></span>The server SHOULD verify that the publishers specified in the
PublisherList property exist in the server&#39;s publisher table. If so, the server
SHOULD add the current channel to the publisher entries in the server&#39;s
publisher table for every publisher specified by the PublisherList property so
that as soon as the new settings are applied, the server is prepared for those
publishers to publish events to this channel.</p>
</li></ul><p>If any of the validation checks fail, the server SHOULD
return ERROR_INVALID_DATA. After copying the data, the server SHOULD return to
the client with ERROR_SUCCESS (0x00000000), but SHOULD NOT apply the new
channel properties until <span><a href="79e81642-5ef1-4963-9e77-798d2a6c2b1a" data-linktype="relative-path">EvtRpcAssertConfig</a></span>
is called or the server restarts. <b>EvtRpcAssertConfig</b> causes the server
to apply an in-memory copy of the channel configuration, whereas when the
server restarts, it loads channel configuration data from persistent storage as
specified in section <span><a href="8f10cb24-8c8d-4dca-b5dc-ee28706c5b78" data-linktype="relative-path">3.1.1.5</a></span>. Before
applying the properties, all the server&#39;s behaviors are still the same as they
were originally, even after the method has successfully returned to the client.
For information on the server saving the configuration and then applying the
changes with the <b>EvtRpcAssertConfig</b> method, see the processing rules in
EvtRpcAssertConfig (section 3.1.4.29). The server SHOULD check if the value
passed by the client is within the allowed range. If not, the server SHOULD return
ERROR_INVALID_PARAMETER (0x00000057). The server will not fail the method if
all the previous checks are passed.</p><p>The server MUST return a value indicating success or failure
for this operation.</p></div>