<div class="content" name="ElfrOpenELW" uuid="ea6c92d3-05d1-4194-b5a0-686847cd8574"><p>The ElfrOpenELW method instructs the server to return a
server context handle to a <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_3c0e011b-e37d-40ef-90d6-1ed516f06b1c" data-linktype="relative-path">live
event log</a>. The caller MUST<a id="Appendix_A_Target_18"></a><a aria-label="Product behavior note 18" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_18" data-linktype="relative-path">&lt;18&gt;</a> have
permission to read the file that contains the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a> for this to
succeed.</p><dl>
<dd>
<div><pre> NTSTATUS ElfrOpenELW(
   [in] EVENTLOG_HANDLE_W UNCServerName,
   [in] PRPC_UNICODE_STRING ModuleName,
   [in] PRPC_UNICODE_STRING RegModuleName,
   [in] unsigned long MajorVersion,
   [in] unsigned long MinorVersion,
   [out] IELF_HANDLE* LogHandle
 );
</pre></div>
</dd></dl><p><b>UNCServerName: </b>A server interface handle. A pointer
to a <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a> string
specifying the server, as specified in section <a href="12315f0e-4143-45ee-bcda-490a80e5bed5" data-linktype="relative-path">2.2.7</a>. The client MUST map
this string to an <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a>
binding handle, and the server MUST ignore this argument, as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a> sections 4.3.5
and 5.1.5.2. </p><p><b>ModuleName: </b>Specifies the event log name, as defined
in section <a href="c32280b0-471d-41b7-b146-7ac496708c26" data-linktype="relative-path">1.8.2</a> and
specified in section <a href="40e4e566-b7fb-46e2-b179-893231f39e8d" data-linktype="relative-path">2.2.11</a>,
for which a handle is needed.</p><p><b>RegModuleName: </b>This parameter MUST be ignored by the
server. Clients MUST specify an empty string.</p><p><b>MajorVersion: </b>Major version of the client. This value
MUST be set to 1. </p><p><b>MinorVersion: </b>Minor version of the client. This value
MUST be set to 1. </p><p><b>LogHandle: </b>Pointer to an event log handle. This
parameter is a server context handle, as specified in section <a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a>. This handle MUST be
closed by using the <a href="e6b61523-8e7a-4279-a90f-2600b7e9da5d" data-linktype="relative-path">ElfrCloseEL (section 3.1.4.21)</a>
method once the handle is no longer needed. In the case when the client cannot
call the ElfrCloseEL function such as the abnormal termination of the client,
this context handle will be revoked by the server so that there will not be any
resource leaks.</p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>.</p><p>In response to this request from the client, the server MUST
determine what event log the client is requesting the handle for. The server
MUST treat the <i>ModuleName</i> parameter as the event log name itself, as
specified in section 1.8.2. If the <i>ModuleName</i> parameter does not specify
a known event log, the server MUST default to requesting access to the
application log that MUST always exist. The server checks the known event logs
by looking up the <a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_2d67ea57-10e6-422f-985e-694834945a02" data-linktype="relative-path">registry</a>
entries as specified in section <a href="6dda2ef2-2efe-4534-bbeb-07ff44f46a10" data-linktype="relative-path">3.1.1.2</a>. The application,
security, and system are three predefined always existing logs, they are
configured by the server once the machine is set up, the server configures them
in the registry as follows.</p><dl>
<dd>
<div><pre> HKEY_LOCAL_MACHINE\
      system\currentcontrolset\services\eventlog\Application
  
 HKEY_LOCAL_MACHINE\
      system\currentcontrolset\services\eventlog\Security
  
 HKEY_LOCAL_MACHINE\
      system\currentcontrolset\services\eventlog\System
  
</pre></div>
</dd></dl><p>The server MUST verify that the caller has read access to
the event log, and the server MUST fail the operation if the caller does not
have read access to the log. The server SHOULD return STATUS_ACCESS_DENIED
(0xC0000022) to indicate this failure.</p><p>If the checks above are successful, the server MUST attempt
to create a server context handle as specified in section 2.2.6 to the wanted
log and if successful, the server MUST return the handle via the <i>LogHandle</i>
parameter. Creating the handle only fails in the case where the server runs out
of memory resources. If that happens, the server MUST return STATUS_NO_MEMORY
(0xC0000017).</p><p>The server MUST return a value indicating success or failure
for this operation. </p></div>