<div class="content" name="EvtRpcClearLog" uuid="6286c156-2f70-4618-b876-09f60fb21a98"><p>The EvtRpcClearLog (Opnum 6) method instructs the server to
clear all the events in a live channel, and optionally, to create a <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_ddd2e7db-ea8f-4488-ac5f-e77d59abe9e4" data-linktype="relative-path">backup event log</a> before the
clear takes place.</p><dl>
<dd>
<div><pre> error_status_t EvtRpcClearLog(
   [in, context_handle] PCONTEXT_HANDLE_OPERATION_CONTROL control,
   [in, range(0, MAX_RPC_CHANNEL_NAME_LENGTH), string] 
     LPCWSTR channelPath,
   [in, unique, range(0, MAX_RPC_FILE_PATH_LENGTH), string] 
     LPCWSTR backupPath,
   [in] DWORD flags,
   [out] RpcInfo* error
 );
</pre></div>
</dd></dl><p><b>control: </b>A handle to an operation control
object. This parameter is an <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a>
context handle, as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a>, Context
Handles.</p><p><b>channelPath: </b> A pointer to a string that
contains the path of the channel to be cleared. </p><p><b>backupPath: </b>A pointer to a string that
contains the path of the file in which events are to be saved before the clear
is performed. A value of NULL indicates that no backup event log is to be
created (the events to be cleared are not to be saved). </p><p><b>flags: </b>A 32-bit unsigned integer that MUST be
set to zero when sent and MAY be ignored on receipt.<a id="Appendix_A_Target_25"></a><a aria-label="Product behavior note 25" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_25" data-linktype="relative-path">&lt;25&gt;</a></p><p><b>error: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-specific
nonzero value as specified in <a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a>.<a id="Appendix_A_Target_26"></a><a aria-label="Product behavior note 26" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_26" data-linktype="relative-path">&lt;26&gt;</a></p><p><b>Return Values: </b>The method returns 0 (ERROR_SUCCESS)
on success; otherwise, it MUST return an implementation-specific nonzero value
as specified in [MS-ERREF].</p><p>The server does not validate the control handle passed to <b>EvtRpcClearLog</b>
and it SHOULD assume that this parameter is always valid when the method is
invoked.</p><p>The server MUST verify that the <i>channelPath</i> parameter
specifies a correct channel name by looking up the channel name in its channel
table. The server SHOULD fail the call if the <i>channelPath</i> parameter is
not an entry in its channel table with the error code
ERROR_EVT_CHANNEL_NOT_FOUND (0x00003A9F).</p><p>If the <i>backupPath</i> parameter is non-NULL and
non-empty, the server MUST validate the path and fail the call if it is not a
file path (an illegal file path for the server&#39;s file system) or if it
specifies a file that already exists. If the path is an illegal file path, the
server SHOULD return the error ERROR_INVALID_PARAMETER (0x00000057). If the
path specifies a file which exists on the server, the server SHOULD return the
error ERROR_FILE_EXISTS (0x00000050).</p><p>Next, the server MUST verify if the client has write and
clear access to the channel and write access to the backup file if specified.
To perform the access check, the server SHOULD first determine the identity of
the caller. Information determining the identity of the caller for the purpose
of performing an access check is specified in <a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a>
section <a href="../ms-rpce/326c9de1-4602-4d78-848d-8b4e11e6ed80" data-linktype="relative-path">3.2.3.4.2</a>.
Then, if the client specifies a channel, the server SHOULD read the channel&#39;s
access property (as specified in section <a href="f5ae9a61-6f5e-4751-965e-394349c7d950" data-linktype="relative-path">3.1.4.21</a>) as the security
descriptor string. Next, the server SHOULD be able to perform the write and
clear access check using the Access Check algorithm (as specified in <a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a>
section <a href="../ms-dtyp/4f1bbcbb-814a-4c70-a11e-2a5b8779a6f9" data-linktype="relative-path">2.5.3.2</a>).
The server MUST fail the method with the error ERROR_ACCESS_DENIED (0x00000005)
if the client does not have write and clear access to the channel. </p><p>If the client specifies the backupPath, the server SHOULD
first impersonate the identity of the caller. For information on how to
impersonate the client&#39;s identity for the purpose of performing an
authorization or security check, see [MS-RPCE]<a href="../ms-rpce/29b8217a-0bda-4fdb-a3ea-48560125ae8d" data-linktype="relative-path"> (section 3.3.3.4.3)</a>.
Then the server SHOULD call the file system component to attempt to create the
backup file. Once the server impersonates the client&#39;s identity, it can
determine whether the client has write access because the file creation will
fail with ERROR_ACCESS_DENIED (0x00000005) if the client does not have write
access. If the server fails to create the backup file, it MUST return the error
(a nonzero value as specified in [MS-ERREF]) reported by the underlying file
system component.<a id="Appendix_A_Target_27"></a><a aria-label="Product behavior note 27" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_27" data-linktype="relative-path">&lt;27&gt;</a> Otherwise, the server MUST
successfully create the backup file.</p><p>If the <i>backupPath</i> parameter is valid, the server MUST
attempt to back up the log to the path specified in the <i>backupPath</i>
parameter before the log is cleared. The method MUST fail and not clear the log
if the backup does not succeed with any possible implementation-based error
code.</p><p>If the <i>backupPath</i> parameter is NULL or empty, the method
MUST NOT attempt to back up the <a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a> but SHOULD still
clear the events in the channel.</p><p>If the previous checks are successful and if there are no
problems in creating a backup log, the server MUST attempt to clear the
associated event log. All events MUST be removed during clearing. During this
process, the server SHOULD check the <b>Canceled</b> field of the operation
control object in the <i>control</i> parameter periodically, for example, once
every 100 milliseconds. If the <b>Canceled</b> field becomes TRUE and the
clearing operation has not been finished, the server SHOULD abandon the current
operation and return to the client immediately with the error code
ERROR_CANCELLED (0x000004C7) without updating any state. On a successful
return, the server SHOULD reset the <b>numberOfRecords</b> to 0 and <b>isLogFull</b>
to false for the header of its associated log file for the channel. The server
does not need to update the <b>curPhysicalRecordNumber</b> and <b>oldestEventRecordNumber</b>.
The <b>LogCreationTime</b>, <b>LogLastAccessTime</b>, <b>LogLastWriteTime</b>, <b>LogFileSize</b>,
and <b>LogAttributes</b> attributes of the associated log file for the channel
are tracked by the server&#39;s file system.</p><p>If all events are successfully deleted
(&#34;cleared&#34;), the server MUST return ERROR_SUCCESS to indicate
success. This method SHOULD only fail in extreme conditions, such as lack of
system resources, file system error, or hardware error, and such issues are not
part of the processing for the EventLog Remoting Protocol Version 6.0. In these
cases, the method MUST return an implementation-specific error, as specified in
[MS-ERREF], from lower level components unchanged. Depending on the server&#39;s
implementation detail, the protocol has no specific error return recommendation
other than it MUST come from [MS-ERREF].</p><p><b>Note</b>  The server does not need to update
any state or information for the created backup event log file.</p></div>