RIP BOOL. Convert BOOL -> bool. I found a few interesting
[nivanova/samba-autobuild/.git] / source3 / rpc_server / srv_eventlog_nt.c
index 5901f68f5210677ac44e58b3d5d6a346e6611d46..d86da9054cb32682f73ca8e43374a823e10f9866 100644 (file)
@@ -7,7 +7,7 @@
  *  
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
+ *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
  *  
  *  This program is distributed in the hope that it will be useful,
@@ -16,8 +16,7 @@
  *  GNU General Public License for more details.
  *  
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "includes.h"
@@ -27,7 +26,8 @@
 
 typedef struct {
        char *logname;
-       TDB_CONTEXT *tdb;
+       ELOG_TDB *etdb;
+       uint32 current_record;
        uint32 num_records;
        uint32 oldest_entry;
        uint32 flags;
@@ -41,8 +41,8 @@ static void free_eventlog_info( void *ptr )
 {
        EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
        
-       if ( elog->tdb )
-               elog_close_tdb( elog->tdb );
+       if ( elog->etdb )
+               elog_close_tdb( elog->etdb, False );
        
        TALLOC_FREE( elog );
 }
@@ -55,7 +55,7 @@ static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
 {
        EVENTLOG_INFO *info;
 
-       if ( !find_policy_by_hnd( p, handle, ( void ** ) &info ) ) {
+       if ( !find_policy_by_hnd( p, handle, (void **)(void *)&info ) ) {
                DEBUG( 2,
                       ( "find_eventlog_info_by_hnd: eventlog not found.\n" ) );
                return NULL;
@@ -67,11 +67,11 @@ static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
 /********************************************************************
 ********************************************************************/
 
-static BOOL elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
+static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
 {
        char *tdbname = elog_tdbname( info->logname );
        SEC_DESC *sec_desc;
-       BOOL ret;
+       bool ret;
        NTSTATUS ntstatus;
        
        if ( !tdbname ) 
@@ -117,11 +117,15 @@ static BOOL elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
 /********************************************************************
  ********************************************************************/
 
-static BOOL elog_validate_logname( const char *name )
+static bool elog_validate_logname( const char *name )
 {
        int i;
        const char **elogs = lp_eventlog_list();
        
+       if (!elogs) {
+               return False;
+       }
+
        for ( i=0; elogs[i]; i++ ) {
                if ( strequal( name, elogs[i] ) )
                        return True;
@@ -130,20 +134,59 @@ static BOOL elog_validate_logname( const char *name )
        return False;
 }
 
+/********************************************************************
+********************************************************************/
+
+static bool get_num_records_hook( EVENTLOG_INFO * info )
+{
+       int next_record;
+       int oldest_record;
+
+       if ( !info->etdb ) {
+               DEBUG( 10, ( "No open tdb for %s\n", info->logname ) );
+               return False;
+       }
+
+       /* lock the tdb since we have to get 2 records */
+
+       tdb_lock_bystring_with_timeout( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
+       next_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
+       oldest_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_OLDEST_ENTRY);
+       tdb_unlock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
+
+       DEBUG( 8,
+              ( "Oldest Record %d; Next Record %d\n", oldest_record,
+                next_record ) );
+
+       info->num_records = ( next_record - oldest_record );
+       info->oldest_entry = oldest_record;
+
+       return True;
+}
+
+/********************************************************************
+ ********************************************************************/
+
+static bool get_oldest_entry_hook( EVENTLOG_INFO * info )
+{
+       /* it's the same thing */
+       return get_num_records_hook( info );
+}
+
 /********************************************************************
  ********************************************************************/
 
-static WERROR elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
+static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
 {
        EVENTLOG_INFO *elog;
        
        /* first thing is to validate the eventlog name */
        
        if ( !elog_validate_logname( logname ) )
-               return WERR_OBJECT_PATH_INVALID;
+               return NT_STATUS_OBJECT_PATH_INVALID;
        
        if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
-               return WERR_NOMEM;
+               return NT_STATUS_NO_MEMORY;
                
        elog->logname = talloc_strdup( elog, logname );
        
@@ -153,10 +196,10 @@ static WERROR elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd
           in a single process */
 
        become_root();
-       elog->tdb = elog_open_tdb( elog->logname );
+       elog->etdb = elog_open_tdb( elog->logname, False );
        unbecome_root();
 
-       if ( !elog->tdb ) {
+       if ( !elog->etdb ) {
                /* according to MSDN, if the logfile cannot be found, we should
                  default to the "Application" log */
        
@@ -169,26 +212,26 @@ static WERROR elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd
                        /* do the access check */
                        if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
                                TALLOC_FREE( elog );
-                               return WERR_ACCESS_DENIED;
+                               return NT_STATUS_ACCESS_DENIED;
                        }
        
                        become_root();
-                       elog->tdb = elog_open_tdb( elog->logname );
+                       elog->etdb = elog_open_tdb( elog->logname, False );
                        unbecome_root();
                }       
                
-               if ( !elog->tdb ) {
+               if ( !elog->etdb ) {
                        TALLOC_FREE( elog );
-                       return WERR_ACCESS_DENIED;      /* ??? */               
+                       return NT_STATUS_ACCESS_DENIED; /* ??? */               
                }
        }
        
        /* now do the access check.  Close the tdb if we fail here */
 
        if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
-               elog_close_tdb( elog->tdb );
+               elog_close_tdb( elog->etdb, False );
                TALLOC_FREE( elog );
-               return WERR_ACCESS_DENIED;
+               return NT_STATUS_ACCESS_DENIED;
        }
        
        /* create the policy handle */
@@ -196,22 +239,31 @@ static WERROR elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd
        if ( !create_policy_hnd
             ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
                free_eventlog_info( elog );
-               return WERR_NOMEM;
+               return NT_STATUS_NO_MEMORY;
        }
 
-       return WERR_OK;
+       /* set the initial current_record pointer */
+
+       if ( !get_oldest_entry_hook( elog ) ) {
+               DEBUG(3,("elog_open: Successfully opened eventlog but can't "
+                       "get any information on internal records!\n"));
+       }       
+
+       elog->current_record = elog->oldest_entry;
+
+       return NT_STATUS_OK;
 }
 
 /********************************************************************
  ********************************************************************/
 
-static WERROR elog_close( pipes_struct *p, POLICY_HND *hnd )
+static NTSTATUS elog_close( pipes_struct *p, POLICY_HND *hnd )
 {
         if ( !( close_policy_hnd( p, hnd ) ) ) {
-                return WERR_BADFID;
+                return NT_STATUS_INVALID_HANDLE;
         }
 
-       return WERR_OK;
+       return NT_STATUS_OK;
 }
 
 /*******************************************************************
@@ -219,12 +271,12 @@ static WERROR elog_close( pipes_struct *p, POLICY_HND *hnd )
 
 static int elog_size( EVENTLOG_INFO *info )
 {
-       if ( !info || !info->tdb ) {
+       if ( !info || !info->etdb ) {
                DEBUG(0,("elog_size: Invalid info* structure!\n"));
                return 0;
        }
 
-       return elog_tdb_size( info->tdb, NULL, NULL );
+       return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
 }
 
 /********************************************************************
@@ -232,7 +284,7 @@ static int elog_size( EVENTLOG_INFO *info )
   Eventlog_entry.  returns NULL if it can't get the record for some reason.
  ********************************************************************/
 
-Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
+static Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
                                     int recno, Eventlog_entry * ee )
 {
        TDB_DATA ret, key;
@@ -240,15 +292,13 @@ Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
        int srecno;
        int reclen;
        int len;
-       uint8 *rbuff;
 
        pstring *wpsource, *wpcomputer, *wpsid, *wpstrs, *puserdata;
 
        key.dsize = sizeof( int32 );
-       rbuff = NULL;
 
        srecno = recno;
-       key.dptr = ( char * ) &srecno;
+       key.dptr = ( uint8 * ) &srecno;
 
        ret = tdb_fetch( tdb, key );
 
@@ -335,7 +385,7 @@ Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
  since it uses the table to find the tdb handle
  ********************************************************************/
 
-static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
+static bool sync_eventlog_params( EVENTLOG_INFO *info )
 {
        pstring path;
        uint32 uiMaxSize;
@@ -348,7 +398,7 @@ static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
 
        DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
 
-       if ( !info->tdb ) {
+       if ( !info->etdb ) {
                DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
                return False;
        }
@@ -358,15 +408,14 @@ static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
        uiRetention = 604800;
 
        /* the general idea is to internally open the registry 
-          key and retreive the values.  That way we can continue 
+          key and retrieve the values.  That way we can continue 
           to use the same fetch/store api that we use in 
           srv_reg_nt.c */
 
        pstr_sprintf( path, "%s/%s", KEY_EVENTLOG, elogname );
 
-       wresult =
-               regkey_open_internal( &keyinfo, path, get_root_nt_token(  ),
-                                     REG_KEY_READ );
+       wresult = regkey_open_internal( NULL, &keyinfo, path,
+                                       get_root_nt_token(  ), REG_KEY_READ );
 
        if ( !W_ERROR_IS_OK( wresult ) ) {
                DEBUG( 4,
@@ -389,54 +438,14 @@ static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
        if ( ( val = regval_ctr_getvalue( values, "MaxSize" ) ) != NULL )
                uiMaxSize = IVAL( regval_data_p( val ), 0 );
 
-       regkey_close_internal( keyinfo );
+       TALLOC_FREE( keyinfo );
 
-       tdb_store_int32( info->tdb, EVT_MAXSIZE, uiMaxSize );
-       tdb_store_int32( info->tdb, EVT_RETENTION, uiRetention );
-
-       return True;
-}
-
-/********************************************************************
-********************************************************************/
-
-static BOOL get_num_records_hook( EVENTLOG_INFO * info )
-{
-       int next_record;
-       int oldest_record;
-
-       if ( !info->tdb ) {
-               DEBUG( 10, ( "No open tdb for %s\n", info->logname ) );
-               return False;
-       }
-
-       /* lock the tdb since we have to get 2 records */
-
-       tdb_lock_bystring( info->tdb, EVT_NEXT_RECORD, 1 );
-       next_record = tdb_fetch_int32( info->tdb, EVT_NEXT_RECORD);
-       oldest_record = tdb_fetch_int32( info->tdb, EVT_OLDEST_ENTRY);
-       tdb_unlock_bystring( info->tdb, EVT_NEXT_RECORD);
-
-       DEBUG( 8,
-              ( "Oldest Record %d; Next Record %d\n", oldest_record,
-                next_record ) );
-
-       info->num_records = ( next_record - oldest_record );
-       info->oldest_entry = oldest_record;
+       tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
+       tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
 
        return True;
 }
 
-/********************************************************************
- ********************************************************************/
-
-static BOOL get_oldest_entry_hook( EVENTLOG_INFO * info )
-{
-
-       /* it's the same thing */
-       return get_num_records_hook( info );
-}
-
 /********************************************************************
  ********************************************************************/
 
@@ -534,7 +543,7 @@ static Eventlog_entry *read_package_entry( prs_struct * ps,
 /********************************************************************
  ********************************************************************/
 
-static BOOL add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
+static bool add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
                                Eventlog_entry * ee_new )
 {
        Eventlog_entry *insert_point;
@@ -560,13 +569,13 @@ static BOOL add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
 /********************************************************************
  ********************************************************************/
 
-WERROR _eventlog_open_eventlog( pipes_struct * p,
+NTSTATUS _eventlog_open_eventlog( pipes_struct * p,
                                EVENTLOG_Q_OPEN_EVENTLOG * q_u,
                                EVENTLOG_R_OPEN_EVENTLOG * r_u )
 {
        fstring servername, logname;
        EVENTLOG_INFO *info;
-       WERROR wresult;
+       NTSTATUS result;
 
        fstrcpy( servername, "" );
        if ( q_u->servername.string ) {
@@ -588,29 +597,29 @@ WERROR _eventlog_open_eventlog( pipes_struct * p,
        /* according to MSDN, if the logfile cannot be found, we should
          default to the "Application" log */
          
-       if ( !W_ERROR_IS_OK( wresult = elog_open( p, logname, &r_u->handle )) )
-               return wresult;
+       if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, &r_u->handle )) )
+               return result;
 
        if ( !(info = find_eventlog_info_by_hnd( p, &r_u->handle )) ) {
                DEBUG(0,("_eventlog_open_eventlog: eventlog (%s) opened but unable to find handle!\n",
                        logname ));
                elog_close( p, &r_u->handle );
-               return WERR_BADFID;
+               return NT_STATUS_INVALID_HANDLE;
        }
 
        DEBUG(10,("_eventlog_open_eventlog: Size [%d]\n", elog_size( info )));
 
        sync_eventlog_params( info );
-       prune_eventlog( info->tdb );
+       prune_eventlog( ELOG_TDB_CTX(info->etdb) );
 
-       return WERR_OK;
+       return NT_STATUS_OK;
 }
 
 /********************************************************************
  This call still needs some work
  ********************************************************************/
 
-WERROR _eventlog_clear_eventlog( pipes_struct * p,
+NTSTATUS _eventlog_clear_eventlog( pipes_struct * p,
                                 EVENTLOG_Q_CLEAR_EVENTLOG * q_u,
                                 EVENTLOG_R_CLEAR_EVENTLOG * r_u )
 {
@@ -618,147 +627,317 @@ WERROR _eventlog_clear_eventlog( pipes_struct * p,
        pstring backup_file_name;
 
        if ( !info )
-               return WERR_BADFID;
+               return NT_STATUS_INVALID_HANDLE;
 
        pstrcpy( backup_file_name, "" );
        if ( q_u->backupfile.string ) {
                rpcstr_pull( backup_file_name, q_u->backupfile.string->buffer,
                             sizeof( backup_file_name ),
                             q_u->backupfile.string->uni_str_len * 2, 0 );
+
+               DEBUG(8,( "_eventlog_clear_eventlog: Using [%s] as the backup "
+                       "file name for log [%s].",
+                        backup_file_name, info->logname ) );
        }
 
-       DEBUG( 8,
-              ( "_eventlog_clear_eventlog: Using [%s] as the backup file name for log [%s].",
-                backup_file_name, info->logname ) );
+       /* check for WRITE access to the file */
+
+       if ( !(info->access_granted&SA_RIGHT_FILE_WRITE_DATA) )
+               return NT_STATUS_ACCESS_DENIED;
 
-#if 0 
-       /* close the current one, reinit */
+       /* Force a close and reopen */
 
-       tdb_close( info->tdb ); 
+       elog_close_tdb( info->etdb, True ); 
+       become_root();
+       info->etdb = elog_open_tdb( info->logname, True );
+       unbecome_root();
 
-       if ( !(info->tdb = elog_init_tdb( ttdb[i].tdbfname )) )
-               return WERR_ACCESS_DENIED;
-#endif
+       if ( !info->etdb )
+               return NT_STATUS_ACCESS_DENIED;
 
-       return WERR_OK;
+       return NT_STATUS_OK;
 }
 
 /********************************************************************
  ********************************************************************/
 
-WERROR _eventlog_close_eventlog( pipes_struct * p,
-                                EVENTLOG_Q_CLOSE_EVENTLOG * q_u,
-                                EVENTLOG_R_CLOSE_EVENTLOG * r_u )
+NTSTATUS _eventlog_CloseEventLog( pipes_struct * p, struct eventlog_CloseEventLog *r )
 {
-       return elog_close( p, &q_u->handle );
+       return elog_close( p, r->in.handle );
 }
 
 /********************************************************************
  ********************************************************************/
 
-WERROR _eventlog_read_eventlog( pipes_struct * p,
+NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
                                EVENTLOG_Q_READ_EVENTLOG * q_u,
                                EVENTLOG_R_READ_EVENTLOG * r_u )
 {
        EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
        Eventlog_entry entry, *ee_new;
-
        uint32 num_records_read = 0;
        prs_struct *ps;
        int bytes_left, record_number;
-       TDB_CONTEXT *tdb;
+       uint32 elog_read_type, elog_read_dir;
+
+       if (info == NULL) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
 
        info->flags = q_u->flags;
        ps = &p->out_data.rdata;
 
        bytes_left = q_u->max_read_size;
-       tdb = info->tdb;
-       if ( !tdb ) {
-               return WERR_EVENTLOG_FILE_CORRUPT;
+
+       if ( !info->etdb ) 
+               return NT_STATUS_ACCESS_DENIED;
+               
+       /* check for valid flags.  Can't use the sequential and seek flags together */
+
+       elog_read_type = q_u->flags & (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ);
+       elog_read_dir = q_u->flags & (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ);
+
+       if ( elog_read_type == (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ) 
+               ||  elog_read_dir == (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ) )
+       {
+               DEBUG(3,("_eventlog_read_eventlog: Invalid flags [0x%x] for ReadEventLog\n", q_u->flags));
+               return NT_STATUS_INVALID_PARAMETER;
        }
 
-       /* DEBUG(8,("Bytes left is %d\n",bytes_left)); */
+       /* a sequential read should ignore the offset */
 
-       record_number = q_u->offset;
+       if ( elog_read_type & EVENTLOG_SEQUENTIAL_READ )
+               record_number = info->current_record;
+       else 
+               record_number = q_u->offset;
 
        while ( bytes_left > 0 ) {
-               if ( get_eventlog_record
-                    ( ps, tdb, record_number, &entry ) ) {
-                       DEBUG( 8,
-                              ( "Retrieved record %d\n", record_number ) );
+
+               /* assume that when the record fetch fails, that we are done */
+
+               if ( !get_eventlog_record ( ps, ELOG_TDB_CTX(info->etdb), record_number, &entry ) ) 
+                       break;
+
+               DEBUG( 8, ( "Retrieved record %d\n", record_number ) );
                               
-                       /* Now see if there is enough room to add */
-                       ee_new = read_package_entry( ps, q_u, r_u,&entry );
-                       if ( !ee_new )
-                               return WERR_NOMEM;
-
-                       if ( r_u->num_bytes_in_resp + ee_new->record.length >
-                            q_u->max_read_size ) {
-                               r_u->bytes_in_next_record =
-                                       ee_new->record.length;
-                                       
-                               /* response would be too big to fit in client-size buffer */
+               /* Now see if there is enough room to add */
+
+               if ( !(ee_new = read_package_entry( ps, q_u, r_u,&entry )) )
+                       return NT_STATUS_NO_MEMORY;
+
+               if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
+                       r_u->bytes_in_next_record = ee_new->record.length;
+
+                       /* response would be too big to fit in client-size buffer */
                                
-                               bytes_left = 0;
-                               break;
-                       }
+                       bytes_left = 0;
+                       break;
+               }
                        
-                       add_record_to_resp( r_u, ee_new );
-                       bytes_left -= ee_new->record.length;
-                       ZERO_STRUCT( entry );
-                       num_records_read =
-                               r_u->num_records - num_records_read;
+               add_record_to_resp( r_u, ee_new );
+               bytes_left -= ee_new->record.length;
+               ZERO_STRUCT( entry );
+               num_records_read = r_u->num_records - num_records_read;
                                
-                       DEBUG( 10,
-                              ( "_eventlog_read_eventlog: read [%d] records for a total of [%d] records using [%d] bytes out of a max of [%d].\n",
-                                num_records_read, r_u->num_records,
-                                r_u->num_bytes_in_resp,
-                                q_u->max_read_size ) );
-               } else {
-                       DEBUG( 8, ( "get_eventlog_record returned NULL\n" ) );
-                       return WERR_NOMEM;      /* wrong error - but return one anyway */
-               }
-
+               DEBUG( 10, ( "_eventlog_read_eventlog: read [%d] records for a total "
+                       "of [%d] records using [%d] bytes out of a max of [%d].\n",
+                        num_records_read, r_u->num_records,
+                        r_u->num_bytes_in_resp,
+                        q_u->max_read_size ) );
 
                if ( info->flags & EVENTLOG_FORWARDS_READ )
                        record_number++;
                else
                        record_number--;
+               
+               /* update the eventlog record pointer */
+               
+               info->current_record = record_number;
        }
-       
-       return WERR_OK;
+
+       /* crazy by WinXP uses NT_STATUS_BUFFER_TOO_SMALL to 
+          say when there are no more records */
+
+       return (num_records_read ? NT_STATUS_OK : NT_STATUS_BUFFER_TOO_SMALL);
 }
 
 /********************************************************************
  ********************************************************************/
 
-WERROR _eventlog_get_oldest_entry( pipes_struct * p,
+NTSTATUS _eventlog_get_oldest_entry( pipes_struct * p,
                                   EVENTLOG_Q_GET_OLDEST_ENTRY * q_u,
                                   EVENTLOG_R_GET_OLDEST_ENTRY * r_u )
 {
        EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
 
+       if (info == NULL) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
+
        if ( !( get_oldest_entry_hook( info ) ) )
-               return WERR_BADFILE;
+               return NT_STATUS_ACCESS_DENIED;
 
        r_u->oldest_entry = info->oldest_entry;
 
-       return WERR_OK;
+       return NT_STATUS_OK;
 }
 
 /********************************************************************
  ********************************************************************/
 
-WERROR _eventlog_get_num_records( pipes_struct * p,
+NTSTATUS _eventlog_get_num_records( pipes_struct * p,
                                  EVENTLOG_Q_GET_NUM_RECORDS * q_u,
                                  EVENTLOG_R_GET_NUM_RECORDS * r_u )
 {
        EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
 
+       if (info == NULL) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
+
        if ( !( get_num_records_hook( info ) ) )
-               return WERR_BADFILE;
+               return NT_STATUS_ACCESS_DENIED;
 
        r_u->num_records = info->num_records;
 
-       return WERR_OK;
+       return NT_STATUS_OK;
+}
+
+NTSTATUS _eventlog_ClearEventLogW(pipes_struct *p, struct eventlog_ClearEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_BackupEventLogW(pipes_struct *p, struct eventlog_BackupEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_DeregisterEventSource(pipes_struct *p, struct eventlog_DeregisterEventSource *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_GetNumRecords(pipes_struct *p, struct eventlog_GetNumRecords *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_GetOldestRecord(pipes_struct *p, struct eventlog_GetOldestRecord *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ChangeNotify(pipes_struct *p, struct eventlog_ChangeNotify *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p, struct eventlog_OpenEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_RegisterEventSourceW(pipes_struct *p, struct eventlog_RegisterEventSourceW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenBackupEventLogW(pipes_struct *p, struct eventlog_OpenBackupEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReadEventLogW(pipes_struct *p, struct eventlog_ReadEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReportEventW(pipes_struct *p, struct eventlog_ReportEventW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ClearEventLogA(pipes_struct *p, struct eventlog_ClearEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_BackupEventLogA(pipes_struct *p, struct eventlog_BackupEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenEventLogA(pipes_struct *p, struct eventlog_OpenEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
 }
+
+NTSTATUS _eventlog_RegisterEventSourceA(pipes_struct *p, struct eventlog_RegisterEventSourceA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenBackupEventLogA(pipes_struct *p, struct eventlog_OpenBackupEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReadEventLogA(pipes_struct *p, struct eventlog_ReadEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReportEventA(pipes_struct *p, struct eventlog_ReportEventA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_RegisterClusterSvc(pipes_struct *p, struct eventlog_RegisterClusterSvc *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_DeregisterClusterSvc(pipes_struct *p, struct eventlog_DeregisterClusterSvc *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_WriteClusterEvents(pipes_struct *p, struct eventlog_WriteClusterEvents *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_GetLogIntormation(pipes_struct *p, struct eventlog_GetLogIntormation *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_FlushEventLog(pipes_struct *p, struct eventlog_FlushEventLog *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+