Audit Functions - Win32 Programmer's Reference

Custom Search

Audit Functions

The auditing functions are obsolete on Windows NT. Windows NT uses an integrated event logging mechanism for reporting both audits and errors. The NetAudit and NetErrorLog functions are provided to access LAN Manager 2.x logs. They will report ERROR_NOT_SUPPORTED if called to a Windows NT system.

The auditing functions are:

NetAuditClear
NetAuditRead

Auditing functions control the audit log on a LAN Manager computer. Auditing functions monitor operations on the specified server. If auditing is enabled, each monitored operation generates an audit entry. For example, when a user establishes a connection to the server, a single audit entry is generated.

Audit entries are stored in a binary file called an audit trail or audit log. All Auditing functions perform their operations on this file. LAN Manager defines many types of audit entries.

NetAuditRead reads the audit log. NetAuditClear clears the audit log.

Data Structures
All audit entries include a fixed-length header used in conjunction with variable-length data specific to the entry type. Because of the variable lengths and structures of the ae_data element of the audit entry (it is possible for ae_data to be zero bytes), only the fixed header is defined in the AUDIT_ENTRY structure.

The variable-length portion of the audit entry can contain an offset to a variable-length Unicode string. The offset values are DWORDs. To determine the value of the pointer to this string, add the offset value to the address of ae_data.

The following example illustrates this procedure. Assume that pAE points to a buffer that contains a complete audit entry and that the ae_type member of the AUDIT_ENTRY structure contains the value AE_CONNSTOP, which specifies the predefined AE_CONNSTOP structure. To point the variable pszComputerName to the Unicode string that contains the name of the client whose connection was stopped, an application would perform the following algorithm:

PAUDIT_ENTRY pAE; // Fixed part of audit entry

LPAE_CONNSTOP pAEvar; // Variable-length structure

LPWSTR pszComputerName; // Pointer to var-length string

// Calculate the offset to the variable-length structure.

pAEvar = (_LPAE_CONNSTOP) (((LPBYTE) pAE) + pAE->ae_data_offset);

// Calculate the offset to the computername.

pszComputerName = ((LPBYTE) pAEvar) + pAEvar->ae_cp_compname;

The following structures are specific to the audit entry type The structures follow the AUDIT_ENTRY header, but they are not necessarily contiguous.

Last news from Greatis Software

    Nostalgia .Net     .Net is powerful, but not all-powerful, so sometimes we need to use Win32 API for our .Net applications. It's simple enough with Platform Invoke if you have Win32 skill, but we do not always have time to dig the ancient documentation, declare the special types that are compatible with Win32, find the values of the Win32's constants and so on. Nostalgia .Net offers several simple-to-use classes, and components that will allow you to forget about the headache of Win32 and just use the power of Win32 in your application the same way as you use the native. Net classes. More »

Recommended software for developers

    Ultimate Pack     Component pack for Delphi and C++ Builder that contains runtime form designer, runtime object inspector, print suite and much more for the very special price. More »

    Form Designer .Net     Unique runtime form design solution that allows to edit any form in .Net WinForms application at runtime with full source codes for only 300 euro! More »

    Print Suite .Net     Print Suite .Net is a set of components for easy printing texts, images and grids from your WinForms applications. Full C# source codes are available More »

    Gradient Controls .Net     Gradient Controls .Net offers controls with gradient background feature. Labels, panels and so on... Full C# source codes are available More »

    Greatis iGrid     iGrid plots drawing grid right over your desktop, so you can use it everywhere, with any drawing application without any special plugins for different graphic editors. More »

All the contacts and projects

Dmitry Vasiliev (just.dmitry)

More Online Helps

Win32 Programmer's Reference
Win32 Multimedia Programmer's Reference
OLE Programmer's Reference
Microsoft Windows Pen API Programmer's Reference
Microsoft Windows Sockets 2 Reference
Microsoft Windows Telephony API (TAPI) Programmer's Reference
Unix Manual Pages

greatis just4fun network