<div class="content"><p> </p><p>The EvtRpcGetPublisherMetadata (Opnum 24) method is used by
a client to open a handle to <span><a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_62964c35-9cf0-4e93-bbb6-a6d2dd85df2d" data-linktype="relative-path">publisher metadata</a></span>.
It also gets some initial information from the metadata.</p><dl>
<dd>
<div><pre> error_status_t EvtRpcGetPublisherMetadata(
   /* [in] RPC_BINDING_HANDLE binding, {the binding handle will be generated by MIDL} */
   [in, unique, range(0, MAX_RPC_PUBLISHER_ID_LENGTH), string] 
     LPCWSTR publisherId,
   [in, unique, range(0, MAX_RPC_FILE_PATH_LENGTH), string] 
     LPCWSTR logFilePath,
   [in] LCID locale,
   [in] DWORD flags,
   [out] EvtRpcVariantList* pubMetadataProps,
   [out, context_handle] PCONTEXT_HANDLE_PUBLISHER_METADATA* pubMetadata
 );
</pre></div>
</dd></dl><p><b>binding: </b>An RPC binding handle as specified in
section <span><a href="1285c318-9f8c-4c6a-a963-7999557bf8d8" data-linktype="relative-path">2.2.21</a></span>.</p><p><b>publisherId: </b>A pointer to a string that
contains the publisher for which information is needed.</p><p><b>logFilePath: </b>A pointer to a null string that
MUST be ignored on receipt.</p><p><b>locale: </b>A Locale value, as specified in <span><a href="../ms-gpsi/8ac65057-0663-45e5-9718-f490e87945dc" data-linktype="relative-path">[MS-GPSI]</a></span>.
This is used later if the <i>pubMetadata</i> handle is used for rendering.</p><p><b>flags: </b>A 32-bit unsigned integer that MUST be
set to zero when sent and MAY be ignored on receipt.<a id="Appendix_A_Target_48"></a><a aria-label="Product behavior note 48" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_48" data-linktype="relative-path">&lt;48&gt;</a></p><p><b>pubMetadataProps: </b>A pointer to an <span><a href="14ba9fda-3402-44b2-b1cd-5318a6613a7f" data-linktype="relative-path">EvtRpcVariantList (section 2.2.9)</a></span>
structure containing publisher properties.</p><p><b>pubMetadata: </b>A pointer to a publisher handle.
This parameter is an <span><a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a></span> context handle,
as specified in <span><a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a></span>, Context
Handles. For information on handle security and authentication considerations,
see sections <span><a href="ef007e79-0549-446f-a928-379f47d57cfd" data-linktype="relative-path">2.2.20</a></span> and <span><a href="f4145058-63b4-4c32-816d-a26b3ea6bd7d" data-linktype="relative-path">5.1</a></span>.
</p><p><b>Return Values: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-specific
nonzero value as specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p>In response to this request from the client, the server MUST
verify that the <i>publisherID</i> parameter specifies either a publisher name
or NULL. The server MUST fail the method if the <i>publisherID</i> is non-NULL
and is not the name of a publisher with the error code ERROR_INVALID_PARAMETER
(0x00000057). The server SHOULD check whether the non-NULL <i>publisherID</i>
is in the publisher table to verify whether the <i>publisherID</i> is a
publisher name. If the <i>publisherID</i> parameter is NULL, the server MUST
use the default publisher (as specified in section <span><a href="df904dfb-00f8-4457-abe0-d7907c64dc71" data-linktype="relative-path">3.1.1.14</a></span>).</p><p>Next, the server MUST verify that the caller has read access
to the information and MUST fail the method with the error ERROR_ACCESS_DENIED
(0x00000005) if the caller does not have read access. To perform the access
check, the server SHOULD first determine the identity of the caller.
Information determining the identity of the caller for the purpose of
performing an access check is specified in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/326c9de1-4602-4d78-848d-8b4e11e6ed80" data-linktype="relative-path">3.2.3.4.2</a></span>.
Then the server MAY get the security descriptor of the publisher table. The
server MAY assign a security descriptor when the publisher is registered in its
publisher table or if the publisher entry is built on the server&#39;s file system,
it can get its security descriptor from the file system.<a id="Appendix_A_Target_49"></a><a aria-label="Product behavior note 49" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_49" data-linktype="relative-path">&lt;49&gt;</a> Next, the server SHOULD be able
to perform the read access check using the Access Check algorithm (as specified
in <span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/4f1bbcbb-814a-4c70-a11e-2a5b8779a6f9" data-linktype="relative-path">2.5.3.2</a></span>).
</p><p>If the previous checks succeed, the server MUST attempt to
create a CONTEXT_HANDLE_PUBLISHER_METADATA for the publisher. As specified in
section <span><a href="2a5dd9ce-aef8-4a03-b42d-be9393a5a5e8" data-linktype="relative-path">3.1.1.11</a></span>, the
server SHOULD create a publisher metadata object and then cast it to the
context and assign the handle to the <i>pubMetadata</i> parameter. The server
SHOULD add the newly created handle to its handle table in order to track it.
The server SHOULD only fail the creation of handles in the case of inadequate
memory and return ERROR_OUTOFMEMORY (0x0000000E). The server MUST store the <i>locale</i>
value in the publisher metadata object.</p><p>The server MUST fill an EvtRpcVariantList (for more
information, see section 2.2.9) that contains 29 <span><a href="9c6673b7-4bf2-42b0-9ab7-242d45ead8ff" data-linktype="relative-path">EvtRpcVariants</a></span> and
save them in the <i>pubMetadataProps</i> parameter. As noted in the <i>pubMetadataProps</i>
description, not all of the EvtRpcVariant entries are actually used, and all
unused ones MUST be set to type EvtRpcVarTypeNULL. The following table lists
those entries that are used. </p><table><thead>
  <tr>
   <th>
   <p>Index</p>
   </th>
   <th>
   <p>Type </p>
   </th>
   <th>
   <p>Description </p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>0</p>
  </td>
  <td>
  <p>EvtVarTypeGuid</p>
  </td>
  <td>
  <p>PublisherGuid: This is the identifier of the publisher
  which is mentioned in section <span><a href="0b8da93b-80de-4244-aea2-f3c3fa9c83cb" data-linktype="relative-path">3.1.1.2</a></span>.</p>
  </td>
 </tr><tr>
  <td>
  <p>1</p>
  </td>
  <td>
  <p>EvtVarTypeString</p>
  </td>
  <td>
  <p>ResourceFilePath: This is the publisher resource file
  path which is specified in section 3.1.1.14.</p>
  </td>
 </tr><tr>
  <td>
  <p>2</p>
  </td>
  <td>
  <p>EvtVarTypeString</p>
  </td>
  <td>
  <p>ParameterFilePath: This is the publisher parameter
  file which is specified in section 3.1.1.14.</p>
  </td>
 </tr><tr>
  <td>
  <p>3</p>
  </td>
  <td>
  <p>EvtVarTypeString</p>
  </td>
  <td>
  <p>MessageFilePath: This is the publisher message file
  which is specified in section 3.1.1.14.</p>
  </td>
 </tr><tr>
  <td>
  <p>7</p>
  </td>
  <td>
  <p>EvtVarTypeStringArray</p>
  </td>
  <td>
  <p>ChannelReferencePath: This is the array of the channel
  paths into which the publisher generates events.</p>
  </td>
 </tr><tr>
  <td>
  <p>8</p>
  </td>
  <td>
  <p>EvtVarTypeUInt32Array</p>
  </td>
  <td>
  <p>ChannelReferenceIndex: The channel start index values,
  as specified in section 3.1.1.2.</p>
  </td>
 </tr><tr>
  <td>
  <p>9</p>
  </td>
  <td>
  <p>EvtVarTypeUInt32Array</p>
  </td>
  <td>
  <p>ChannelReferenceID: The channel reference ID values,
  as specified in section 3.1.1.2.</p>
  </td>
 </tr><tr>
  <td>
  <p>10</p>
  </td>
  <td>
  <p>EvtVarTypeUInt32Array</p>
  </td>
  <td>
  <p>ChannelReferenceFlags: The channel reference flags, as
  specified in section 3.1.1.2.</p>
  </td>
 </tr><tr>
  <td>
  <p>11</p>
  </td>
  <td>
  <p>EvtVarTypeUInt32Array</p>
  </td>
  <td>
  <p>ChannelReferenceMessageID: This is the message Ids for
  the channels.</p>
  </td>
 </tr></tbody></table><p>As specified earlier in this section, the server SHOULD find
the publisher entry in its publisher table based on the specified publisherId
parameter from the client. Once the server locates the publisher entry, the
server SHOULD get the publisherGUID, ResourceFilePath, ParameterFilePath,
MessageFilePath, ChannelReferenceIndex, ChannelReferenceID and
ChannelReferenceFlags directly from the publisher table entry (as specified in
sections <span><a href="f10b0008-ffdd-4299-bda6-69842ced8ff9" data-linktype="relative-path">3.1.1.3</a></span> for
publisher tables and 3.1.1.2 for publishers). Then the server SHOULD open the
publisher resource file and locate the channel information in the resource file
(as specified in section 3.1.1.14). Next, the server reads the channel name
strings and channel message IDs, returning them as the result for the
ChannelReferencePath and ChannelReferenceMessageID. See section <span><a href="d0845b03-c130-4281-9e38-065e266f7fd5" data-linktype="relative-path">4.12</a></span>
for an example EvtRpcVariantList containing all 29 EvtRpcVariants.</p><p>If the server can&#39;t allocate enough memory for the returning
parameter <i>pubMetadataProps</i>, it SHOULD return the error ERROR_OUTOFMEMORY
(0x0000000E).</p><p>The server MUST return a value indicating success or failure
for this operation.</p><p>If the server can&#39;t find the corresponding information from
the publisher resource, the server SHOULD set the entry to <i>EvtRpcVarTypeNULL</i>
to indicate some of the values are not retrieved, but SHOULD still proceed with
the other eleven data fields without returning any error. Even if all of the
eleven fields are all not found, the server SHOULD still return ERROR_SUCCESS
(0x00000000).</p></div>