<div class="content"><p> </p><p>The EvtRpcGetChannelConfig (opnum 20) method is used by a
client to get the configuration for a channel. </p><dl>
<dd>
<div><pre> error_status_t EvtRpcGetChannelConfig(
   /* [in] RPC_BINDING_HANDLE binding, {the binding handle will be generated by MIDL} */
   [in, range(1, MAX_RPC_CHANNEL_NAME_LENGTH), string] 
     LPCWSTR channelPath,
   [in] DWORD flags,
   [out] EvtRpcVariantList* props
 );
</pre></div>
</dd></dl><p><b>binding: </b>An RPC binding handle as specified in
section <span><a href="1285c318-9f8c-4c6a-a963-7999557bf8d8" data-linktype="relative-path">2.2.21</a></span>.</p><p><b>channelPath: </b>A pointer to a string that
contains the name of a channel for which the information is needed.</p><p><b>flags: </b>A 32-bit unsigned integer that MUST be
set to zero when sent and MAY be ignored on receipt.<a id="Appendix_A_Target_38"></a><a aria-label="Product behavior note 38" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_38" data-linktype="relative-path">&lt;38&gt;</a></p><p><b>props: </b>A pointer to an EvtRpcVariantList
structure to be filled with channel properties, as defined in the following
table.</p><dl>
<dd>
<p><b>Note</b>  The index column in the
following table is the array index, not the actual field of the <b>EvtRpcVariantList</b>
structure. The returned data is an array of <b>EvtRpcVariantList</b> for which
the index value is used to identify the elements in the array. For example,
index 0 means the first element of the returned array.</p>
</dd>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Index</p>
   </th>
   <th>
   <p>Type</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>0</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>Enabled. If true, the channel can accept new events.
  If false, any attempts to write events into this channel are automatically
  dropped.</p>
  </td>
 </tr><tr>
  <td>
  <p>1</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Channel Isolation. It defines the default access
  permissions for the channel. Three values are allowed: </p>
  <ul><li><p><span><span>  
  </span></span><span>0: Application.</span></p>
  </li><li><p><span><span>  
  </span></span><span>1: System. </span></p>
  </li><li><p><span><span>  
  </span></span><span>2: Custom. </span></p>
  </li></ul><p> </p>
  <p>The default isolation is Application. The default
  permissions for Application are (shown using SDDL):</p>
  <ul><li><p><span><span>  
  </span></span><span>L&#34;O:BAG:SYD:&#34;</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0xf0007;;;SY)&#34; //
  local system (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x7;;;BA)&#34; //
  built-in admins (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x7;;;SO)&#34; //
  server operators (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;IU)&#34; //
  INTERACTIVE LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;SU)&#34; //
  SERVICES LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;S-1-5-3)&#34;
  // BATCH LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;S-1-5-33)&#34;
  // write restricted service (read,write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;S-1-5-32-573)&#34;;
  // event log readers (read)</span></p>
  </li></ul><p> </p>
  <p>The default permissions for System are (shown using
  SDDL):</p>
  <ul><li><p><span><span>  
  </span></span><span>L&#34;O:BAG:SYD:&#34;</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0xf0007;;;SY)&#34; //
  local system (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x7;;;BA)&#34; //
  built-in admins (read, write, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;BO)&#34; //
  backup operators (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x5;;;SO)&#34; //
  server operators (read, clear)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;IU)&#34; // INTERACTIVE
  LOGON (read)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x3;;;SU)&#34; //
  SERVICES LOGON (read, write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;S-1-5-3)&#34;
  // BATCH LOGON (read)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x2;;;S-1-5-33)&#34;
  // write restricted service (write)</span></p>
  </li><li><p><span><span>  
  </span></span><span>L&#34;(A;;0x1;;;S-1-5-32-573)&#34;;
  // event log readers (read)</span></p>
  </li></ul><p> </p>
  <p>When the Custom value is used, the Access property
  will contain the defined SDDL.</p>
  </td>
 </tr><tr>
  <td>
  <p>2</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Channel type. One of four values:</p>
  <ul><li><p><span><span>  
  </span></span><span>0: Admin</span></p>
  </li><li><p><span><span>  
  </span></span><span>1: Operational</span></p>
  </li><li><p><span><span>  
  </span></span><span>2: Analytic</span></p>
  </li><li><p><span><span>  
  </span></span><span>3: Debug</span></p>
  </li></ul><p> </p>
  <p>For more information, see <span><a href="https://go.microsoft.com/fwlink/?LinkId=208452" data-linktype="external">[MSDN-EVTLGCHWINEVTLG]</a></span>.</p>
  </td>
 </tr><tr>
  <td>
  <p>3</p>
  </td>
  <td>
  <p>EvtRpcVarTypeString</p>
  </td>
  <td>
  <p>OwningPublisher. Name of the publisher that defines
  and registers the channel with the system. For more information on how the
  server reacts to changes of this property, see section <span><a href="e02828fd-873d-4cc5-9b60-23ef31987275" data-linktype="relative-path">3.1.4.22</a></span>.</p>
  </td>
 </tr><tr>
  <td>
  <p>4</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>ClassicEventlog. If true, the channel represents an <span><a href="fda52b23-608b-444e-a979-6b62a00e8f48#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event
  log</a></span> created according to the EventLog Remoting Protocol, not this
  protocol (EventLog Remoting Protocol Version 6.0). The server maintains two
  channel tables: one for the EventLog Remoting Protocol Version 6.0 and one
  for the legacy EventLog Remoting Protocol. The table for the legacy EventLog
  Remoting Protocol is called &#34;log table&#34;. For more information on
  the legacy &#34;log table&#34;, see <span><a href="../ms-even/55b13664-f739-4e4e-bd8d-04eeda59d09f" data-linktype="relative-path">[MS-EVEN]</a></span>.
  Any channel coming from the new &#34;channel table&#34; gets the value as
  false, any channel name that is in the legacy &#34;log table&#34; gets the
  value as true.</p>
  </td>
 </tr><tr>
  <td>
  <p>5</p>
  </td>
  <td>
  <p>EvtRpcVarTypeString</p>
  </td>
  <td>
  <p>Access. A Security Descriptor Description Language
  (SDDL) string, as specified in <span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>,
  that represents access permissions to the channels. If the <b>isolation</b>
  attribute is set to Application or System, the access descriptor controls
  read access to the file (the write permissions are ignored). If the <b>isolation</b>
  attribute is set to Custom, the access descriptor controls write access to
  the channel and read access to the file.</p>
  </td>
 </tr><tr>
  <td>
  <p>6</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>Retention. If set to true, events can never be
  overwritten unless explicitly cleared. If set to false, events are
  overwritten as needed when the event log is full.</p>
  </td>
 </tr><tr>
  <td>
  <p>7</p>
  </td>
  <td>
  <p>EvtRpcVarTypeBoolean</p>
  </td>
  <td>
  <p>AutoBackup. When set to true, the event log file
  associated with the channel is closed as soon as it reaches the maximum size
  specified by the MaxSize property, and a new file is opened to accept new
  events. If the new file reaches maximum size, another new file will be
  generated and the previous new file will be backed up. The events in backed
  up files cannot be queried from this channel in the server unless the client
  specifies the backup log file names in a separate query.</p>
  </td>
 </tr><tr>
  <td>
  <p>8</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt64</p>
  </td>
  <td>
  <p>MaxSize. The value that indicates at which point the
  size (in bytes) of the event log file stops increasing. When the size is
  greater than or equal to this value, the file growth stops.</p>
  </td>
 </tr><tr>
  <td>
  <p>9</p>
  </td>
  <td>
  <p>EvtRpcVarTypeString</p>
  </td>
  <td>
  <p>LogFilePath. File path to the event log file for the
  channel. The path is saved in the channel config and read out by the server
  when client requests it.</p>
  </td>
 </tr><tr>
  <td>
  <p>10</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Level. Events with a level property less than or equal
  to this specified value are logged to the channel.</p>
  </td>
 </tr><tr>
  <td>
  <p>11</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt64</p>
  </td>
  <td>
  <p>Keywords. Events with a keyword bit contained in the
  Keywords bitmask set are logged to the channel.</p>
  </td>
 </tr><tr>
  <td>
  <p>12</p>
  </td>
  <td>
  <p>EvtRpcVarTypeGuid</p>
  </td>
  <td>
  <p>ControlGuid. A GUID value. The client SHOULD ignore
  this value.</p>
  </td>
 </tr><tr>
  <td>
  <p>13</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt64</p>
  </td>
  <td>
  <p>BufferSize. Size of the events buffer (in kilobytes)
  used for asynchronous event delivery. This property is for providing events.
  Typically the events generated by a publisher are first written to memory
  buffers on the server. Once the buffer used is full, that buffer is written
  to a disk file. The BufferSize is used to specify the size of the buffer. The
  server allocates buffers according to the BufferSize value. The number of
  buffers the server can allocate is controlled by the MinBuffers and
  MaxBuffers properties. The server&#39;s specific implementation can allocate any
  number of buffers between MinBuffers and MaxBuffers.</p>
  </td>
 </tr><tr>
  <td>
  <p>14</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>MinBuffers. The minimum number of buffers used for
  asynchronous event delivery. For more information, see the preceding
  BufferSize information.</p>
  </td>
 </tr><tr>
  <td>
  <p>15</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>MaxBuffers. The maximum number of buffers used for
  asynchronous event delivery. For more information, see the preceding
  BufferSize information.</p>
  </td>
 </tr><tr>
  <td>
  <p>16</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>Latency. The number of seconds of inactivity (if
  events are delivered asynchronously and no new events are arriving) after
  which the event buffers MUST be flushed to the server. As specified in the
  description for BufferSize property, the server keeps a number of buffers
  when writing events. If the buffers are full, the server writes the buffers
  to disk file. However, if a certain amount of time elapses and the buffers
  are still not full, the server SHOULD write the buffers to disk. That certain
  amount of time is the latency property.</p>
  </td>
 </tr><tr>
  <td>
  <p>17</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>ClockType. One of two values:</p>
  <ul><li><p><span><span>  
  </span></span><span>0: SystemTime. Use the system
  time. When set to this value, the server uses the system time type (which is
  low-resolution on most platforms) for a time stamp field of any event it
  writes into this channel.</span></p>
  </li><li><p><span><span>  
  </span></span><span>1: Query Performance Counter. The
  server uses a high-resolution time type for the time stamp field of any event
  it writes into this channel.</span></p>
  <p><b><span>Note</span></b><span>  The
  timestamp is simply written into the event without any special handling.
  Which is to say, the server behavior does not change if a channel&#39;s Clock
  type is SystemTime or Query Performance Counter.</span></p>
  </li></ul><p> </p>
  </td>
 </tr><tr>
  <td>
  <p>18</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUInt32</p>
  </td>
  <td>
  <p>SIDType. One of two values:</p>
  <ul><li><p><span><span>  
  </span></span><span>0: The events written by the
  server to this channel will not include the publisher&#39;s SID.</span></p>
  </li><li><p><span><span>  
  </span></span><span>1: The events written by the
  server to this channel will include the publisher&#39;s SID.</span></p>
  </li></ul><p> </p>
  </td>
 </tr><tr>
  <td>
  <p>19</p>
  </td>
  <td>
  <p>EvtRpcVarTypeStringArray</p>
  </td>
  <td>
  <p>PublisherList. List of publishers that can raise
  events into the channel. This returns the same list as is returned by the <b>EvtRpcGetPublisherList</b>
  method, as specified in section <span><a href="fe5a6b1f-db18-4e7c-b680-555338aece0b" data-linktype="relative-path">3.1.4.24</a></span>. </p>
  </td>
 </tr><tr>
  <td>
  <p>20</p>
  </td>
  <td>
  <p>EvtRpcVarTypeUint32</p>
  </td>
  <td>
  <p>FileMax. Maximum number of log files associated with
  an analytic or debug channel. When the number of logs reaches the specified
  maximum, the system begins to overwrite the logs, beginning with the oldest.
  A FileMax value of 0 or 1 indicates that only one file is associated with
  this channel. A FileMax of 0 is default.<a id="Appendix_A_Target_39"></a><a aria-label="Product behavior note 39" href="65f22d62-5f0f-4306-85c4-50fb9e77075b#Appendix_A_39" data-linktype="relative-path">&lt;39&gt;</a></p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>Return Values: </b>The method MUST return ERROR_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-specific
nonzero value as specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p>In response to this request from the client, the server MUST
verify that the <i>channelPath</i> parameter specifies a valid channel name.
The server MUST fail the method if the parameter is invalid with the error
ERROR_INVALID_PARAMETER (0x00000057). The server checks if a channel name is
valid by searching the given name in its channel table.</p><p>Next, the server MUST verify that the caller has read access
to the information and MUST fail the method if the caller does not have read
access with the error ERROR_ACCESS_DENIED (0x00000005). To perform the access
check, the server SHOULD first determine the identity of the caller.
Information determining the identity of the caller for the purpose of
performing an access check is specified in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/326c9de1-4602-4d78-848d-8b4e11e6ed80" data-linktype="relative-path">3.2.3.4.2</a></span>.
Then, if the client specifies a channel, the server SHOULD read the channel&#39;s
access property (as specified in section 3.1.4.21) as the security descriptor
string. Next, the server SHOULD be able to perform the write and clear access
check using the Access Check algorithm (as specified in [MS-DTYP] section <span><a href="../ms-dtyp/4f1bbcbb-814a-4c70-a11e-2a5b8779a6f9" data-linktype="relative-path">2.5.3.2</a></span>).
</p><p>If the previous checks succeed, the server MUST attempt to
return the list of a channel&#39;s properties. The server MUST fill the output
parameter <i>props</i> with all the properties for the channel (which are
specified in the preceding <i>props</i> properties table) into an <span><a href="9c6673b7-4bf2-42b0-9ab7-242d45ead8ff" data-linktype="relative-path">EvtRpcVariant</a></span>
list. The server SHOULD only fail the method if the system memory is inadequate
with the error ERROR_OUTOFMEMORY (0x0000000E). The client MUST NOT interpret
the values in this list. They MUST be passed uninterpreted to the higher-layer
protocol or client application. For more information, see <span><a href="https://go.microsoft.com/fwlink/?LinkId=90000" data-linktype="external">[MSDN-EVENTS]</a></span>.
</p><p>Note that in the interval between a client calling the
EvtRpcPutChannelConfig and <span><a href="79e81642-5ef1-4963-9e77-798d2a6c2b1a" data-linktype="relative-path">EvtRpcAssertConfig</a></span>
methods, the server holds two copies of the channel properties. One copy is
held in the channel table. The other copy is an encapsulated but inactive set
of properties created by EvtRpcPutChannelConfig that is held in temporary
storage. The server MUST return the properties held in the channel table. It
MUST NOT return the encapsulated but inactive set of properties created by
EvtRpcPutChannelConfig. See EvtRpcAssertConfig (section 3.1.4.29) for
more information.</p><p>The server MUST NOT update its state as a result of this
method, nor SHOULD the server apply any channel properties. The server SHOULD
always return ERROR_SUCCESS (0x00000000) if the inputs are valid, because
reading the channel properties SHOULD never fail.</p><p>The server MUST return a value indicating success or failure
for this operation.</p></div>