<div class="content"><p> </p><p>The ElfrClearELFW (Opnum 0) method instructs the server to
clear an <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a></span>, and,
optionally, to back up the event log before the clear operation takes place. </p><dl>
<dd>
<div><pre> NTSTATUS ElfrClearELFW(
   [in] IELF_HANDLE LogHandle,
   [in, unique] PRPC_UNICODE_STRING BackupFileName
 );
</pre></div>
</dd></dl><p><b>LogHandle: </b>Handle to the event log to be cleared.
This parameter is a server context handle, as specified in section <span><a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a></span>.
This handle MUST NOT be one obtained via the <span><a href="6dcf59eb-11ca-416f-9cc4-8f6c2979baad" data-linktype="relative-path">ElfrOpenBELA (section 3.1.4.2)</a></span>
method or the <span><a href="4db1601c-7bc2-4d5c-8375-c58a6f8fc7e1" data-linktype="relative-path">ElfrOpenBELW (section 3.1.4.1)</a></span>
method. </p><p><b>BackupFileName: </b>Provides a <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a></span> string (as
specified in section <span><a href="40e4e566-b7fb-46e2-b179-893231f39e8d" data-linktype="relative-path">2.2.11</a></span>) that points
to an <span><a href="c1550f98-a1ce-426a-9991-7509e7c3787c" data-linktype="relative-path">NT Object Path</a></span> of a
file in which a current copy of the event log is to be placed. If this is NULL
or empty, no backup is to be created. The path is relative to the server rather
than the client.</p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p>In response to this request from the client, the server MUST
first check that the handle is valid. The server MUST fail the operation with
the error STATUS_INVALID_HANDLE (0xC0000008) if the handle is invalid or if the
handle is for a <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_ddd2e7db-ea8f-4488-ac5f-e77d59abe9e4" data-linktype="relative-path">backup event log</a></span>.
Handles to backup event logs are obtained via the
ElfrOpenBELW (section 3.1.4.1) method or the
ElfrOpenBELA (section 3.1.4.2) method and have the backup flag set.<a id="Appendix_A_Target_20"></a><a aria-label="Product behavior note 20" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_20" data-linktype="relative-path">&lt;20&gt;</a></p><p><b>Note</b>  The server determines if a handle is
a backup event log handle by looking at the flag for that handle. The handle
that is passed in through the <i>LogHandle</i> parameter is a server context
handle, which means that the server keeps a data structure for the handle when
it is created. If the handle is created for backup purposes, the server puts a
backup tag into the data structure. When the handle is passed back to the
server, the server locates the handle, and checks the corresponding data
structure for that handle to determine if it is a backup handle.<a id="Appendix_A_Target_21"></a><a aria-label="Product behavior note 21" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_21" data-linktype="relative-path">&lt;21&gt;</a> </p><p>If the <i>BackupFileName</i> is non-NULL and non-empty, the
server MUST validate the <i>BackupFileName</i> and fail the call if it is not a
valid name. An invalid name is defined as an illegal NT Object Path or a path
that specifies a file that already exists. If the <i>BackupFileName</i> is
valid, the server MUST attempt to back up the log to the path specified in <i>BackupFileName</i>
before the log is cleared. The method MUST fail the operation and not clear the
log if the user does not have write access to the location specified by the
BackupFileName parameter or if the backup does not succeed for any other
reason.<a id="Appendix_A_Target_22"></a><a aria-label="Product behavior note 22" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_22" data-linktype="relative-path">&lt;22&gt;</a></p><p>If the <i>BackupFileName</i> is NULL or empty, meaning if
the pointer inside the RPC_UNICODE_STRING structure being checked has a size of
zero or the buffer inside of <i>BackupFileName</i> is NULL, the method MUST NOT
attempt to back up the event log <a id="Appendix_A_Target_23"></a><a aria-label="Product behavior note 23" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_23" data-linktype="relative-path">&lt;23&gt;</a> and MUST
return a nonzero NTSTATUS value to indicate the failure of the method. The
server SHOULD return STATUS_INVALID_PARAMETER (0xC000000D).</p><p>If the preceding checks are successful, and if no problems
occur during creation of a backup log, the server MUST attempt to clear the
associated event log. All events MUST be removed during clearing. Additionally,
the state of the log MUST be modified so that the next record written has a
record number 1.<a id="Appendix_A_Target_24"></a><a aria-label="Product behavior note 24" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_24" data-linktype="relative-path">&lt;24&gt;</a> The server MUST return a value
indicating success or failure for this operation. The server MUST return a
value indicating success or failure for this operation. </p></div>