<div class="content"><p> </p><p>This method<a id="Appendix_A_Target_32"></a><a aria-label="Product behavior note 32" href="4acc4fbc-1378-4120-83d1-cfb4ae0240e0#Appendix_A_32" data-linktype="relative-path">&lt;32&gt;</a> instructs
the server to write an event to an <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_bb3fad7e-60bf-46d4-9c3f-7caea47a743e" data-linktype="relative-path">event log</a></span>. It
differs from the other methods for writing an event by specifying the <span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_efdc035d-100a-4568-a67f-69fb726fadcb" data-linktype="relative-path">event
source</a></span> at the time of the write. The other methods for writing an
event required the event source to be specified when the handle was opened for
write.</p><dl>
<dd>
<div><pre> NTSTATUS ElfrReportEventAndSourceW(
   [in] IELF_HANDLE LogHandle,
   [in] unsigned long Time,
   [in] unsigned short EventType,
   [in] unsigned short EventCategory,
   [in] unsigned long EventID,
   [in] PRPC_UNICODE_STRING SourceName,
   [in, range(0, 256)] unsigned short NumStrings,
   [in, range(0, 61440)] unsigned long DataSize,
   [in] PRPC_UNICODE_STRING ComputerName,
   [in, unique] PRPC_SID UserSID,
   [in, size_is(NumStrings), unique] 
     PRPC_UNICODE_STRING Strings[*],
   [in, size_is(DataSize), unique] 
    unsigned char* Data,
   [in] unsigned short Flags,
   [in, out, unique] unsigned long* RecordNumber,
   [in, out, unique] unsigned long* TimeWritten
 );
</pre></div>
</dd></dl><p><b>LogHandle: </b>Handle to an event log. This parameter is
a server context handle, as specified in section <span><a href="de54bfbc-fbe4-43b8-b8e1-b8a6b2189604" data-linktype="relative-path">2.2.6</a></span>. This handle
MUST NOT be obtained via the <span><a href="6dcf59eb-11ca-416f-9cc4-8f6c2979baad" data-linktype="relative-path">ElfrOpenBELA (section 3.1.4.2)</a></span>
method or the <span><a href="4db1601c-7bc2-4d5c-8375-c58a6f8fc7e1" data-linktype="relative-path">ElfrOpenBELW (section 3.1.4.1)</a></span>
method.</p><p><b>Time: </b>Time at which the event was generated by the
event source (not the time at which the event was logged). The time MUST be
expressed as the number of seconds since 00:00:00 on January 1, 1970 (UTC). </p><p><b>EventType: </b>Type of the event, as specified in section
<span><a href="1ed850f9-a1fe-4567-a371-02683c6ed3cb" data-linktype="relative-path">2.2.2</a></span>.</p><p><b>EventCategory: </b><span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_218d3b23-9c27-45d5-a861-7b832d392fc6" data-linktype="relative-path">Event category</a></span>, as
specified in section <span><a href="c1f99c2e-b118-45e1-a414-007272fb9d43" data-linktype="relative-path">1.8.5</a></span>.</p><p><b>EventID: </b><span><a href="e74c8719-c30e-4f7a-bef7-82753cc0e159#gt_edce565a-e2b7-40df-ab78-cbb3a49ff3bd" data-linktype="relative-path">EventID</a></span>, as
specified in section <span><a href="123d104a-39fd-4f60-8f7b-fbd9a43f88c1" data-linktype="relative-path">3.1.1.4</a></span>.</p><p><b>SourceName: </b>Specifies the name of the event source.</p><p><b>NumStrings: </b>Number of strings in the array pointed to
by the <i>Strings</i> parameter. If no strings are present, this value MUST be
set to zero.</p><p><b>DataSize: </b>Number of bytes of event-specific raw
binary data to write to the log. This binary data is passed in the <i>Data</i>
parameter. If no event-specific data is present, this parameter MUST be set to
zero.</p><p><b>ComputerName: </b>A string to assist in identifying the
machine that generated the event. In practice, the name of the computer. There
are no character restrictions on this field&#39;s content (for example, a FQDN can
be used).</p><p><b>UserSID: </b>Either NULL or a user SID. If this is NULL,
the event is to have a zero length <b>UserSid</b> field.</p><p><b>Strings: </b>Strings containing text information specific
to the event. This parameter MUST be a valid pointer. If the <i>NumStrings</i>
parameter is zero, this parameter MUST be NULL. For example, an event relating
to file deletion could use a string to specify the path of the file being
deleted.</p><p><b>Data: </b>Pointer to a buffer that contains binary
information specific to the event. This parameter MUST be a valid pointer (or
NULL), even if the DataSize parameter is zero.</p><p><b>Flags: </b>Unused. MUST be set to zero when sent and MUST
be ignored on receipt.</p><p><b>RecordNumber: </b>Unused. Can be set to any arbitrary
value when sent, and any value sent by the client MUST be ignored on receipt by
the server.</p><p><b>TimeWritten: </b>Unused. Can be set to any arbitrary
value when sent, and any value sent by the client MUST be ignored on receipt by
the server.</p><p><b>Return Values: </b>The method MUST return STATUS_SUCCESS
(0x00000000) on success; otherwise, it MUST return an implementation-based,
nonzero NTSTATUS value specified in <span><a href="../ms-erref/1bc92ddf-b79e-413c-bbaa-99a5281a6c90" data-linktype="relative-path">[MS-ERREF]</a></span>.</p><p><b>Note</b>  If the method is not supported, the
RPC transport itself (as opposed to this protocol) returns
RPC_S_PROCNUM_OUT_OF_RANGE (0x6D1). </p><p>This method is almost identical to the <span><a href="1e8cc02c-e5a5-4924-90b5-0aaa69da3571" data-linktype="relative-path">ElfrReportEventW (section 3.1.4.13)</a></span>
method except that it has a <i>SourceName</i> parameter. The server uses this <i>SourceName</i>
parameter to log the source into the event instead of retrieving the source
name from the <i>LogHandle</i> parameter. </p></div>