B.3.9 Event Logging Function

StrmLogEvent

Windows NT provides the strlog function as a convenience in porting. The output of strlog will be sent to the Win32 event log. To fully exploit the capability of the event logging facility, STREAMS stacks should be rewritten to use the function StrmLogEvent. This function writes an entry into the Windows NT I/O error log. The Windows NT event logging facility permits the use of localizable message strings with run time insertion strings, and binary dump data.

NTSTATUS
StrmLogEvent(
    IN PDRIVER_OBJECT DriverObject OPTIONAL,
    IN NTSTATUS EventCode,
    IN ULONG UniqueEventValue,
    IN USHORT NumStrings,
    IN PCHAR *Strings OPTIONAL,
    IN ULONG DataSize,
    IN PVOID Data OPTIONAL
    );
 

Parameters

DriverObject

Optionally points to a driver object.

EventCode

Identifies the error message.

UniqueEventValue

Identifies this instance of the error message.

NumStrings

Specifies the number of ANSI strings in the Strings array.

Strings

Optionally points to an array of pointers to ANSI strings.

DataSize

Specifies the number of bytes contained in the Data parameter.

Data

Optionally points to the binary data associated with the error log entry.

The interface to the I/O event logging facility requires Unicode insertion strings. StrmLogEvent performs the conversion from ANSI to Unicode.

There is a limit on the amount of binary dump data and insertion string data that can be logged in a single call to the event logging facility. The manifest constant STRM_MAX_ERROR_LOG_DATA_SIZE defines this value for STREAMS transports. This definition accounts for the ANSI to Unicode conversion. Note that strlog is implemented as a call to StrmLogEvent with a single insertion string containing the strlog data. Thus, the length of the strlog entry is severely limited.