3.1.4.2.1 RpcNetEventOpenSession (Opnum 0)

  • Article

The RpcNetEventOpenSession method opens a context handle to a running event session. 

 DWORD RpcNetEventOpenSession (
   [in] handle_t BindingHandle,
   [in] [string] wchar_t* LoggerName,
   [out] PSESSION_HANDLE* SessionHandle
 );

BindingHandle:  An RPC binding handle to the server. Details concerning binding handles are specified in [C706] section 2.3

LoggerName:  The name of the current event session. The value of this field MUST correspond to the Name property of a previously started MSFT_NetEventSession object (section 2.3.1.1).

SessionHandle:  An out parameter that receives an RPC context handle (as specified in section 2.2.1.1) that represents a reference to an active event session on the server.

Return Values: The method MUST return ERROR_SUCCESS (0x00000000) on success or a nonzero Win32 error code value if an error occurred. All error values MUST be treated the same.

The opnum field value for this method is 0.

When processing this call, the server MUST do the following:

  • When the RpcNetEventOpenSession method is called, the server MUST check its Session Table for an event session with a Session Name that matches the value specified in the LoggerName member.  When a match is not found, the server MUST return an error.

  • When a match is found, the server MUST attempt to allocate a Session Handle for the client and store it in its event session, and if it cannot perform the allocation, return an error.

  • When the server can allocate the Session Handle for the client, the server MUST start collecting events from the event providers and accumulate in the Queued Event List, all events matching the event session object’s Level, Match Any Keyword, and Match All Keywords filters.

  • The server MUST return the Session Handle to the caller and complete the call with success.

Exceptions Thrown: Exceptions SHOULD NOT be thrown beyond those thrown by the underlying RPC protocol specified in [MS-RPCE].