22.214.171.124 Receiving a $E (End-of-Stream Notification) Packet
The client MUST verify that the $E packet adheres to the syntax specified in section 126.96.36.199.
If the value of the Client-State variable is STREAMING, or if the value of the Reason field in the $E packet specifies an error HRESULT code, the client MUST report this event to the higher layer.
If the value of the Client-State variable is STREAMING, and the value of the KeepAlive-Mode variable specifies that the pipelined mode of the protocol is used, the client MUST send a Log request (section 188.8.131.52) to the server on the same TCP connection that the $E packet was received on.
If the value of the Client-State variable is STREAMING, and the non-pipelined mode of the protocol is used, the client MUST establish a new TCP connection to the server. The new connection MUST be to the same TCP port as the connection on which the $E packet was received. The client MUST then send a Log request to the server on the new TCP connection.
If the server's product name is "Cougar" and its version number is greater than or equal to 9.0, as determined by the Server-Version variable, the previously mentioned Log request SHOULD contain a logging message in XML format as specified in [MS-WMLOG]. If the client will submit remote-log remote events using the SendEvent request (section 184.108.40.206), then the logging information included in the Log request MUST be a "streaming" log, as specified in [MS-WMLOG]. Otherwise, the logging information MUST be a "legacy" style log, as specified in [MS-WMLOG].
Next, the value of the Client-State variable MUST be set to IDLE.
If the Keepalive timer is running, it MUST be restarted. If it is not running, it MUST be started.
If the value of the Reason field in the $E packet is 0, then the client MUST set the value of the Expected-Packets variable to $E and then process the rules in section 220.127.116.11.