NdisWriteEventLogEntry function (ndis.h)

Article
04/18/2022

NdisWriteEventLogEntry logs an event to the Win32 event log.

Syntax

NDIS_STATUS NdisWriteEventLogEntry(
  [in]           PVOID       LogHandle,
  [in]           NDIS_STATUS EventCode,
  [in]           ULONG       UniqueEventValue,
  [in]           USHORT      NumStrings,
  [in, optional] PVOID       StringsList,
  [in]           ULONG       DataSize,
  [in, optional] PVOID       Data
);

Parameters

[in] LogHandle

Pointer to the driver object of the protocol that is logging this event.

[in] EventCode

Specifies the NDIS_STATUS_XXX code describing the event.

[in] UniqueEventValue

Identifies this instance of the error message.

[in] NumStrings

Specifies the number of pointers to Unicode strings in the optional StringsList. If StringsList is NULL, NumStrings must be zero.

[in, optional] StringsList

Either NULL or points to buffered Unicode strings. These strings, which describe the event, are inserted into the Win32 event log and can be examined with the Win32 event viewer. Each string must be a NUL-terminated Unicode string.

[in] DataSize

Specifies the number of bytes in the buffer for the binary data at Data . If Data is NULL, DataSize must be zero.

[in, optional] Data

Either NULL or points to buffered binary dump data that is useful for understanding the event. This data can be examined with the Win32 event viewer.

Return value

NdisWriteEventLogEntry can return one of the following values:

Return code	Description
NDIS_STATUS_SUCCESS	The event was successfully logged.
NDIS_STATUS_BUFFER_TOO_SHORT	The optionally supplied Unicode strings and binary dump data exceed the maximum-allowed size (MAX_EVENT_LOG_DATA_SIZE).
NDIS_STATUS_RESOURCES	NDIS was unable to allocate memory for the I/O error log record.

Remarks

NdisWriteEventLogEntry allocates an I/O error log record, fills in the record with the supplied information about the event, and then writes the record to the I/O error log file. A user can view the logged event, including an optional description of the event and/or optional binary dump data, with the Win32 event viewer.

The NT error-logging thread uses any strings supplied in the optional StringsList to fill in messages written into the Win32 event log. Each string must be a NUL-terminated Unicode string. The I/O manager assumes that the initial string is either the name of the driver reporting the error or the name of the device that caused the error.

The Unicode strings supplied by the caller should be read from the registry or should be language-independent (that is, the strings should be the same in any language -- for example, the string could be a file name).

Caller-supplied dump data can be any binary data (such as register values) that is useful in understanding the event. The caller does not have to pad the binary data. If necessary, NdisWriteEventLogEntry pads the binary dump data so that the final data size is a multiple integral of sizeof(ULONG).

The system limits the total size of the optional data supplied to NdisWriteEventLogEntry. The combined size of the strings list and the (possibly padded) binary dump must be less than or equal to MAX_EVENT_LOG_DATA_SIZE.

NdisWriteEventLogEntry is called only by protocol drivers. Miniport drivers should call NdisWriteErrorLogEntry to log events and errors.

Requirements

Requirement	Value
Minimum supported client	Supported for NDIS 6.0 and NDIS 5.1 drivers (see NdisWriteEventLogEntry (NDIS 5.1)) in Windows Vista. Supported for NDIS 5.1 drivers (see NdisWriteEventLogEntry (NDIS 5.1)) in Windows XP.
Target Platform	Universal
Header	ndis.h (include Ndis.h)
Library	Ndis.lib
IRQL	<= DISPATCH_LEVEL
DDI compliance rules	Irql_Miscellaneous_Function(ndis)