home *** CD-ROM | disk | FTP | other *** search
/ PC World Komputer 2010 April / PCWorld0410.iso / WindowsServerTrial / server.iso / sources / install.wim / 2 / Windows / System32 / wbem / filetrace.mof < prev    next >
Encoding:
Text File  |  2006-09-18  |  17.5 KB  |  662 lines
  1. /*++
  2.  
  3. Copyright (c) Microsoft Corporation.  All rights reserved.
  4.  
  5. Module Name:
  6.  
  7.     FileTrace.mof
  8.  
  9. Abstract:
  10.  
  11.     This file defines the file trace MOF classes that describe
  12.     the data logged by the file trace mini filter.
  13.  
  14. Revision History:
  15.  
  16. --*/
  17.  
  18. #pragma namespace("\\\\.\\root\\wmi")
  19.  
  20. #pragma classflags("forceupdate")
  21.  
  22. [Dynamic,
  23.  Description("File Kernel Trace; Operation Set 1") : amended,
  24.  Guid("{D75D8303-6C21-4bde-9C98-ECC6320F9291}")
  25.  ]
  26. class MSNT_FileBaseTrace_Set1:EventTrace
  27. {
  28.     [Description ("Enable Flags") : amended,
  29.         ValueDescriptions{
  30.             "Create",
  31.             "Create Named Pipe",
  32.             "Close",
  33.             "Read",
  34.             "Write",
  35.             "Query Information",
  36.             "Set Information",
  37.             "Query EA",
  38.             "Set EA",
  39.             "Flush Buffers",
  40.             "Query Volume Information",
  41.             "Set Volume Information",
  42.             "Directory Control",
  43.             "File System Control",
  44.             "Device Control",
  45.             "Internal Device Control",
  46.             "Shutdown",
  47.             "Lock Control",
  48.             "Cleanup",
  49.             "Create Mailslot",
  50.             "Query Security",
  51.             "Set Security",
  52.             "Power",
  53.             "System Control",
  54.             "Device Change",
  55.             "Query Quota",
  56.             "Set Quota",
  57.             "PNP"} : amended,
  58.          DefineValues{
  59.             "EVENT_TRACE_FLAG_CREATE",
  60.             "EVENT_TRACE_FLAG_CREATENAMEDPIPE",
  61.             "EVENT_TRACE_FLAG_CLOSE",
  62.             "EVENT_TRACE_FLAG_READ",
  63.             "EVENT_TRACE_FLAG_WRITE",
  64.             "EVENT_TRACE_FLAG_QUERYINFORMATION",
  65.             "EVENT_TRACE_FLAG_SETINFORMATION",
  66.             "EVENT_TRACE_FLAG_QUERYEA",
  67.             "EVENT_TRACE_FLAG_SETEA",
  68.             "EVENT_TRACE_FLAG_FLUSHBUFFERS",
  69.             "EVENT_TRACE_FLAG_QUERYVOLINFO",
  70.             "EVENT_TRACE_FLAG_SETVOLINFO",
  71.             "EVENT_TRACE_FLAG_DIRECTORYCONTROL",
  72.             "EVENT_TRACE_FLAG_FILESYSCONTROL",
  73.             "EVENT_TRACE_FLAG_DEVICECONTROL",
  74.             "EVENT_TRACE_FLAG_INTERNALDEVICECONTROL",
  75.             "EVENT_TRACE_FLAG_SHUTDOWN",
  76.             "EVENT_TRACE_FLAG_LOCKCONTROL",
  77.             "EVENT_TRACE_FLAG_CLEANUP",
  78.             "EVENT_TRACE_FLAG_CREATEMAILSLOT",
  79.             "EVENT_TRACE_FLAG_QUERYSECURITY",
  80.             "EVENT_TRACE_FLAG_SETSECURITY",
  81.             "EVENT_TRACE_FLAG_POWER",
  82.             "EVENT_TRACE_FLAG_SYSTEMCONTROL",
  83.             "EVENT_TRACE_FLAG_DEVICECHANGE",
  84.             "EVENT_TRACE_FLAG_QUERYQUOTA",
  85.             "EVENT_TRACE_FLAG_SETQUOTA",
  86.             "EVENT_TRACE_FLAG_PNP"},
  87.         Values{
  88.             "create",
  89.             "createnamedpipe",
  90.             "close",
  91.             "read",
  92.             "write",
  93.             "queryinfo",
  94.             "setinfo",
  95.             "queryea",
  96.             "setea"
  97.             "flushbuffers",
  98.             "queryvolinfo",
  99.             "setvolinfo",
  100.             "directorycontrol",
  101.             "filesystemcontrol",
  102.             "devicecontrol",
  103.             "internaldevicecontrol",
  104.             "shutdown",
  105.             "lockcontrol",
  106.             "cleanup",
  107.             "createmailslot",
  108.             "querysecurity",
  109.             "setsecurity",
  110.             "power",
  111.             "systemcontrol",
  112.             "devicechange",
  113.             "queryquota",
  114.             "setquota",
  115.             "pnp"},
  116.         ValueMap{
  117.             "0x00000001",
  118.             "0x00000002",
  119.             "0x00000004",
  120.             "0x00000008",
  121.             "0x00000010",
  122.             "0x00000020",
  123.             "0x00000040",
  124.             "0x00000080",
  125.             "0x00000100",
  126.             "0x00000200",
  127.             "0x00000400",
  128.             "0x00000800",
  129.             "0x00001000",
  130.             "0x00002000",
  131.             "0x00004000",
  132.             "0x00008000",
  133.             "0x00010000",
  134.             "0x00020000",
  135.             "0x00040000",
  136.             "0x00080000",
  137.             "0x00100000",
  138.             "0x00200000",
  139.             "0x00400000",
  140.             "0x00800000",
  141.             "0x01000000",
  142.             "0x02000000",
  143.             "0x04000000",
  144.             "0x08000000"}
  145.     ]
  146.     uint32 Flags;
  147. };
  148.  
  149. [Dynamic,
  150.  Description("File Kernel Trace; Operation Set 2") : amended,
  151.  Guid("{058DD951-7604-414d-A5D6-A56D35367A46}")
  152.  ]
  153. class MSNT_FileBaseTrace_Set2:EventTrace
  154. {
  155.     [Description ("Enable Flags") : amended,
  156.         ValueDescriptions{
  157.             "Acquire For Section Synchronization",
  158.             "Release For Section Synchronization",
  159.             "Acquire For Mod Write",
  160.             "Release For Mod Write",
  161.             "Acquire For CC Flush",
  162.             "Release For CC Flush",
  163.             "Notify Stream File Object",
  164.             "Fast IO Check If Possible",
  165.             "Network Query Open",
  166.             "MDL Read",
  167.             "MDL Read Complete",
  168.             "Prepare MDL Write",
  169.             "MDL Write Complete",
  170.             "Volume Mount",
  171.             "Volume Dismount"} : amended,
  172.          DefineValues{
  173.             "EVENT_TRACE_FLAG_ACQUIRESECTIONSYNCH",
  174.             "EVENT_TRACE_FLAG_RELEASESECTIONSYNCH",
  175.             "EVENT_TRACE_FLAG_ACQUIREMODWRITE",
  176.             "EVENT_TRACE_FLAG_RELEASEMODWRITE",
  177.             "EVENT_TRACE_FLAG_ACQUIRECCFLUSH",
  178.             "EVENT_TRACE_FLAG_RELEASECCFLUSH",
  179.             "EVENT_TRACE_FLAG_NOTIFYSTREAMFILEOBJ",
  180.             "EVENT_TRACE_FLAG_FASTIOCHECKIFPOSSIBLE",
  181.             "EVENT_TRACE_FLAG_NETWORKQUERYOPEN",
  182.             "EVENT_TRACE_FLAG_MDLREAD",
  183.             "EVENT_TRACE_FLAG_MDLREADCOMPLETE",
  184.             "EVENT_TRACE_FLAG_PREPAREMDLWRITE",
  185.             "EVENT_TRACE_FLAG_MDLWRITECOMPLETE",
  186.             "EVENT_TRACE_FLAG_VOLUMEMOUNT",
  187.             "EVENT_TRACE_FLAG_VOLUMEDISMOUNT"},
  188.         Values{
  189.             "acquireforsectionsynchronization",
  190.             "releaseforsectionsynchronization",
  191.             "acquireformodwrite",
  192.             "releaseformodwrite",
  193.             "acquireforccflush",
  194.             "releaseforccflush",
  195.             "notifystreamfileobject",
  196.             "fastiocheckifpossible",
  197.             "networkqueryopen",
  198.             "mdlread",
  199.             "mdlreadcomplete",
  200.             "preparemdlwrite",
  201.             "mdlwritecomplete",
  202.             "volumemount",
  203.             "volumedismount"},
  204.         ValueMap{
  205.             "0x00000001",
  206.             "0x00000002",
  207.             "0x00000004",
  208.             "0x00000008",
  209.             "0x00000010",
  210.             "0x00000020",
  211.             "0x00000040",
  212.             "0x00001000",
  213.             "0x00002000",
  214.             "0x00004000",
  215.             "0x00008000",
  216.             "0x00010000",
  217.             "0x00020000",
  218.             "0x00040000",
  219.             "0x00080000"}
  220.     ]
  221.     uint32 Flags;
  222. };
  223.  
  224. [Dynamic,
  225.  Description("File Kernel Trace; Optional Data") : amended,
  226.  Guid("{7DA1385C-F8F5-414d-B9D0-02FCA090F1EC}")
  227.  ]
  228. class MSNT_FileBaseTrace_OptionalData : EventTrace
  229. {
  230.     [Description ("Enable Flags") : amended,
  231.         ValueDescriptions{
  232.             "User Context",
  233.             "Session Id",
  234.             "Last Access Time",
  235.             "Call Parameters",
  236.             "Call Result Data",
  237.             "Previous Data",
  238.             "Create On Existing File",
  239.             "Process Window Station"} : amended,
  240.          DefineValues{
  241.             "EVENT_TRACE_FLAG_USERCONTEXT",
  242.             "EVENT_TRACE_FLAG_SESSIONID",
  243.             "EVENT_TRACE_FLAG_LASTACCESSTIME",
  244.             "EVENT_TRACE_FLAG_CALLPARAMETERS",
  245.             "EVENT_TRACE_FLAG_CALLRESULTDATA",
  246.             "EVENT_TRACE_FLAG_PREVIOUSDATA",
  247.             "EVENT_TRACE_FLAG_CREATEONEXISTINGFILE",
  248.             "EVENT_TRACE_FLAG_PROCESSWINDOWSTATION",
  249.             "EVENT_TRACE_FLAG_BLOCKPAGINGIO"},
  250.         Values{
  251.             "usercontext",
  252.             "sessionid",
  253.             "lastaccesstime",
  254.             "callparameters",
  255.             "callresultdata",
  256.             "previousdata",
  257.             "createonexistingfile",
  258.             "processwindowstation",
  259.             "blockpagingio"},
  260.         ValueMap{
  261.             "0x00000001",
  262.             "0x00000002",
  263.             "0x00000004",
  264.             "0x00000008",
  265.             "0x00000010",
  266.             "0x00000020",
  267.             "0x00000040",
  268.             "0x00000080",
  269.             "0x00000100"}
  270.     ]
  271.     uint32 Flags;
  272. };
  273.  
  274. [Dynamic,
  275.  Description("File Kernel Trace; Volume To Log") : amended,
  276.  Guid("{127D46AF-4AD3-489f-9165-F00BA64D5467}")
  277.  ]
  278. class MSNT_FileBaseTrace_VolumeToLog : EventTrace
  279. {
  280.     [Description ("Enable Flags") : amended,
  281.         ValueDescriptions{
  282.             "A",
  283.             "B",
  284.             "C",
  285.             "D",
  286.             "E",
  287.             "F",
  288.             "G",
  289.             "H",
  290.             "I",
  291.             "J",
  292.             "K",
  293.             "L",
  294.             "M",
  295.             "N",
  296.             "O",
  297.             "P",
  298.             "Q",
  299.             "R",
  300.             "S",
  301.             "T",
  302.             "U",
  303.             "V",
  304.             "X",
  305.             "Y",
  306.             "Z",
  307.             "All",
  308.             "Local",
  309.             "Network"} : amended,
  310.          DefineValues{
  311.             "EVENT_TRACE_FLAG_A",
  312.             "EVENT_TRACE_FLAG_B",
  313.             "EVENT_TRACE_FLAG_C",
  314.             "EVENT_TRACE_FLAG_D",
  315.             "EVENT_TRACE_FLAG_E",
  316.             "EVENT_TRACE_FLAG_F",
  317.             "EVENT_TRACE_FLAG_G",
  318.             "EVENT_TRACE_FLAG_H",
  319.             "EVENT_TRACE_FLAG_I",
  320.             "EVENT_TRACE_FLAG_J",
  321.             "EVENT_TRACE_FLAG_K",
  322.             "EVENT_TRACE_FLAG_L",
  323.             "EVENT_TRACE_FLAG_M",
  324.             "EVENT_TRACE_FLAG_N",
  325.             "EVENT_TRACE_FLAG_O",
  326.             "EVENT_TRACE_FLAG_P",
  327.             "EVENT_TRACE_FLAG_Q",
  328.             "EVENT_TRACE_FLAG_R",
  329.             "EVENT_TRACE_FLAG_S",
  330.             "EVENT_TRACE_FLAG_T",
  331.             "EVENT_TRACE_FLAG_U",
  332.             "EVENT_TRACE_FLAG_V",
  333.             "EVENT_TRACE_FLAG_W",
  334.             "EVENT_TRACE_FLAG_X",
  335.             "EVENT_TRACE_FLAG_Y",
  336.             "EVENT_TRACE_FLAG_Z",
  337.             "EVENT_TRACE_FLAG_ALL",
  338.             "EVENT_TRACE_FLAG_LOCAL",
  339.             "EVENT_TRACE_FLAG_NETWORK"},
  340.         Values{
  341.             "a",
  342.             "b",
  343.             "c",
  344.             "d",
  345.             "e",
  346.             "f",
  347.             "g",
  348.             "h",
  349.             "i",
  350.             "j",
  351.             "k",
  352.             "l",
  353.             "m",
  354.             "n",
  355.             "o",
  356.             "p",
  357.             "q",
  358.             "r",
  359.             "s",
  360.             "t",
  361.             "u",
  362.             "v",
  363.             "w",
  364.             "x",
  365.             "y",
  366.             "z",
  367.             "all",
  368.             "local",
  369.             "network"},
  370.         ValueMap{
  371.             "0x00000001",
  372.             "0x00000002",
  373.             "0x00000004",
  374.             "0x00000008",
  375.             "0x00000010",
  376.             "0x00000020",
  377.             "0x00000040",
  378.             "0x00000080",
  379.             "0x00000100",
  380.             "0x00000200",
  381.             "0x00000400",
  382.             "0x00000800",
  383.             "0x00001000",
  384.             "0x00002000",
  385.             "0x00004000",
  386.             "0x00008000",
  387.             "0x00010000",
  388.             "0x00020000",
  389.             "0x00040000",
  390.             "0x00080000",
  391.             "0x00100000",
  392.             "0x00200000",
  393.             "0x00400000",
  394.             "0x00800000",
  395.             "0x01000000",
  396.             "0x02000000",
  397.             "0x04000000",
  398.             "0X08000000",
  399.             "0X10000000"}
  400.     ]
  401.     uint32 Flags;
  402. };
  403.  
  404. [Dynamic,
  405.  Description("File Trace") : amended,
  406.  Guid("{F681E6CC-EC6C-4ee9-90A6-C0C4E83276C2}"),
  407.  EventVersion(0),
  408.  DisplayName("File Trace") : amended
  409. ]
  410. class FileTrace : MSNT_FileBaseTrace_Set1
  411. {
  412.  
  413. };
  414.  
  415. [Dynamic,
  416.  EventType{0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
  417.            21,22,23,24,25,26,27,236,237,238,239,240,241,242,243,
  418.            249,250,251,252,253,254,255},
  419.  EventTypeName("FileTrace"),
  420.  Description("File Trace Event") : amended
  421.  ]
  422. class FileOperation : FileTrace
  423. {
  424.     [WmiDataId(1),
  425.      Description("Status") : amended,
  426.      format("x"),
  427.      read]
  428.      uint32  Status;
  429.     [WmiDataId(2),
  430.      Description("Operation") : amended,
  431.      Values{
  432.         "NORMALIZE_NAME_COMPONENT",
  433.         "GENERATE_FILE_NAME",
  434.         "VOLUME_DISMOUNT",
  435.         "VOLUME_MOUNT",
  436.         "MDL_WRITE_COMPLETE",
  437.         "PREPARE_MDL_WRITE",
  438.         "MDL_READ_COMPLETE",
  439.         "MDL_READ",
  440.         "NETWORK_QUERY_OPEN",
  441.         "FAST_IO_CHECK_IF_POSSIBLE",
  442.         "NOTIFY_STREAM_FILE_OBJECT",
  443.         "RELEASE_FOR_CC_FLUSH",
  444.         "ACQUIRE_FOR_CC_FLUSH",
  445.         "RELEASE_FOR_MOD_WRITE",
  446.         "ACQUIRE_FOR_MOD_WRITE",
  447.         "RELEASE_FOR_SECTION_SYNCHRONIZATION",
  448.         "ACQUIRE_FOR_SECTION_SYNCHRONIZATION",
  449.         "CREATE",
  450.         "CREATE_NAMED_PIPE",
  451.         "CLOSE",
  452.         "READ",
  453.         "WRITE",
  454.         "QUERY_INFORMATION",
  455.         "SET_INFORMATION",
  456.         "QUERY_EA",
  457.         "SET_EA",
  458.         "FLUSH_BUFFERS",
  459.         "QUERY_VOLUME_INFORMATION",
  460.         "SET_VOLUME_INFORMATION",
  461.         "DIRECTORY_CONTROL",
  462.         "FILE_SYSTEM_CONTROL",
  463.         "DEVICE_CONTROL",
  464.         "INTERNAL_DEVICE_CONTROL",
  465.         "SHUTDOWN",
  466.         "LOCK_CONTROL",
  467.         "CLEANUP",
  468.         "CREATE_MAILSLOT",
  469.         "QUERY_SECURITY",
  470.         "SET_SECURITY",
  471.         "POWER",
  472.         "SYSTEM_CONTROL",
  473.         "DEVICE_CHANGE",
  474.         "QUERY_QUOTA",
  475.         "SET_QUOTA",
  476.         "PNP"},
  477.      ValueMap{
  478.         "0",
  479.         "1",
  480.         "2",
  481.         "3",
  482.         "4",
  483.         "5",
  484.         "6",
  485.         "7",
  486.         "8",
  487.         "9",
  488.         "15",
  489.         "16",
  490.         "17",
  491.         "18",
  492.         "19",
  493.         "20",
  494.         "21",
  495.         "22",
  496.         "23",
  497.         "24",
  498.         "25",
  499.         "26",
  500.         "27",
  501.         "28",
  502.         "29",
  503.         "30",
  504.         "31",
  505.         "32",
  506.         "33",
  507.         "34",
  508.         "35",
  509.         "36",
  510.         "37",
  511.         "38",
  512.         "39",
  513.         "40",
  514.         "41",
  515.         "42",
  516.         "43",
  517.         "44",
  518.         "45",
  519.         "46",
  520.         "47",
  521.         "48",
  522.         "49"},
  523.      read]
  524.      uint8  Operation;
  525.     [WmiDataId(3),
  526.      Description("Minor operation") : amended,
  527.      read]
  528.      uint8  MinorOperation;
  529.     [WmiDataId(4),
  530.      Description("SequenceNumber") : amended,
  531.      read]
  532.      uint32  SequenceNumber;
  533.     [WmiDataId(5),
  534.      Description("Is this a paging operation") : amended,
  535.      read]
  536.      uint8  IsPagingIO;
  537.     [WmiDataId(6),
  538.      Description("Is this a fast IO operation") : amended,
  539.      read]
  540.      uint8  IsFastIO;
  541.     [WmiDataId(7),
  542.      Description("IsDirectory") : amended,
  543.     Values{
  544.         "False",
  545.         "True",
  546.         "NA"},
  547.     ValueMap{
  548.         "0",
  549.         "1",
  550.         "2"},
  551.      read]
  552.      uint8  IsDirectory;
  553.     [WmiDataId(8),
  554.      Description("Create called on existing file") : amended,
  555.     Values{
  556.         "False",
  557.         "True",
  558.         "NA"},
  559.     ValueMap{
  560.         "0",
  561.         "1",
  562.         "2"},
  563.      read]
  564.      uint8 CreateOnExisting;
  565.     [WmiDataId(9),
  566.      Description("The time the operation started") : amended,
  567.      read]
  568.      sint64 StartTime;
  569.     [WmiDataId(10),
  570.      Description("Id of the operation's process") : amended,
  571.      read]
  572.      uint32  ProcessId;
  573.     [WmiDataId(11),
  574.      Description("The time the process was created") : amended,
  575.      read]
  576.      sint64 ProcessCreateTime;
  577.     [WmiDataId(12),
  578.      Description("File Object") : amended,
  579.      format("x"),
  580.      pointer,
  581.      read]
  582.      uint64 FileObject;
  583.     [WmiDataId(13),
  584.      Description("File last access time") : amended,
  585.      read]
  586.      sint64 LastAccessTime;
  587.     [WmiDataId(14),
  588.      Description("Session Id") : amended,
  589.      read]
  590.      uint32 SessionId;
  591.     [WmiDataId(15),
  592.      Description("Window Station") : amended,
  593.      pointer,
  594.      read]
  595.      uint64 WindowStation;
  596.     [WmiDataId(16),
  597.      Description("Acess token address") : amended,
  598.      pointer,
  599.      read]
  600.      uint32 AccessToken;
  601.     [WmiDataId(17),
  602.      Description("User Sid Data Length") : amended,
  603.      read]
  604.      uint32 SidLength;
  605.     [WmiDataId(18),
  606.      Description("Parameters Data Length") : amended,
  607.      read]
  608.      uint32 ParametersLength;
  609.     [WmiDataId(19),
  610.      Description("Result Data Length") : amended,
  611.      read]
  612.      uint32 ResultLength;
  613.     [WmiDataId(20),
  614.      Description("Previous Value Length") : amended,
  615.      read]
  616.      uint32 PreviousValueLength;
  617.     [WmiDataId(21),
  618.      Description("User Sid") : amended,
  619.      extension("Sid"),
  620.      read]
  621.      object  UserSID;
  622.     [WmiDataId(22),
  623.      description("Operational Parameters") : amended,
  624.      WmiSizeIs("ParametersLength"),
  625.      read]
  626.      uint8 OperationalParameters[];
  627.     [WmiDataId(23),
  628.      description("Query Result Data") : amended,
  629.      WmiSizeIs("ResultLength"),
  630.      read]
  631.      uint8 ResultData[];
  632.     [WmiDataId(24),
  633.      description("Previous Value") : amended,
  634.      WmiSizeIs("PreviousValueLength"),
  635.      read]
  636.      uint8 PreviousValue[];
  637.     [WmiDataId(25),
  638.      Description("File Name") : amended,
  639.      StringTermination("NullTerminated"),
  640.      format("w"),
  641.      read]
  642.      string  FileName;
  643.     [WmiDataId(26),
  644.      Description("Volume Dos Name") : amended,
  645.      StringTermination("NullTerminated"),
  646.      format("w"),
  647.      read]
  648.      string  VolumeDosName;
  649.     [WmiDataId(27),
  650.      Description("Volume Guid Name") : amended,
  651.      StringTermination("NullTerminated"),
  652.      format("w"),
  653.      read]
  654.      string  VolumeGuidName;
  655.     [WmiDataId(28),
  656.      Description("Volume Name") : amended,
  657.      StringTermination("NullTerminated"),
  658.      format("w"),
  659.      read]
  660.      string  VolumeName;
  661. };
  662.