How to log a crimson event to the custom log (for parental controls)

Now that you have setup a custom event using WMI, you can log to it.  Remember that you need to be elevated to register a custom event, but you do not need to be elevated to log to the channel.  The Windows Parental Controls channel is write only for limited users and only readable when logged in as an admin.

Here is the C++ code to log a custom event.

#include <wpcevents.h>

#include <winevt.h>


#define ARRAYSIZE(x)   &nbsp(sizeof(x)/sizeof(x[0]))


inline ULONG GetStringByteLength(__in PCWSTR pcsz)


   &nbspif (!pcsz)


   &nbsp   &nbspreturn 0;


   &nbspreturn (ULONG)((wcslen(pcsz)+1)*sizeof(WCHAR));


HRESULT LogCustomEvent(

   &nbspLPCWSTR pszPublisher,

   &nbspLPCWSTR pszApp,

   &nbspLPCWSTR pszAppVersion,

   &nbspLPCWSTR pszEvent,

   &nbspLPCWSTR pszColumn1,

   &nbspLPCWSTR pszColumn2,

   &nbspLPCWSTR pszColumn3,

   &nbspDWORD dwBLocked,

   &nbspLPCWSTR pszReason




   &nbspif (pszPublisher != NULL &&

   &nbsp   &nbsppszApp != NULL &&

   &nbsp   &nbsppszAppVersion != NULL &&

   &nbsp   &nbsppszEvent != NULL &&

   &nbsp   &nbsppszColumn1 != NULL &&

   &nbsp   &nbsppszCOlumn2 != NULL &&

   &nbsp   &nbsppszColumn3 != NULL)


   &nbsp   &nbspREGHANDLE hProvider;

   &nbsp   &nbsp// Register us with the crimson system, so we can log to it.

   &nbsp   &nbspULONG res = EventRegister(&WPCPROV, NULL, NULL, &hProvider);

   &nbsp   &nbspif (res == ERROR_SUCCESS)

   &nbsp   &nbsp{

   &nbsp   &nbsp // Array to handle all the data descriptors.


   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_PUBLISHER], (const PVOID)pszPublisher, GetStringByteLength(pszPublisher));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_APPNAME], (const PVOID)pszApp, GetStringByteLength(pszApp));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_APPVERSION], (const PVOID)pszAppVersion, GetStringByteLength(pszAppVersion));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_EVENT], (const PVOID)pszEvent, GetStringByteLength(pszEvent));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_VALUE1], (const PVOID)pszColumn1, GetStringByteLength(pszColumn1));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_VALUE2], (const PVOID)pszColumn2, GetStringByteLength(pszColumn2));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_VALUE3], (const PVOID)pszColumn3, GetStringByteLength(pszColumn3));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_BLOCKED], (const PVOID)&dwBlocked, sizeof(dwBlocked));

   &nbsp   &nbsp EventDataDescCreate(&eventData[WPC_ARGS_CUSTOMEVENT_REASON], (const PVOID)pszReason, GetStringByteLength(pszReason));

   &nbsp   &nbsp res = EventWrite(hProvider, &WPCEVENT_CUSTOMEVENT, ARRAYSIZE(eventData), eventData);

   &nbsp   &nbsp if (res == ERROR_SUCCESS)

   &nbsp   &nbsp {

   &nbsp   &nbsp   &nbsp hr = S_OK;

   &nbsp   &nbsp }

   &nbsp   &nbsp else

   &nbsp   &nbsp {

   &nbsp   &nbsp   &nbsp hr = HRESULT_FROM_WIN32(GetLastError());

   &nbsp   &nbsp }

   &nbsp   &nbsp EventUnregister(hProvider);

   &nbsp   &nbsp}

   &nbsp   &nbspelse

   &nbsp   &nbsp{

   &nbsp   &nbsp hr = HRESULT_FROM_WIN32(GetLastError());

   &nbsp   &nbsp}


   &nbspreturn hr;


Now that you have logged your event, you should be able to see it in the activity viewer of the windows parental controls controls panel.  You can also see it by looking at the Event Viewer in the control panel.  You want to look at the channel called Microsoft-Windows-ParentalControls/Operational. The event will be logged with an id of 13.

Comments (0)