static int elog_size( EVENTLOG_INFO *info )
{
if ( !info || !info->etdb ) {
DEBUG(0,("elog_size: Invalid info* structure!\n"));
return 0;
}
return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
}
bool prune_eventlog( TDB_CONTEXT * tdb )
{
int MaxSize, Retention, CalcdSize;
if ( !tdb ) {
DEBUG( 4, ( "No eventlog tdb handle\n" ) );
return False;
}
CalcdSize = elog_tdb_size( tdb, &MaxSize, &Retention );
DEBUG( 3,
( "Calculated size [%d] MaxSize [%d]\n", CalcdSize,
MaxSize ) );
if ( CalcdSize > MaxSize ) {
return make_way_for_eventlogs( tdb, CalcdSize - MaxSize,
False );
}
return make_way_for_eventlogs( tdb, 0, True );
}
static bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32_t needed )
{
int calcd_size;
int MaxSize, Retention;
/* see if we can write to the eventlog -- do a policy enforcement */
if ( !tdb )
return False; /* tdb is null, so we can't write to it */
if ( needed < 0 )
return False;
MaxSize = 0;
Retention = 0;
calcd_size = elog_tdb_size( tdb, &MaxSize, &Retention );
if ( calcd_size <= MaxSize )
return True; /* you betcha */
if ( calcd_size + needed < MaxSize )
return True;
if ( Retention == 0xffffffff ) {
return False; /* see msdn - we can't write no room, discard */
}
/*
note don't have to test, but always good to show intent, in case changes needed
later
*/
if ( Retention == 0x00000000 ) {
/* discard record(s) */
/* todo - decide when to remove a bunch vs. just what we need... */
return make_way_for_eventlogs( tdb, calcd_size - MaxSize,
True );
}
return make_way_for_eventlogs( tdb, calcd_size - MaxSize, False );
}