.net Binding for WPC Events
The WPC event system logs a series of events to the WPC crimson channel. The channel contents is viewable inside the log viewer and it has a path of: Microsoft-Windows-ParentalControls/Operational. The events are logged with a variety of different parameters, mostly you can see what they are from inside the event viewer itself. Of the logs in the system, the ones that are logged by default are SettingChangeEvent (logged by the WPC system), Game Start Event (logged by the gameux system), Url Visit Event (logged by the WPC system), Media Playback Event (logged by Media Player), File Download Event (logged by IE), AppOverrideEvent (logged by the WPC system), WebOverrideEvent (logged by the WPC system) and AppBlockedEvent (safer events copied from the insecure application log).
The logs are mostly as you would expect, the web and app override events are generated by the over the shoulder allowing of specific web sites, when it pops up the elevation dialog box and allows you to allow or block the url/app on the spot. The other events in the wpc log are not currently logged by any existing application and will require logging from the apps themselves. This log format is not going to change in the future though, so logging these events will mean they will show up in the next versions of WPC as well.
The following code is a series of constants that allow you to reference the various parts of the crimson logs easily. The enum WPCEvents is used to look at the eventid of the crimson log to see which of the wpc events it is referring to. The other enums are used to index into the user array of events when querying the crimson logs, to get the correct values out.
The enum of WPC_MEDIA_TYPE and WPC_MEDIA_EXPLICIT_TYPE are used when looking at the values for the MEDIATYPE and the EXPLICIT fields in the the media playback event.
The enum of WPCFLAG_IM_FEATURE is used to determine which features the IMFEATUREEVENT refers to. The feature event is logged for several different types of log events and this mask determines which type they are. It is legal for this mask to contain multiple flags to mark that this event is for multiple event types.
The enum of WPCSettings is used to look at the SETTING name inside the SETTINGSCHANGEVENT to figure out which of the settings is being changed. This is a number to make the setting localizable correctly.
using System;
using System.Collections.Generic;
using System.Text;
namespace OneCareService
{
public enum WPCEvents
{
SettingChangeEvent = 1,
GameStartEvent = 2,
UrlVisitEvent = 3,
EmailReceivedEvent = 4,
EmailSentEvent = 5,
MediaPlaybackEvent = 6,
IMInvitationEvent = 7,
IMJoinEvent = 8,
IMLeaveEvent = 9,
FileDownloadEvent = 10,
IMFeatureEvent = 11,
CustomEvent = 13,
EmailContactEvent = 14,
IMContactEvent = 15,
AppBlockedEvent = 16,
AppOverrideEvent = 17,
WebOverrideEvent = 18
}
public enum WPC_ARGS_SETTINGSCHANGEEVENT
{
CLASS = 0,
SETTING,
OWNER,
OLDVAL,
NEWVAL,
REASON,
OPTIONAL
}
public enum WPC_ARGS_SAFERAPPBLOCKED
{
TIMESTAMP = 0,
USERID,
PATH,
RULEID
}
public enum WPC_ARGS_EMAILRECEIEVEDEVENT
{
SENDER = 0,
APPNAME,
APPVERSION,
SUBJECT,
REASON,
RECIPCOUNT,
RECIPIENT,
ATTACHCOUNT,
ATTACHMENTNAME,
RECEIVEDTIME,
EMAILACCOUNT
}
public enum WPC_ARGS_EMAILSENTEVENT
{
SENDER = 0,
APPNAME,
APPVERSION,
SUBJECT,
REASON,
RECIPCOUNT,
RECIPIENT,
ATTACHCOUNT,
ATTACHMENTNAME,
EMAILACCOUNT
}
public enum WPC_ARGS_EMAILCONTACTEVENT
{
APPNAME = 0,
APPVERSION,
OLDNAME,
OLDID,
NEWNAME,
NEWID,
REASON,
EMAILACCOUNT
}
public enum WPC_MEDIA_TYPE
{
OTHER = 0,
DVD,
RECORDED_TV,
AUDIO_FILE,
CD_AUDIO,
VIDEO_FILE,
PICTURE_FILE,
MAX
}
public enum WPC_MEDIA_EXPLICIT_TYPE
{
FALSE = 0,
TRUE,
UNKNOWN
}
public enum WPC_ARGS_MEDIAPLAYBACKEVENT
{
APPNAME = 0,
APPVERSION,
MEDIATYPE,
PATH,
TITLE,
PML,
ALBUM,
EXPLICIT,
REASON
}
public enum WPC_ARGS_MEDIADOWNLOADEVENT
{
APPNAME = 0,
APPVERSION,
MEDIATYPE,
PATH,
TITLE,
PML,
ALBUM,
EXPLICIT,
REASON
}
public enum WPC_ARGS_CONVERSATIONINITEVENT
{
APPNAME = 0,
APPVERSION,
ACCOUNTNAME,
CONVID,
REQUESTINGIP,
SENDER,
REASON,
RECIPCOUNT,
RECIPIENT
}
public enum WPC_ARGS_CONVERSATIONJOINEVENT
{
APPNAME = 0,
APPVERSION,
ACCOUNTNAME,
CONVID,
JOININGIP,
JOININGUSER,
REASON,
MEMBERCOUNT,
MEMBER,
SENDER
}
public enum WPC_ARGS_CONVERSATIONLEAVEEVENT
{
APPNAME = 0,
APPVERSION,
ACCOUNTNAME,
CONVID,
LEAVINGIP,
LEAVINGUSER,
REASON,
MEMBERCOUNT,
MEMBER,
FLAGS
}
public enum WPCFLAG_IM_FEATURE : uint
{
NONE = 0x00,
VIDEO = 0x01,
AUDIO = 0x02,
GAME = 0x04,
SMS = 0x08,
FILESWAP = 0x10,
URLSWAP = 0x20,
SENDING = 0x80000000, ALL = 0xFFFFFFFF
}
public enum WPC_ARGS_IMFEATUREEVENT
{
APPNAME = 0,
APPVERSION,
ACCOUNTNAME,
CONVID,
MEDIATYPE,
REASON,
RECIPCOUNT,
RECIPIENT,
SENDER,
SENDERIP,
DATA
}
public enum WPC_ARGS_IMCONTACTEVENT
{
APPNAME = 0,
APPVERSION,
ACCOUNTNAME,
OLDNAME,
OLDID,
NEWNAME,
NEWID,
REASON
}
public enum WPC_ARGS_GAMESTARTEVENT
{
APPID = 0,
INSTANCEID,
APPVERSION,
PATH,
RATING,
RATINGSYSTEM,
REASON,
DESCCOUNT,
DESCRIPTOR,
PID
}
public enum WPC_ARGS_FILEDOWNLOADEVENT
{
URL = 0,
APPNAME,
VERSION,
BLOCKED,
PATH,
}
public enum WPC_ARGS_URLVISITEVENT
{
URL = 0,
APPNAME,
VERSION,
REASON,
RATINGSYSTEMID,
CATCOUNT,
CATEGORY
}
public enum WPC_ARGS_CUSTOMEVENT
{
PUBLISHER = 0,
APPNAME,
APPVERSION,
EVENT,
VALUE1,
VALUE2,
