什么 REG-BINARY 设置为 failureAction 服务 [英] What REG-BINARY to set for FailureAction for service

问题描述

我有一个服务，我想在注册表中为 FailureAction 设置数据值.当前在注册表中设置了值.使用 RegKey.SetValue("FailureActions", Value) 设置值；

I have a service for which I want to set Data value for FailureAction in registry. Currently there is value set in registry. Value is set using RegKey.SetValue("FailureActions", Value);

我想知道:

1) 这些字节的值如何对应服务的恢复选项(例如如何在注册表中找出特定序列意味着将第一次失败"设置为重新启动服务")

1) How these bytes of Value correspond to recovery option of service (like how to find out particular sequence in registry means setting 'First failure' as 'Restart the Service')

2) 我还需要更改注册表中的FailureAction，这将对应于后续故障"为重新启动服务"

2) Also I need to change in registry FailureAction which will correspond to 'Subsequent failures' as 'Restart the Service'

这是我使用试错法的发现:

a) 手动更改服务恢复设置，然后注册表项更改.复制该值并在代码中使用.它设置了后续失败"

a)Manually change setting of recovery for service then registry entry changes. Copy that value and use in code. It set 'Subsequent failures'

b) 更改代码中的原始值.它设置了后续失败"

b)Change original value in code. It set 'Subsequent failures'

但是来自 a) 和 b) 的值不匹配，但如果我右键单击服务并查看恢复选项，我会看到相同的结果.为了理解这一点，我想知道问题 1) 和 2) 的答案.

But value from a) and b) does not match but I see same result if I right click on service and see recovery option. To understand this I would like to know answers to question 1) and 2).

感谢您的评论\线索.

推荐答案

为了说明FailureActions注册表项data value中bytes的含义，我举个例子:

To explain the meaning of bytes in data value of FailureActions registry key, I will take this example:

这个表示中的字节对应这个结构:

The bytes in this representation correspond to this structure:

typedef struct _SERVICE_FAILURE_ACTIONS {
    DWORD     dwResetPeriod;
    LPTSTR    lpRebootMsg;
    LPTSTR    lpCommand;
    DWORD     cActions;
    SC_ACTION *lpsaActions;
} SERVICE_FAILURE_ACTIONS, *LPSERVICE_FAILURE_ACTIONS;

前四个字节80 51 01 00是dwResetPeriod结构成员的值.如果没有故障，这是将故障计数重置为零的时间.它以秒计算.在这个例子中，重置周期是 0x15180 秒(因为小端).在十进制中，它相当于 86400 秒或等于 24 小时.因此，如果在 24 小时内没有故障，则故障计数将重置为零.

The first four bytes 80 51 01 00 are the value of dwResetPeriod structure's member. It is the time after which to reset the failure count to zero if there are no failures. It is counted in seconds. In this example the reset period is 0x15180 sec (because of little endian). In decimal it is equivalent of 86400 sec or equal to 24 hours. So, if in a period of 24 hours there are no failures then the failure count is reset to zero.

接下来的四个字节00 00 00 00对应于lpRebootMsg.有关此结构成员和下一个成员的更多信息，请参见 这里

The next four bytes 00 00 00 00 correspond to lpRebootMsg. More info about this structure's member and the next one can be found here

接下来的四个字节00 00 00 00对应于lpCommand.

The next four bytes 00 00 00 00 correspond to lpCommand.

接下来的四个字节03 00 00 00对应于cActions.该成员是 lpsaActions 数组中的元素数.在这种情况下，我们有 3 个元素.

The next four bytes 03 00 00 00 correspond to cActions. This member is the number of elements in the lpsaActions array. In this case we have 3 elements.

接下来的四个字节14 00 00 00对应于lpsaActions，它是一个指向SA_ACTION类型数组的指针.

The next four bytes 14 00 00 00 correspond to lpsaActions which is a pointer to an array of type SA_ACTION.

最后，01 00 00 00 60 EA 00 0001 00 00 00 60 EA 00 0000 00 00 00 00 00 00 00 是 lpsaActions 指向的 SC_ACTION 类型数组的内容.我们有对应于 3 行字节的这个结构的 3 个实例.结构 SC_ACTION 声明如下:

Finally, 01 00 00 00 60 EA 00 00 01 00 00 00 60 EA 00 00 00 00 00 00 00 00 00 00 is the content of an array of type SC_ACTION pointed by lpsaActions. We have 3 instances of this structure corresponding to the 3 lines of bytes. The structure SC_ACTION is declared below:

typedef struct _SC_ACTION {
    SC_ACTION_TYPE Type;
    DWORD          Delay;
} SC_ACTION, *LPSC_ACTION;

有关 SC_ACTION 和 SC_ACTION_TYPE 的更多信息，请访问 此处.

More info about SC_ACTION and SC_ACTION_TYPE can be found here.

所以，第一行 01 00 00 00 60 EA 00 00 的意思是:如果失败，60 后重启服务(01 00 00 00)秒(60 EA 00 00 == 到 0xEA60 ms == 60000 ms == 60 sec)."第二行意思相同.第三行表示如果失败，0秒后不采取任何行动(00 00 00 00)(00 00 00 00)"

So, first line 01 00 00 00 60 EA 00 00 means: : "In case of a failure, restart the service (01 00 00 00) after 60 sec (60 EA 00 00 == to 0xEA60 ms == 60000 ms == 60 sec)." The second line means the same. The third line means "In case of failure, take no action(00 00 00 00) after 0 sec (00 00 00 00)"

这是如何工作的?每次服务失败时，服务控制器都会增加失败计数 N 并采取 lpsaActions 指向的数组中指定的操作 N-1.在我们的例子中，服务第一次失败时，N 增加到 1，控制器将执行由 0 索引的动作，这意味着在 60 秒后重新启动服务.第二次失败时 N 增加到 2 并采取操作 N-1 = 1 这意味着，在 60 秒后重新启动服务.第三次服务失败时，控制器执行数组中的最后一个动作，在我们的例子中，不采取任何动作.如果N 大于cActions，则服务控制器重复数组中的最后一个动作.在这种情况下，服务不再启动.

How this works? Each time a service fails, the service controller increments a failure count N and take the action N-1 specified in the array pointed by lpsaActions. In our case, first time the service fails, N is incremented to 1 and the controller will execute the actions indexed by 0 which means, restart the service after 60 sec. Second time it fails the N is incremented to 2 and the action N-1 = 1 is taken which means, restart the service after 60 sec. The third time the service fails the controller executes the last action in array which in our case is, take no action. If N is greater than cActions, the service controller repeats the last action in the array. In this case the service is no started anymore.

这篇关于什么 REG-BINARY 设置为 failureAction 服务的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！