source/rpc_server/srv_eventlog_lib.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Eventlog utility  routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005,
   5  *  Copyright (C) Brian Moran                2005.
   6  *  Copyright (C) Gerald (Jerry) Carter      2005.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23
  24 /* maintain a list of open eventlog tdbs with reference counts */
  25
  26 static ELOG_TDB *open_elog_list;
  27
  28 /********************************************************************
  29  Init an Eventlog TDB, and return it. If null, something bad
  30  happened.
  31 ********************************************************************/
  32
  33 TDB_CONTEXT *elog_init_tdb( char *tdbfilename )
  34 {
  35         TDB_CONTEXT *tdb;
  36
  37         DEBUG(10,("elog_init_tdb: Initializing eventlog tdb (%s)\n",
  38                 tdbfilename));
  39
  40         tdb = tdb_open_log( tdbfilename, 0, TDB_DEFAULT,
  41                 O_RDWR|O_CREAT|O_TRUNC, 0660 );
  42
  43         if ( !tdb ) {
  44                 DEBUG( 0, ( "Can't open tdb for [%s]\n", tdbfilename ) );
  45                 return NULL;
  46         }
  47
  48         /* initialize with defaults, copy real values in here from registry */
  49
  50         tdb_store_int32( tdb, EVT_OLDEST_ENTRY, 1 );
  51         tdb_store_int32( tdb, EVT_NEXT_RECORD, 1 );
  52         tdb_store_int32( tdb, EVT_MAXSIZE, 0x80000 );
  53         tdb_store_int32( tdb, EVT_RETENTION, 0x93A80 );
  54
  55         tdb_store_int32( tdb, EVT_VERSION, EVENTLOG_DATABASE_VERSION_V1 );
  56
  57         return tdb;
  58 }
  59
  60 /********************************************************************
  61  make the tdb file name for an event log, given destination buffer
  62  and size. Caller must free memory.
  63 ********************************************************************/
  64
  65 char *elog_tdbname(TALLOC_CTX *ctx, const char *name )
  66 {
  67         char *path = talloc_asprintf(ctx, "%s/%s.tdb",
  68                         state_path("eventlog"),
  69                         name);
  70         if (!path) {
  71                 return NULL;
  72         }
  73         strlower_m(path);
  74         return path;
  75 }
  76
  77
  78 /********************************************************************
  79  this function is used to count up the number of bytes in a
  80  particular TDB
  81 ********************************************************************/
  82
  83 struct trav_size_struct {
  84         int size;
  85         int rec_count;
  86 };
  87
  88 static int eventlog_tdb_size_fn( TDB_CONTEXT * tdb, TDB_DATA key, TDB_DATA data,
  89                           void *state )
  90 {
  91         struct trav_size_struct  *tsize = (struct trav_size_struct *)state;
  92
  93         tsize->size += data.dsize;
  94         tsize->rec_count++;
  95
  96         return 0;
  97 }
  98
  99 /********************************************************************
 100  returns the size of the eventlog, and if MaxSize is a non-null
 101  ptr, puts the MaxSize there. This is purely a way not to have yet
 102  another function that solely reads the maxsize of the eventlog.
 103  Yeah, that's it.
 104 ********************************************************************/
 105
 106 int elog_tdb_size( TDB_CONTEXT * tdb, int *MaxSize, int *Retention )
 107 {
 108         struct trav_size_struct tsize;
 109
 110         if ( !tdb )
 111                 return 0;
 112
 113         ZERO_STRUCT( tsize );
 114
 115         tdb_traverse( tdb, eventlog_tdb_size_fn, &tsize );
 116
 117         if ( MaxSize != NULL ) {
 118                 *MaxSize = tdb_fetch_int32( tdb, EVT_MAXSIZE );
 119         }
 120
 121         if ( Retention != NULL ) {
 122                 *Retention = tdb_fetch_int32( tdb, EVT_RETENTION );
 123         }
 124
 125         DEBUG( 1,
 126                ( "eventlog size: [%d] for [%d] records\n", tsize.size,
 127                  tsize.rec_count ) );
 128         return tsize.size;
 129 }
 130
 131 /********************************************************************
 132  Discard early event logs until we have enough for 'needed' bytes...
 133  NO checking done beforehand to see that we actually need to do
 134  this, and it's going to pluck records one-by-one. So, it's best
 135  to determine that this needs to be done before doing it.
 136
 137  Setting whack_by_date to True indicates that eventlogs falling
 138  outside of the retention range need to go...
 139
 140  return True if we made enough room to accommodate needed bytes
 141 ********************************************************************/
 142
 143 static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
 144                                     bool whack_by_date )
 145 {
 146         int start_record, i, new_start;
 147         int end_record;
 148         int nbytes, reclen, len, Retention, MaxSize;
 149         int tresv1, trecnum, timegen, timewr;
 150         TDB_DATA key, ret;
 151         time_t current_time, exp_time;
 152
 153         /* discard some eventlogs */
 154
 155         /* read eventlogs from oldest_entry -- there can't be any discontinuity in recnos,
 156            although records not necessarily guaranteed to have successive times */
 157         /* */
 158
 159         /* lock */
 160         tdb_lock_bystring_with_timeout( the_tdb, EVT_NEXT_RECORD, 1 );
 161         /* read */
 162         end_record = tdb_fetch_int32( the_tdb, EVT_NEXT_RECORD );
 163         start_record = tdb_fetch_int32( the_tdb, EVT_OLDEST_ENTRY );
 164         Retention = tdb_fetch_int32( the_tdb, EVT_RETENTION );
 165         MaxSize = tdb_fetch_int32( the_tdb, EVT_MAXSIZE );
 166
 167         time( &current_time );
 168
 169         /* calculate ... */
 170         exp_time = current_time - Retention;    /* discard older than exp_time */
 171
 172         /* todo - check for sanity in next_record */
 173         nbytes = 0;
 174
 175         DEBUG( 3,
 176                ( "MaxSize [%d] Retention [%d] Current Time [%d]  exp_time [%d]\n",
 177                  MaxSize, Retention, (uint32)current_time, (uint32)exp_time ) );
 178         DEBUG( 3,
 179                ( "Start Record [%d] End Record [%d]\n", start_record,
 180                  end_record ) );
 181
 182         for ( i = start_record; i < end_record; i++ ) {
 183                 /* read a record, add the amt to nbytes */
 184                 key.dsize = sizeof( int32 );
 185                 key.dptr = ( uint8 * ) ( int32 * ) & i;
 186                 ret = tdb_fetch( the_tdb, key );
 187                 if ( ret.dsize == 0 ) {
 188                         DEBUG( 8,
 189                                ( "Can't find a record for the key, record [%d]\n",
 190                                  i ) );
 191                         tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
 192                         return False;
 193                 }
 194                 nbytes += ret.dsize;    /* note this includes overhead */
 195
 196                 len = tdb_unpack( ret.dptr, ret.dsize, "ddddd", &reclen,
 197                                   &tresv1, &trecnum, &timegen, &timewr );
 198                 if (len == -1) {
 199                         DEBUG( 10,("make_way_for_eventlogs: tdb_unpack failed.\n"));
 200                         tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
 201                         return False;
 202                 }
 203
 204                 DEBUG( 8,
 205                        ( "read record %d, record size is [%d], total so far [%d]\n",
 206                          i, reclen, nbytes ) );
 207
 208                 SAFE_FREE( ret.dptr );
 209
 210                 /* note that other servers may just stop writing records when the size limit
 211                    is reached, and there are no records older than 'retention'. This doesn't
 212                    like a very useful thing to do, so instead we whack (as in sleeps with the
 213                    fishes) just enough records to fit the what we need.  This behavior could
 214                    be changed to 'match', if the need arises. */
 215
 216                 if ( !whack_by_date && ( nbytes >= needed ) )
 217                         break;  /* done */
 218                 if ( whack_by_date && ( timegen >= exp_time ) )
 219                         break;  /* done */
 220         }
 221
 222         DEBUG( 3,
 223                ( "nbytes [%d] needed [%d] start_record is [%d], should be set to [%d]\n",
 224                  nbytes, needed, start_record, i ) );
 225         /* todo - remove eventlog entries here and set starting record to start_record... */
 226         new_start = i;
 227         if ( start_record != new_start ) {
 228                 for ( i = start_record; i < new_start; i++ ) {
 229                         key.dsize = sizeof( int32 );
 230                         key.dptr = ( uint8 * ) ( int32 * ) & i;
 231                         tdb_delete( the_tdb, key );
 232                 }
 233
 234                 tdb_store_int32( the_tdb, EVT_OLDEST_ENTRY, new_start );
 235         }
 236         tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
 237         return True;
 238 }
 239
 240 /********************************************************************
 241   some hygiene for an eventlog - see how big it is, and then
 242   calculate how many bytes we need to remove
 243 ********************************************************************/
 244
 245 bool prune_eventlog( TDB_CONTEXT * tdb )
 246 {
 247         int MaxSize, Retention, CalcdSize;
 248
 249         if ( !tdb ) {
 250                 DEBUG( 4, ( "No eventlog tdb handle\n" ) );
 251                 return False;
 252         }
 253
 254         CalcdSize = elog_tdb_size( tdb, &MaxSize, &Retention );
 255         DEBUG( 3,
 256                ( "Calculated size [%d] MaxSize [%d]\n", CalcdSize,
 257                  MaxSize ) );
 258
 259         if ( CalcdSize > MaxSize ) {
 260                 return make_way_for_eventlogs( tdb, CalcdSize - MaxSize,
 261                                                False );
 262         }
 263
 264         return make_way_for_eventlogs( tdb, 0, True );
 265 }
 266
 267 /********************************************************************
 268 ********************************************************************/
 269
 270 bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32 needed )
 271 {
 272         int calcd_size;
 273         int MaxSize, Retention;
 274
 275         /* see if we can write to the eventlog -- do a policy enforcement */
 276         if ( !tdb )
 277                 return False;   /* tdb is null, so we can't write to it */
 278
 279
 280         if ( needed < 0 )
 281                 return False;
 282         MaxSize = 0;
 283         Retention = 0;
 284
 285         calcd_size = elog_tdb_size( tdb, &MaxSize, &Retention );
 286
 287         if ( calcd_size <= MaxSize )
 288                 return True;    /* you betcha */
 289         if ( calcd_size + needed < MaxSize )
 290                 return True;
 291
 292         if ( Retention == 0xffffffff ) {
 293                 return False;   /* see msdn - we can't write no room, discard */
 294         }
 295         /*
 296            note don't have to test, but always good to show intent, in case changes needed
 297            later
 298          */
 299
 300         if ( Retention == 0x00000000 ) {
 301                 /* discard record(s) */
 302                 /* todo  - decide when to remove a bunch vs. just what we need... */
 303                 return make_way_for_eventlogs( tdb, calcd_size - MaxSize,
 304                                                True );
 305         }
 306
 307         return make_way_for_eventlogs( tdb, calcd_size - MaxSize, False );
 308 }
 309
 310 /*******************************************************************
 311 *******************************************************************/
 312
 313 ELOG_TDB *elog_open_tdb( char *logname, bool force_clear )
 314 {
 315         TDB_CONTEXT *tdb = NULL;
 316         uint32 vers_id;
 317         ELOG_TDB *ptr;
 318         char *tdbpath = NULL;
 319         ELOG_TDB *tdb_node = NULL;
 320         char *eventlogdir;
 321         TALLOC_CTX *ctx = talloc_tos();
 322
 323         /* first see if we have an open context */
 324
 325         for ( ptr=open_elog_list; ptr; ptr=ptr->next ) {
 326                 if ( strequal( ptr->name, logname ) ) {
 327                         ptr->ref_count++;
 328
 329                         /* trick to alow clearing of the eventlog tdb.
 330                            The force_clear flag should imply that someone
 331                            has done a force close.  So make sure the tdb
 332                            is NULL.  If this is a normal open, then just
 333                            return the existing reference */
 334
 335                         if ( force_clear ) {
 336                                 SMB_ASSERT( ptr->tdb == NULL );
 337                                 break;
 338                         }
 339                         else
 340                                 return ptr;
 341                 }
 342         }
 343
 344         /* make sure that the eventlog dir exists */
 345
 346         eventlogdir = state_path( "eventlog" );
 347         if ( !directory_exist( eventlogdir, NULL ) )
 348                 mkdir( eventlogdir, 0755 );
 349
 350         /* get the path on disk */
 351
 352         tdbpath = elog_tdbname(ctx, logname);
 353         if (!tdbpath) {
 354                 return NULL;
 355         }
 356
 357         DEBUG(7,("elog_open_tdb: Opening %s...(force_clear == %s)\n",
 358                 tdbpath, force_clear?"True":"False" ));
 359
 360         /* the tdb wasn't already open or this is a forced clear open */
 361
 362         if ( !force_clear ) {
 363
 364                 tdb = tdb_open_log( tdbpath, 0, TDB_DEFAULT, O_RDWR , 0 );
 365                 if ( tdb ) {
 366                         vers_id = tdb_fetch_int32( tdb, EVT_VERSION );
 367
 368                         if ( vers_id != EVENTLOG_DATABASE_VERSION_V1 ) {
 369                                 DEBUG(1,("elog_open_tdb: Invalid version [%d] on file [%s].\n",
 370                                         vers_id, tdbpath));
 371                                 tdb_close( tdb );
 372                                 tdb = elog_init_tdb( tdbpath );
 373                         }
 374                 }
 375         }
 376
 377         if ( !tdb )
 378                 tdb = elog_init_tdb( tdbpath );
 379
 380         /* if we got a valid context, then add it to the list */
 381
 382         if ( tdb ) {
 383                 /* on a forced clear, just reset the tdb context if we already
 384                    have an open entry in the list */
 385
 386                 if ( ptr ) {
 387                         ptr->tdb = tdb;
 388                         return ptr;
 389                 }
 390
 391                 if ( !(tdb_node = TALLOC_ZERO_P( NULL, ELOG_TDB)) ) {
 392                         DEBUG(0,("elog_open_tdb: talloc() failure!\n"));
 393                         tdb_close( tdb );
 394                         return NULL;
 395                 }
 396
 397                 tdb_node->name = talloc_strdup( tdb_node, logname );
 398                 tdb_node->tdb = tdb;
 399                 tdb_node->ref_count = 1;
 400
 401                 DLIST_ADD( open_elog_list, tdb_node );
 402         }
 403
 404         return tdb_node;
 405 }
 406
 407 /*******************************************************************
 408  Wrapper to handle reference counts to the tdb
 409 *******************************************************************/
 410
 411 int elog_close_tdb( ELOG_TDB *etdb, bool force_close )
 412 {
 413         TDB_CONTEXT *tdb;
 414
 415         if ( !etdb )
 416                 return 0;
 417
 418         etdb->ref_count--;
 419
 420         SMB_ASSERT( etdb->ref_count >= 0 );
 421
 422         if ( etdb->ref_count == 0 ) {
 423                 tdb = etdb->tdb;
 424                 DLIST_REMOVE( open_elog_list, etdb );
 425                 TALLOC_FREE( etdb );
 426                 return tdb_close( tdb );
 427         }
 428
 429         if ( force_close ) {
 430                 tdb = etdb->tdb;
 431                 etdb->tdb = NULL;
 432                 return tdb_close( tdb );
 433         }
 434
 435         return 0;
 436 }
 437
 438
 439 /*******************************************************************
 440  write an eventlog entry. Note that we have to lock, read next
 441  eventlog, increment, write, write the record, unlock
 442
 443  coming into this, ee has the eventlog record, and the auxilliary date
 444  (computer name, etc.) filled into the other structure. Before packing
 445  into a record, this routine will calc the appropriate padding, etc.,
 446  and then blast out the record in a form that can be read back in
 447 *******************************************************************/
 448
 449 #define MARGIN 512
 450
 451 int write_eventlog_tdb( TDB_CONTEXT * the_tdb, Eventlog_entry * ee )
 452 {
 453         int32 next_record;
 454         uint8 *packed_ee;
 455         TALLOC_CTX *mem_ctx = NULL;
 456         TDB_DATA kbuf, ebuf;
 457         uint32 n_packed;
 458
 459         if ( !ee )
 460                 return 0;
 461
 462         mem_ctx = talloc_init( "write_eventlog_tdb" );
 463
 464         if ( mem_ctx == NULL )
 465                 return 0;
 466
 467         /* discard any entries that have bogus time, which usually indicates a bogus entry as well. */
 468         if ( ee->record.time_generated == 0 )
 469                 return 0;
 470
 471         /* todo - check for sanity in next_record */
 472
 473         fixup_eventlog_entry( ee );
 474
 475         if ( !can_write_to_eventlog( the_tdb, ee->record.length ) ) {
 476                 DEBUG( 3, ( "Can't write to Eventlog, no room \n" ) );
 477                 talloc_destroy( mem_ctx );
 478                 return 0;
 479         }
 480
 481         /* alloc mem for the packed version */
 482         packed_ee = (uint8 *)TALLOC( mem_ctx, ee->record.length + MARGIN );
 483         if ( !packed_ee ) {
 484                 talloc_destroy( mem_ctx );
 485                 return 0;
 486         }
 487
 488         /* need to read the record number and insert it into the entry here */
 489
 490         /* lock */
 491         tdb_lock_bystring_with_timeout( the_tdb, EVT_NEXT_RECORD, 1 );
 492         /* read */
 493         next_record = tdb_fetch_int32( the_tdb, EVT_NEXT_RECORD );
 494
 495         n_packed =
 496                 tdb_pack( (uint8 *)packed_ee, ee->record.length + MARGIN,
 497                           "ddddddwwwwddddddBBdBBBd", ee->record.length,
 498                           ee->record.reserved1, next_record,
 499                           ee->record.time_generated, ee->record.time_written,
 500                           ee->record.event_id, ee->record.event_type,
 501                           ee->record.num_strings, ee->record.event_category,
 502                           ee->record.reserved2,
 503                           ee->record.closing_record_number,
 504                           ee->record.string_offset,
 505                           ee->record.user_sid_length,
 506                           ee->record.user_sid_offset, ee->record.data_length,
 507                           ee->record.data_offset,
 508                           ee->data_record.source_name_len,
 509                           ee->data_record.source_name,
 510                           ee->data_record.computer_name_len,
 511                           ee->data_record.computer_name,
 512                           ee->data_record.sid_padding,
 513                           ee->record.user_sid_length, ee->data_record.sid,
 514                           ee->data_record.strings_len,
 515                           ee->data_record.strings,
 516                           ee->data_record.user_data_len,
 517                           ee->data_record.user_data,
 518                           ee->data_record.data_padding );
 519
 520         /*DEBUG(3,("write_eventlog_tdb: packed into  %d\n",n_packed)); */
 521
 522         /* increment the record count */
 523
 524         kbuf.dsize = sizeof( int32 );
 525         kbuf.dptr = (uint8 * ) & next_record;
 526
 527         ebuf.dsize = n_packed;
 528         ebuf.dptr = (uint8 *)packed_ee;
 529
 530         if ( tdb_store( the_tdb, kbuf, ebuf, 0 ) ) {
 531                 /* DEBUG(1,("write_eventlog_tdb: Can't write record %d to eventlog\n",next_record)); */
 532                 tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
 533                 talloc_destroy( mem_ctx );
 534                 return 0;
 535         }
 536         next_record++;
 537         tdb_store_int32( the_tdb, EVT_NEXT_RECORD, next_record );
 538         tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
 539         talloc_destroy( mem_ctx );
 540         return ( next_record - 1 );
 541 }
 542
 543 /*******************************************************************
 544  calculate the correct fields etc for an eventlog entry
 545 *******************************************************************/
 546
 547 void fixup_eventlog_entry( Eventlog_entry * ee )
 548 {
 549         /* fix up the eventlog entry structure as necessary */
 550
 551         ee->data_record.sid_padding =
 552                 ( ( 4 -
 553                     ( ( ee->data_record.source_name_len +
 554                         ee->data_record.computer_name_len ) % 4 ) ) % 4 );
 555         ee->data_record.data_padding =
 556                 ( 4 -
 557                   ( ( ee->data_record.strings_len +
 558                       ee->data_record.user_data_len ) % 4 ) ) % 4;
 559         ee->record.length = sizeof( Eventlog_record );
 560         ee->record.length += ee->data_record.source_name_len;
 561         ee->record.length += ee->data_record.computer_name_len;
 562         if ( ee->record.user_sid_length == 0 ) {
 563                 /* Should not pad to a DWORD boundary for writing out the sid if there is
 564                    no SID, so just propagate the padding to pad the data */
 565                 ee->data_record.data_padding += ee->data_record.sid_padding;
 566                 ee->data_record.sid_padding = 0;
 567         }
 568         /* DEBUG(10, ("sid_padding is [%d].\n", ee->data_record.sid_padding)); */
 569         /* DEBUG(10, ("data_padding is [%d].\n", ee->data_record.data_padding)); */
 570
 571         ee->record.length += ee->data_record.sid_padding;
 572         ee->record.length += ee->record.user_sid_length;
 573         ee->record.length += ee->data_record.strings_len;
 574         ee->record.length += ee->data_record.user_data_len;
 575         ee->record.length += ee->data_record.data_padding;
 576         /* need another copy of length at the end of the data */
 577         ee->record.length += sizeof( ee->record.length );
 578 }
 579
 580 /********************************************************************
 581  Note that it's a pretty good idea to initialize the Eventlog_entry
 582  structure to zero's before calling parse_logentry on an batch of
 583  lines that may resolve to a record.  ALSO, it's a good idea to
 584  remove any linefeeds (that's EOL to you and me) on the lines
 585  going in.
 586 ********************************************************************/
 587
 588 bool parse_logentry( char *line, Eventlog_entry * entry, bool * eor )
 589 {
 590         TALLOC_CTX *ctx = talloc_tos();
 591         char *start = NULL, *stop = NULL;
 592
 593         start = line;
 594
 595         /* empty line signyfiying record delimeter, or we're at the end of the buffer */
 596         if ( start == NULL || strlen( start ) == 0 ) {
 597                 DEBUG( 6,
 598                        ( "parse_logentry: found end-of-record indicator.\n" ) );
 599                 *eor = True;
 600                 return True;
 601         }
 602         if ( !( stop = strchr( line, ':' ) ) ) {
 603                 return False;
 604         }
 605
 606         DEBUG( 6, ( "parse_logentry: trying to parse [%s].\n", line ) );
 607
 608         if ( 0 == strncmp( start, "LEN", stop - start ) ) {
 609                 /* This will get recomputed later anyway -- probably not necessary */
 610                 entry->record.length = atoi( stop + 1 );
 611         } else if ( 0 == strncmp( start, "RS1", stop - start ) ) {
 612                 /* For now all these reserved entries seem to have the same value,
 613                    which can be hardcoded to int(1699505740) for now */
 614                 entry->record.reserved1 = atoi( stop + 1 );
 615         } else if ( 0 == strncmp( start, "RCN", stop - start ) ) {
 616                 entry->record.record_number = atoi( stop + 1 );
 617         } else if ( 0 == strncmp( start, "TMG", stop - start ) ) {
 618                 entry->record.time_generated = atoi( stop + 1 );
 619         } else if ( 0 == strncmp( start, "TMW", stop - start ) ) {
 620                 entry->record.time_written = atoi( stop + 1 );
 621         } else if ( 0 == strncmp( start, "EID", stop - start ) ) {
 622                 entry->record.event_id = atoi( stop + 1 );
 623         } else if ( 0 == strncmp( start, "ETP", stop - start ) ) {
 624                 if ( strstr( start, "ERROR" ) ) {
 625                         entry->record.event_type = EVENTLOG_ERROR_TYPE;
 626                 } else if ( strstr( start, "WARNING" ) ) {
 627                         entry->record.event_type = EVENTLOG_WARNING_TYPE;
 628                 } else if ( strstr( start, "INFO" ) ) {
 629                         entry->record.event_type = EVENTLOG_INFORMATION_TYPE;
 630                 } else if ( strstr( start, "AUDIT_SUCCESS" ) ) {
 631                         entry->record.event_type = EVENTLOG_AUDIT_SUCCESS;
 632                 } else if ( strstr( start, "AUDIT_FAILURE" ) ) {
 633                         entry->record.event_type = EVENTLOG_AUDIT_FAILURE;
 634                 } else if ( strstr( start, "SUCCESS" ) ) {
 635                         entry->record.event_type = EVENTLOG_SUCCESS;
 636                 } else {
 637                         /* some other eventlog type -- currently not defined in MSDN docs, so error out */
 638                         return False;
 639                 }
 640         }
 641
 642 /*
 643   else if(0 == strncmp(start, "NST", stop - start))
 644   {
 645   entry->record.num_strings = atoi(stop + 1);
 646   }
 647 */
 648         else if ( 0 == strncmp( start, "ECT", stop - start ) ) {
 649                 entry->record.event_category = atoi( stop + 1 );
 650         } else if ( 0 == strncmp( start, "RS2", stop - start ) ) {
 651                 entry->record.reserved2 = atoi( stop + 1 );
 652         } else if ( 0 == strncmp( start, "CRN", stop - start ) ) {
 653                 entry->record.closing_record_number = atoi( stop + 1 );
 654         } else if ( 0 == strncmp( start, "USL", stop - start ) ) {
 655                 entry->record.user_sid_length = atoi( stop + 1 );
 656         } else if ( 0 == strncmp( start, "SRC", stop - start ) ) {
 657                 stop++;
 658                 while ( isspace( stop[0] ) ) {
 659                         stop++;
 660                 }
 661                 entry->data_record.source_name_len = rpcstr_push_talloc(ctx,
 662                                 &entry->data_record.source_name,
 663                                 stop);
 664                 if (entry->data_record.source_name_len == (uint32_t)-1 ||
 665                                 entry->data_record.source_name == NULL) {
 666                         return false;
 667                 }
 668         } else if ( 0 == strncmp( start, "SRN", stop - start ) ) {
 669                 stop++;
 670                 while ( isspace( stop[0] ) ) {
 671                         stop++;
 672                 }
 673                 entry->data_record.computer_name_len = rpcstr_push_talloc(ctx,
 674                                 &entry->data_record.computer_name,
 675                                 stop);
 676                 if (entry->data_record.computer_name_len == (uint32_t)-1 ||
 677                                 entry->data_record.computer_name == NULL) {
 678                         return false;
 679                 }
 680         } else if ( 0 == strncmp( start, "SID", stop - start ) ) {
 681                 stop++;
 682                 while ( isspace( stop[0] ) ) {
 683                         stop++;
 684                 }
 685                 entry->record.user_sid_length = rpcstr_push_talloc(ctx,
 686                                 &entry->data_record.sid,
 687                                 stop);
 688                 if (entry->record.user_sid_length == (uint32_t)-1 ||
 689                                 entry->data_record.sid == NULL) {
 690                         return false;
 691                 }
 692         } else if ( 0 == strncmp( start, "STR", stop - start ) ) {
 693                 smb_ucs2_t *temp = NULL;
 694                 size_t tmp_len;
 695                 uint32_t old_len;
 696                 /* skip past initial ":" */
 697                 stop++;
 698                 /* now skip any other leading whitespace */
 699                 while ( isspace(stop[0])) {
 700                         stop++;
 701                 }
 702                 tmp_len = rpcstr_push_talloc(ctx,
 703                                                 &temp,
 704                                                 stop);
 705                 if (tmp_len == (size_t)-1 || !temp) {
 706                         return false;
 707                 }
 708                 old_len = entry->data_record.strings_len;
 709                 entry->data_record.strings = (smb_ucs2_t *)TALLOC_REALLOC_ARRAY(ctx,
 710                                                 entry->data_record.strings,
 711                                                 char,
 712                                                 old_len + tmp_len);
 713                 if (!entry->data_record.strings) {
 714                         return false;
 715                 }
 716                 memcpy(entry->data_record.strings + old_len,
 717                                 temp,
 718                                 tmp_len);
 719                 entry->data_record.strings_len += tmp_len;
 720                 entry->record.num_strings++;
 721         } else if ( 0 == strncmp( start, "DAT", stop - start ) ) {
 722                 /* skip past initial ":" */
 723                 stop++;
 724                 /* now skip any other leading whitespace */
 725                 while ( isspace( stop[0] ) ) {
 726                         stop++;
 727                 }
 728                 entry->data_record.user_data_len = strlen(stop);
 729                 entry->data_record.user_data = talloc_strdup(ctx,
 730                                                 stop);
 731                 if (!entry->data_record.user_data) {
 732                         return false;
 733                 }
 734         } else {
 735                 /* some other eventlog entry -- not implemented, so dropping on the floor */
 736                 DEBUG( 10, ( "Unknown entry [%s]. Ignoring.\n", line ) );
 737                 /* For now return true so that we can keep on parsing this mess. Eventually
 738                    we will return False here. */
 739                 return true;
 740         }
 741         return true;
 742 }