3 * Samba Unix/Linux SMB client utility
4 * Write Eventlog records to a tdb, perform other eventlog related functions
7 * Copyright (C) Brian Moran 2005.
8 * Copyright (C) Guenther Deschner 2009.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 #include "lib/eventlog/eventlog.h"
28 #include "registry/reg_backend_db.h"
29 #include "registry/reg_objects.h"
36 static void usage( char *s
)
38 printf( "\nUsage: %s [OPTION]\n\n", s
);
39 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
40 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
41 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
42 printf( "\nMiscellaneous options:\n" );
43 printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
44 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
45 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
48 static void display_eventlog_names( void )
53 elogs
= lp_eventlog_list( );
54 printf( "Active eventlog names:\n" );
55 printf( "--------------------------------------\n" );
57 for ( i
= 0; elogs
[i
]; i
++ ) {
58 printf( "\t%s\n", elogs
[i
] );
62 printf( "\t<None specified>\n");
65 /*********************************************************************
66 for an eventlog, add in a source name. If the eventlog doesn't
67 exist (not in the list) do nothing. If a source for the log
68 already exists, change the information (remove, replace)
69 *********************************************************************/
70 static bool eventlog_add_source( const char *eventlog
, const char *sourcename
,
71 const char *messagefile
)
73 /* Find all of the eventlogs, add keys for each of them */
74 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
75 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
77 const char **elogs
= lp_eventlog_list( );
78 const char **wrklist
, **wp
;
79 char *evtlogpath
= NULL
;
80 struct regsubkey_ctr
*subkeys
;
81 struct regval_ctr
*values
;
82 struct regval_blob
*rval
;
87 TALLOC_CTX
*ctx
= talloc_tos();
95 for ( i
= 0; elogs
[i
]; i
++ ) {
96 if ( strequal( elogs
[i
], eventlog
) )
101 d_printf("Eventlog [%s] not found in list of valid event logs\n",
103 return false; /* invalid named passed in */
106 /* have to assume that the evenlog key itself exists at this point */
107 /* add in a key of [sourcename] under the eventlog key */
109 /* todo add to Sources */
111 werr
= regval_ctr_init(ctx
, &values
);
112 if(!W_ERROR_IS_OK(werr
)) {
113 d_printf("talloc() failure!\n");
117 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
123 regdb_fetch_values( evtlogpath
, values
);
126 if ( !( rval
= regval_ctr_getvalue( values
, "Sources" ) ) ) {
127 d_printf("No Sources value for [%s]!\n", eventlog
);
130 /* perhaps this adding a new string to a multi_sz should be a fn? */
131 /* check to see if it's there already */
133 if ( regval_type(rval
) != REG_MULTI_SZ
) {
134 d_printf("Wrong type for Sources, should be REG_MULTI_SZ\n");
137 /* convert to a 'regulah' chars to do some comparisons */
141 dump_data(1, regval_data_p(rval
), regval_size(rval
));
143 blob
= data_blob_const(regval_data_p(rval
), regval_size(rval
));
144 if (!pull_reg_multi_sz(talloc_tos(), &blob
, &wrklist
)) {
148 for (ii
=0; wrklist
[ii
]; ii
++) {
152 if (numsources
> 0) {
153 /* see if it's in there already */
157 if ( strequal( *wp
, sourcename
) ) {
158 d_printf("Source name [%s] already in list for [%s] \n",
159 sourcename
, eventlog
);
166 d_printf("Nothing in the sources list, this might be a problem\n");
172 /* make a new list with an additional entry; copy values, add another */
173 wp
= TALLOC_ARRAY(ctx
, const char *, numsources
+ 2 );
176 d_printf("talloc() failed \n");
179 memcpy( wp
, wrklist
, sizeof( char * ) * numsources
);
180 *( wp
+ numsources
) = ( char * ) sourcename
;
181 *( wp
+ numsources
+ 1 ) = NULL
;
182 if (!push_reg_multi_sz(ctx
, &blob
, wp
)) {
185 dump_data( 1, blob
.data
, blob
.length
);
186 regval_ctr_addvalue( values
, "Sources", REG_MULTI_SZ
,
187 blob
.data
, blob
.length
);
188 regdb_store_values( evtlogpath
, values
);
189 data_blob_free(&blob
);
191 d_printf("Source name [%s] found in existing list of sources\n",
195 TALLOC_FREE(wrklist
); /* */
197 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
198 if (!W_ERROR_IS_OK(werr
)) {
199 d_printf("talloc() failure!\n");
202 TALLOC_FREE(evtlogpath
);
203 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
205 TALLOC_FREE(subkeys
);
209 regdb_fetch_keys( evtlogpath
, subkeys
);
211 if ( !regsubkey_ctr_key_exists( subkeys
, sourcename
) ) {
212 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
213 sourcename
, eventlog
);
214 regsubkey_ctr_addkey( subkeys
, sourcename
);
215 if ( !regdb_store_keys( evtlogpath
, subkeys
) )
218 TALLOC_FREE(subkeys
);
220 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
222 /* now allocate room for the source's subkeys */
224 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
225 if (!W_ERROR_IS_OK(werr
)) {
226 d_printf("talloc() failure!\n");
229 TALLOC_FREE(evtlogpath
);
230 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s\\%s",
231 KEY_EVENTLOG
, eventlog
, sourcename
);
233 TALLOC_FREE(subkeys
);
237 regdb_fetch_keys( evtlogpath
, subkeys
);
239 /* now add the values to the KEY_EVENTLOG/Application form key */
240 werr
= regval_ctr_init(ctx
, &values
);
241 if (!W_ERROR_IS_OK(werr
)) {
242 d_printf("talloc() failure!\n");
245 d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
246 messagefile
, evtlogpath
);
248 regdb_fetch_values( evtlogpath
, values
);
250 regval_ctr_addvalue_sz(values
, "EventMessageFile", messagefile
);
251 regdb_store_values( evtlogpath
, values
);
258 static int DoAddSourceCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
262 printf( "need more arguments:\n" );
263 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
266 /* must open the registry before we access it */
267 if (!W_ERROR_IS_OK(regdb_init())) {
268 printf( "Can't open the registry.\n" );
272 if ( !eventlog_add_source( argv
[0], argv
[1], argv
[2] ) )
277 static int DoWriteCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
284 /* fixed constants are bad bad bad */
287 struct eventlog_Record_tdb ee
;
288 uint32_t record_number
= 0;
289 TALLOC_CTX
*mem_ctx
= talloc_tos();
293 printf( "Can't open STDIN\n" );
298 printf( "Starting write for eventlog [%s]\n", argv
[0] );
299 display_eventlog_names( );
304 if ( !( etdb
= elog_open_tdb( argfname
, False
, False
) ) ) {
305 printf( "can't open the eventlog TDB (%s)\n", argfname
);
309 ZERO_STRUCT( ee
); /* MUST initialize between records */
311 while ( !feof( f1
) ) {
312 if (fgets( linein
, sizeof( linein
) - 1, f1
) == NULL
) {
315 if ((strlen(linein
) > 0)
316 && (linein
[strlen(linein
)-1] == '\n')) {
317 linein
[strlen(linein
)-1] = 0;
321 printf( "Read line [%s]\n", linein
);
326 parse_logentry( mem_ctx
, ( char * ) &linein
, &ee
, &is_eor
);
327 /* should we do something with the return code? */
330 fixup_eventlog_record_tdb( &ee
);
333 printf( "record number [%d], tg [%d] , tw [%d]\n",
334 ee
.record_number
, (int)ee
.time_generated
, (int)ee
.time_written
);
336 if ( ee
.time_generated
!= 0 ) {
338 /* printf("Writing to the event log\n"); */
340 status
= evlog_push_record_tdb( mem_ctx
, ELOG_TDB_CTX(etdb
),
341 &ee
, &record_number
);
342 if ( !NT_STATUS_IS_OK(status
) ) {
343 printf( "Can't write to the event log: %s\n",
347 printf( "Wrote record %d\n",
352 printf( "<null record>\n" );
354 ZERO_STRUCT( ee
); /* MUST initialize between records */
358 elog_close_tdb( etdb
, False
);
363 static int DoDumpCommand(int argc
, char **argv
, bool debugflag
, char *exename
)
366 TALLOC_CTX
*mem_ctx
= talloc_tos();
367 const char *tdb_filename
;
374 tdb_filename
= argv
[0];
377 count
= atoi(argv
[1]);
380 etdb
= elog_open_tdb(argv
[0], false, true);
382 printf("can't open the eventlog TDB (%s)\n", argv
[0]);
388 struct eventlog_Record_tdb
*r
;
391 r
= evlog_pull_record_tdb(mem_ctx
, etdb
->tdb
, count
);
396 printf("displaying record: %d\n", count
);
398 s
= NDR_PRINT_STRUCT_STRING(mem_ctx
, eventlog_Record_tdb
, r
);
406 elog_close_tdb(etdb
, false);
411 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
413 int main( int argc
, char *argv
[] )
417 char *configfile
= NULL
;
418 TALLOC_CTX
*frame
= talloc_stackframe();
425 opt_debug
= 0; /* todo set this from getopts */
431 fstrcpy( opname
, "write" ); /* the default */
433 #if 0 /* TESTING CODE */
434 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
436 while ( ( opt
= getopt( argc
, argv
, "dho:s:" ) ) != EOF
) {
440 fstrcpy( opname
, optarg
);
445 display_eventlog_names( );
453 configfile
= talloc_strdup(frame
, optarg
);
463 printf( "\nNot enough arguments!\n" );
468 if ( configfile
== NULL
) {
469 lp_load(get_dyn_CONFIGFILE(), True
, False
, False
, True
);
470 } else if (!lp_load(configfile
, True
, False
, False
, True
)) {
471 printf("Unable to parse configfile '%s'\n",configfile
);
475 /* note that the separate command types should call usage if they need to... */
477 if ( !StrCaseCmp( opname
, "addsource" ) ) {
478 rc
= DoAddSourceCommand( argc
, argv
, opt_debug
,
482 if ( !StrCaseCmp( opname
, "write" ) ) {
483 rc
= DoWriteCommand( argc
, argv
, opt_debug
, exename
);
486 if ( !StrCaseCmp( opname
, "dump" ) ) {
487 rc
= DoDumpCommand( argc
, argv
, opt_debug
, exename
);
490 printf( "unknown command [%s]\n", opname
);