source3/utils/eventlogadm.c

   1
   2 /*
   3  * Samba Unix/Linux SMB client utility
   4  * Write Eventlog records to a tdb, perform other eventlog related functions
   5  *
   6  *
   7  * Copyright (C) Brian Moran                2005.
   8  * Copyright (C) Guenther Deschner          2009.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 3 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24
  25 #include "includes.h"
  26 #include "lib/eventlog/eventlog.h"
  27 #include "registry.h"
  28 #include "registry/reg_backend_db.h"
  29 #include "registry/reg_eventlog.h"
  30
  31 #undef  DBGC_CLASS
  32 #define DBGC_CLASS DBGC_UTIL_EVENTLOG
  33
  34
  35 extern int optind;
  36 extern char *optarg;
  37
  38 int opt_debug = 0;
  39
  40 static void usage( char *s )
  41 {
  42         printf( "\nUsage: %s [OPTION]\n\n", s );
  43         printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
  44         printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
  45         printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
  46         printf( "\nMiscellaneous options:\n" );
  47         printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
  48         printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
  49         printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
  50 }
  51
  52 static void display_eventlog_names( void )
  53 {
  54         const char **elogs;
  55         int i;
  56
  57         elogs = lp_eventlog_list(  );
  58         printf( "Active eventlog names:\n" );
  59         printf( "--------------------------------------\n" );
  60         if ( elogs ) {
  61                 for ( i = 0; elogs[i]; i++ ) {
  62                         printf( "\t%s\n", elogs[i] );
  63                 }
  64         }
  65         else
  66                 printf( "\t<None specified>\n");
  67 }
  68
  69 static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename )
  70 {
  71
  72         if ( argc < 3 ) {
  73                 printf( "need more arguments:\n" );
  74                 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
  75                 return -1;
  76         }
  77         /* must open the registry before we access it */
  78         if (!W_ERROR_IS_OK(regdb_init())) {
  79                 printf( "Can't open the registry.\n" );
  80                 return -1;
  81         }
  82
  83         if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) )
  84                 return -2;
  85         return 0;
  86 }
  87
  88 static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename )
  89 {
  90         FILE *f1;
  91         char *argfname;
  92         ELOG_TDB *etdb;
  93         NTSTATUS status;
  94
  95         /* fixed constants are bad bad bad  */
  96         char linein[1024];
  97         bool is_eor;
  98         struct eventlog_Record_tdb ee;
  99         uint32_t record_number = 0;
 100         TALLOC_CTX *mem_ctx = talloc_tos();
 101
 102         f1 = stdin;
 103         if ( !f1 ) {
 104                 printf( "Can't open STDIN\n" );
 105                 return -1;
 106         }
 107
 108         if ( debugflag ) {
 109                 printf( "Starting write for eventlog [%s]\n", argv[0] );
 110                 display_eventlog_names(  );
 111         }
 112
 113         argfname = argv[0];
 114
 115         if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) {
 116                 printf( "can't open the eventlog TDB (%s)\n", argfname );
 117                 return -1;
 118         }
 119
 120         ZERO_STRUCT( ee );      /* MUST initialize between records */
 121
 122         while ( !feof( f1 ) ) {
 123                 if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) {
 124                         break;
 125                 }
 126                 if ((strlen(linein) > 0)
 127                     && (linein[strlen(linein)-1] == '\n')) {
 128                         linein[strlen(linein)-1] = 0;
 129                 }
 130
 131                 if ( debugflag )
 132                         printf( "Read line [%s]\n", linein );
 133
 134                 is_eor = False;
 135
 136
 137                 parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor );
 138                 /* should we do something with the return code? */
 139
 140                 if ( is_eor ) {
 141                         fixup_eventlog_record_tdb( &ee );
 142
 143                         if ( opt_debug )
 144                                 printf( "record number [%d], tg [%d] , tw [%d]\n",
 145                                         ee.record_number, (int)ee.time_generated, (int)ee.time_written );
 146
 147                         if ( ee.time_generated != 0 ) {
 148
 149                                 /* printf("Writing to the event log\n"); */
 150
 151                                 status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb),
 152                                                                 &ee, &record_number );
 153                                 if ( !NT_STATUS_IS_OK(status) ) {
 154                                         printf( "Can't write to the event log: %s\n",
 155                                                 nt_errstr(status) );
 156                                 } else {
 157                                         if ( opt_debug )
 158                                                 printf( "Wrote record %d\n",
 159                                                         record_number );
 160                                 }
 161                         } else {
 162                                 if ( opt_debug )
 163                                         printf( "<null record>\n" );
 164                         }
 165                         ZERO_STRUCT( ee );      /* MUST initialize between records */
 166                 }
 167         }
 168
 169         elog_close_tdb( etdb , False );
 170
 171         return 0;
 172 }
 173
 174 static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename)
 175 {
 176         ELOG_TDB *etdb;
 177         TALLOC_CTX *mem_ctx = talloc_tos();
 178         const char *tdb_filename;
 179         uint32_t count = 1;
 180
 181         if (argc > 2) {
 182                 return -1;
 183         }
 184
 185         tdb_filename = argv[0];
 186
 187         if (argc > 1) {
 188                 count = atoi(argv[1]);
 189         }
 190
 191         etdb = elog_open_tdb(argv[0], false, true);
 192         if (!etdb) {
 193                 printf("can't open the eventlog TDB (%s)\n", argv[0]);
 194                 return -1;
 195         }
 196
 197         while (1) {
 198
 199                 struct eventlog_Record_tdb *r;
 200                 char *s;
 201
 202                 r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count);
 203                 if (!r) {
 204                         break;
 205                 }
 206
 207                 printf("displaying record: %d\n", count);
 208
 209                 s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r);
 210                 if (s) {
 211                         printf("%s\n", s);
 212                         talloc_free(s);
 213                 }
 214                 count++;
 215         }
 216
 217         elog_close_tdb(etdb, false);
 218
 219         return 0;
 220 }
 221
 222 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
 223
 224 int main( int argc, char *argv[] )
 225 {
 226         int opt, rc;
 227         char *exename;
 228         char *configfile = NULL;
 229         TALLOC_CTX *frame = talloc_stackframe();
 230
 231
 232         fstring opname;
 233
 234         load_case_tables();
 235
 236         opt_debug = 0;          /* todo set this from getopts */
 237
 238         exename = argv[0];
 239
 240         /* default */
 241
 242         fstrcpy( opname, "write" );     /* the default */
 243
 244 #if 0                           /* TESTING CODE */
 245         eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
 246 #endif
 247         while ( ( opt = getopt( argc, argv, "dho:s:" ) ) != EOF ) {
 248                 switch ( opt ) {
 249
 250                 case 'o':
 251                         fstrcpy( opname, optarg );
 252                         break;
 253
 254                 case 'h':
 255                         usage( exename );
 256                         display_eventlog_names(  );
 257                         exit( 0 );
 258                         break;
 259
 260                 case 'd':
 261                         opt_debug = 1;
 262                         break;
 263                 case 's':
 264                         configfile = talloc_strdup(frame, optarg);
 265                         break;
 266
 267                 }
 268         }
 269
 270         argc -= optind;
 271         argv += optind;
 272
 273         if ( argc < 1 ) {
 274                 printf( "\nNot enough arguments!\n" );
 275                 usage( exename );
 276                 exit( 1 );
 277         }
 278
 279         if ( configfile == NULL ) {
 280                 lp_load(get_dyn_CONFIGFILE(), True, False, False, True);
 281         } else if (!lp_load(configfile, True, False, False, True)) {
 282                 printf("Unable to parse configfile '%s'\n",configfile);
 283                 exit( 1 );
 284         }
 285
 286         /*  note that the separate command types should call usage if they need to... */
 287         while ( 1 ) {
 288                 if ( !StrCaseCmp( opname, "addsource" ) ) {
 289                         rc = DoAddSourceCommand( argc, argv, opt_debug,
 290                                                  exename );
 291                         break;
 292                 }
 293                 if ( !StrCaseCmp( opname, "write" ) ) {
 294                         rc = DoWriteCommand( argc, argv, opt_debug, exename );
 295                         break;
 296                 }
 297                 if ( !StrCaseCmp( opname, "dump" ) ) {
 298                         rc = DoDumpCommand( argc, argv, opt_debug, exename );
 299                         break;
 300                 }
 301                 printf( "unknown command [%s]\n", opname );
 302                 usage( exename );
 303                 exit( 1 );
 304                 break;
 305         }
 306         TALLOC_FREE(frame);
 307         return rc;
 308 }