source3/utils/eventlogadm.c

   1
   2 /*
   3  * Samba Unix/Linux SMB client utility
   4  * Write Eventlog records to a tdb, perform other eventlog related functions
   5  *
   6  *
   7  * Copyright (C) Brian Moran                2005.
   8  * Copyright (C) Guenther Deschner          2009.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 3 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24
  25 #include "includes.h"
  26 #include "lib/eventlog/eventlog.h"
  27 #include "registry.h"
  28 #include "registry/reg_backend_db.h"
  29 #include "registry/reg_objects.h"
  30 #include "../libcli/registry/util_reg.h"
  31
  32 extern int optind;
  33 extern char *optarg;
  34
  35 int opt_debug = 0;
  36
  37 static void usage( char *s )
  38 {
  39         printf( "\nUsage: %s [OPTION]\n\n", s );
  40         printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
  41         printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
  42         printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
  43         printf( "\nMiscellaneous options:\n" );
  44         printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
  45         printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
  46         printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
  47 }
  48
  49 static void display_eventlog_names( void )
  50 {
  51         const char **elogs;
  52         int i;
  53
  54         elogs = lp_eventlog_list(  );
  55         printf( "Active eventlog names:\n" );
  56         printf( "--------------------------------------\n" );
  57         if ( elogs ) {
  58                 for ( i = 0; elogs[i]; i++ ) {
  59                         printf( "\t%s\n", elogs[i] );
  60                 }
  61         }
  62         else
  63                 printf( "\t<None specified>\n");
  64 }
  65
  66 /*********************************************************************
  67  for an eventlog, add in a source name. If the eventlog doesn't
  68  exist (not in the list) do nothing.   If a source for the log
  69  already exists, change the information (remove, replace)
  70 *********************************************************************/
  71 static bool eventlog_add_source( const char *eventlog, const char *sourcename,
  72                                  const char *messagefile )
  73 {
  74         /* Find all of the eventlogs, add keys for each of them */
  75         /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
  76            need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
  77
  78         const char **elogs = lp_eventlog_list(  );
  79         const char **wrklist, **wp;
  80         char *evtlogpath = NULL;
  81         struct regsubkey_ctr *subkeys;
  82         struct regval_ctr *values;
  83         struct regval_blob *rval;
  84         int ii = 0;
  85         bool already_in;
  86         int i;
  87         int numsources = 0;
  88         TALLOC_CTX *ctx = talloc_tos();
  89         WERROR werr;
  90         DATA_BLOB blob;
  91
  92         if (!elogs) {
  93                 return False;
  94         }
  95
  96         for ( i = 0; elogs[i]; i++ ) {
  97                 if ( strequal( elogs[i], eventlog ) )
  98                         break;
  99         }
 100
 101         if ( !elogs[i] ) {
 102                 d_printf("Eventlog [%s] not found in list of valid event logs\n",
 103                          eventlog);
 104                 return false;   /* invalid named passed in */
 105         }
 106
 107         /* have to assume that the evenlog key itself exists at this point */
 108         /* add in a key of [sourcename] under the eventlog key */
 109
 110         /* todo add to Sources */
 111
 112         werr = regval_ctr_init(ctx, &values);
 113         if(!W_ERROR_IS_OK(werr)) {
 114                 d_printf("talloc() failure!\n");
 115                 return false;
 116         }
 117
 118         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
 119         if (!evtlogpath) {
 120                 TALLOC_FREE(values);
 121                 return false;
 122         }
 123
 124         regdb_fetch_values( evtlogpath, values );
 125
 126
 127         if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
 128                 d_printf("No Sources value for [%s]!\n", eventlog);
 129                 return False;
 130         }
 131         /* perhaps this adding a new string to a multi_sz should be a fn? */
 132         /* check to see if it's there already */
 133
 134         if ( regval_type(rval) != REG_MULTI_SZ ) {
 135                 d_printf("Wrong type for Sources, should be REG_MULTI_SZ\n");
 136                 return False;
 137         }
 138         /* convert to a 'regulah' chars to do some comparisons */
 139
 140         already_in = False;
 141         wrklist = NULL;
 142         dump_data(1, regval_data_p(rval), regval_size(rval));
 143
 144         blob = data_blob_const(regval_data_p(rval), regval_size(rval));
 145         if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) {
 146                 return false;
 147         }
 148
 149         for (ii=0; wrklist[ii]; ii++) {
 150                 numsources++;
 151         }
 152
 153         if (numsources > 0) {
 154                 /* see if it's in there already */
 155                 wp = wrklist;
 156
 157                 while (wp && *wp ) {
 158                         if ( strequal( *wp, sourcename ) ) {
 159                                 d_printf("Source name [%s] already in list for [%s] \n",
 160                                          sourcename, eventlog);
 161                                 already_in = True;
 162                                 break;
 163                         }
 164                         wp++;
 165                 }
 166         } else {
 167                 d_printf("Nothing in the sources list, this might be a problem\n");
 168         }
 169
 170         wp = wrklist;
 171
 172         if ( !already_in ) {
 173                 /* make a new list with an additional entry; copy values, add another */
 174                 wp = talloc_array(ctx, const char *, numsources + 2 );
 175
 176                 if ( !wp ) {
 177                         d_printf("talloc() failed \n");
 178                         return False;
 179                 }
 180                 memcpy( wp, wrklist, sizeof( char * ) * numsources );
 181                 *( wp + numsources ) = (const char * ) sourcename;
 182                 *( wp + numsources + 1 ) = NULL;
 183                 if (!push_reg_multi_sz(ctx, &blob, wp)) {
 184                         return false;
 185                 }
 186                 dump_data( 1, blob.data, blob.length);
 187                 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 188                                      blob.data, blob.length);
 189                 regdb_store_values( evtlogpath, values );
 190                 data_blob_free(&blob);
 191         } else {
 192                 d_printf("Source name [%s] found in existing list of sources\n",
 193                          sourcename);
 194         }
 195         TALLOC_FREE(values);
 196         TALLOC_FREE(wrklist);   /*  */
 197
 198         werr = regsubkey_ctr_init(ctx, &subkeys);
 199         if (!W_ERROR_IS_OK(werr)) {
 200                 d_printf("talloc() failure!\n");
 201                 return False;
 202         }
 203         TALLOC_FREE(evtlogpath);
 204         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
 205         if (!evtlogpath) {
 206                 TALLOC_FREE(subkeys);
 207                 return false;
 208         }
 209
 210         regdb_fetch_keys( evtlogpath, subkeys );
 211
 212         if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
 213                 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
 214                          sourcename, eventlog);
 215                 regsubkey_ctr_addkey( subkeys, sourcename );
 216                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
 217                         return False;
 218         }
 219         TALLOC_FREE(subkeys);
 220
 221         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 222
 223         /* now allocate room for the source's subkeys */
 224
 225         werr = regsubkey_ctr_init(ctx, &subkeys);
 226         if (!W_ERROR_IS_OK(werr)) {
 227                 d_printf("talloc() failure!\n");
 228                 return False;
 229         }
 230         TALLOC_FREE(evtlogpath);
 231         evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
 232                   KEY_EVENTLOG, eventlog, sourcename);
 233         if (!evtlogpath) {
 234                 TALLOC_FREE(subkeys);
 235                 return false;
 236         }
 237
 238         regdb_fetch_keys( evtlogpath, subkeys );
 239
 240         /* now add the values to the KEY_EVENTLOG/Application form key */
 241         werr = regval_ctr_init(ctx, &values);
 242         if (!W_ERROR_IS_OK(werr)) {
 243                 d_printf("talloc() failure!\n");
 244                 return False;
 245         }
 246         d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
 247                  messagefile, evtlogpath);
 248
 249         regdb_fetch_values( evtlogpath, values );
 250
 251         regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile);
 252         regdb_store_values( evtlogpath, values );
 253
 254         TALLOC_FREE(values);
 255
 256         return True;
 257 }
 258
 259 static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename )
 260 {
 261
 262         if ( argc < 3 ) {
 263                 printf( "need more arguments:\n" );
 264                 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
 265                 return -1;
 266         }
 267         /* must open the registry before we access it */
 268         if (!W_ERROR_IS_OK(regdb_init())) {
 269                 printf( "Can't open the registry.\n" );
 270                 return -1;
 271         }
 272
 273         if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) )
 274                 return -2;
 275         return 0;
 276 }
 277
 278 static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename )
 279 {
 280         FILE *f1;
 281         char *argfname;
 282         ELOG_TDB *etdb;
 283         NTSTATUS status;
 284
 285         /* fixed constants are bad bad bad  */
 286         char linein[1024];
 287         bool is_eor;
 288         struct eventlog_Record_tdb ee;
 289         uint32_t record_number = 0;
 290         TALLOC_CTX *mem_ctx = talloc_tos();
 291
 292         f1 = stdin;
 293         if ( !f1 ) {
 294                 printf( "Can't open STDIN\n" );
 295                 return -1;
 296         }
 297
 298         if ( debugflag ) {
 299                 printf( "Starting write for eventlog [%s]\n", argv[0] );
 300                 display_eventlog_names(  );
 301         }
 302
 303         argfname = argv[0];
 304
 305         if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) {
 306                 printf( "can't open the eventlog TDB (%s)\n", argfname );
 307                 return -1;
 308         }
 309
 310         ZERO_STRUCT( ee );      /* MUST initialize between records */
 311
 312         while ( !feof( f1 ) ) {
 313                 if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) {
 314                         break;
 315                 }
 316                 if ((strlen(linein) > 0)
 317                     && (linein[strlen(linein)-1] == '\n')) {
 318                         linein[strlen(linein)-1] = 0;
 319                 }
 320
 321                 if ( debugflag )
 322                         printf( "Read line [%s]\n", linein );
 323
 324                 is_eor = False;
 325
 326
 327                 parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor );
 328                 /* should we do something with the return code? */
 329
 330                 if ( is_eor ) {
 331                         fixup_eventlog_record_tdb( &ee );
 332
 333                         if ( opt_debug )
 334                                 printf( "record number [%d], tg [%d] , tw [%d]\n",
 335                                         ee.record_number, (int)ee.time_generated, (int)ee.time_written );
 336
 337                         if ( ee.time_generated != 0 ) {
 338
 339                                 /* printf("Writing to the event log\n"); */
 340
 341                                 status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb),
 342                                                                 &ee, &record_number );
 343                                 if ( !NT_STATUS_IS_OK(status) ) {
 344                                         printf( "Can't write to the event log: %s\n",
 345                                                 nt_errstr(status) );
 346                                 } else {
 347                                         if ( opt_debug )
 348                                                 printf( "Wrote record %d\n",
 349                                                         record_number );
 350                                 }
 351                         } else {
 352                                 if ( opt_debug )
 353                                         printf( "<null record>\n" );
 354                         }
 355                         ZERO_STRUCT( ee );      /* MUST initialize between records */
 356                 }
 357         }
 358
 359         elog_close_tdb( etdb , False );
 360
 361         return 0;
 362 }
 363
 364 static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename)
 365 {
 366         ELOG_TDB *etdb;
 367         TALLOC_CTX *mem_ctx = talloc_tos();
 368         uint32_t count = 1;
 369
 370         if (argc > 2) {
 371                 return -1;
 372         }
 373
 374         if (argc > 1) {
 375                 count = atoi(argv[1]);
 376         }
 377
 378         etdb = elog_open_tdb(argv[0], false, true);
 379         if (!etdb) {
 380                 printf("can't open the eventlog TDB (%s)\n", argv[0]);
 381                 return -1;
 382         }
 383
 384         while (1) {
 385
 386                 struct eventlog_Record_tdb *r;
 387                 char *s;
 388
 389                 r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count);
 390                 if (!r) {
 391                         break;
 392                 }
 393
 394                 printf("displaying record: %d\n", count);
 395
 396                 s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r);
 397                 if (s) {
 398                         printf("%s\n", s);
 399                         talloc_free(s);
 400                 }
 401                 count++;
 402         }
 403
 404         elog_close_tdb(etdb, false);
 405
 406         return 0;
 407 }
 408
 409 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
 410
 411 int main( int argc, char *argv[] )
 412 {
 413         int opt, rc;
 414         char *exename;
 415         char *configfile = NULL;
 416         TALLOC_CTX *frame = talloc_stackframe();
 417
 418
 419         fstring opname;
 420
 421         load_case_tables();
 422
 423         opt_debug = 0;          /* todo set this from getopts */
 424
 425         exename = argv[0];
 426
 427         /* default */
 428
 429         fstrcpy( opname, "write" );     /* the default */
 430
 431 #if 0                           /* TESTING CODE */
 432         eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
 433 #endif
 434         while ( ( opt = getopt( argc, argv, "dho:s:" ) ) != EOF ) {
 435                 switch ( opt ) {
 436
 437                 case 'o':
 438                         fstrcpy( opname, optarg );
 439                         break;
 440
 441                 case 'h':
 442                         usage( exename );
 443                         display_eventlog_names(  );
 444                         exit( 0 );
 445                         break;
 446
 447                 case 'd':
 448                         opt_debug = 1;
 449                         break;
 450                 case 's':
 451                         configfile = talloc_strdup(frame, optarg);
 452                         break;
 453
 454                 }
 455         }
 456
 457         argc -= optind;
 458         argv += optind;
 459
 460         if ( argc < 1 ) {
 461                 printf( "\nNot enough arguments!\n" );
 462                 usage( exename );
 463                 exit( 1 );
 464         }
 465
 466         if ( configfile == NULL ) {
 467                 lp_load(get_dyn_CONFIGFILE(), True, False, False, True);
 468         } else if (!lp_load(configfile, True, False, False, True)) {
 469                 printf("Unable to parse configfile '%s'\n",configfile);
 470                 exit( 1 );
 471         }
 472
 473         /*  note that the separate command types should call usage if they need to... */
 474         while ( 1 ) {
 475                 if ( !strcasecmp_m( opname, "addsource" ) ) {
 476                         rc = DoAddSourceCommand( argc, argv, opt_debug,
 477                                                  exename );
 478                         break;
 479                 }
 480                 if ( !strcasecmp_m( opname, "write" ) ) {
 481                         rc = DoWriteCommand( argc, argv, opt_debug, exename );
 482                         break;
 483                 }
 484                 if ( !strcasecmp_m( opname, "dump" ) ) {
 485                         rc = DoDumpCommand( argc, argv, opt_debug, exename );
 486                         break;
 487                 }
 488                 printf( "unknown command [%s]\n", opname );
 489                 usage( exename );
 490                 exit( 1 );
 491                 break;
 492         }
 493         TALLOC_FREE(frame);
 494         return rc;
 495 }