source3/utils/eventlogadm.c

   1
   2 /*
   3  * Samba Unix/Linux SMB client utility
   4  * Write Eventlog records to a tdb, perform other eventlog related functions
   5  *
   6  *
   7  * Copyright (C) Brian Moran                2005.
   8  * Copyright (C) Guenther Deschner          2009.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 3 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24
  25 #include "includes.h"
  26 #include "lib/eventlog/eventlog.h"
  27 #include "registry.h"
  28 #include "registry/reg_backend_db.h"
  29 #include "registry/reg_objects.h"
  30
  31 extern int optind;
  32 extern char *optarg;
  33
  34 int opt_debug = 0;
  35
  36 static void usage( char *s )
  37 {
  38         printf( "\nUsage: %s [OPTION]\n\n", s );
  39         printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
  40         printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
  41         printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
  42         printf( "\nMiscellaneous options:\n" );
  43         printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
  44         printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
  45         printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
  46 }
  47
  48 static void display_eventlog_names( void )
  49 {
  50         const char **elogs;
  51         int i;
  52
  53         elogs = lp_eventlog_list(  );
  54         printf( "Active eventlog names:\n" );
  55         printf( "--------------------------------------\n" );
  56         if ( elogs ) {
  57                 for ( i = 0; elogs[i]; i++ ) {
  58                         printf( "\t%s\n", elogs[i] );
  59                 }
  60         }
  61         else
  62                 printf( "\t<None specified>\n");
  63 }
  64
  65 /*********************************************************************
  66  for an eventlog, add in a source name. If the eventlog doesn't
  67  exist (not in the list) do nothing.   If a source for the log
  68  already exists, change the information (remove, replace)
  69 *********************************************************************/
  70 static bool eventlog_add_source( const char *eventlog, const char *sourcename,
  71                                  const char *messagefile )
  72 {
  73         /* Find all of the eventlogs, add keys for each of them */
  74         /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
  75            need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
  76
  77         const char **elogs = lp_eventlog_list(  );
  78         const char **wrklist, **wp;
  79         char *evtlogpath = NULL;
  80         struct regsubkey_ctr *subkeys;
  81         struct regval_ctr *values;
  82         struct regval_blob *rval;
  83         int ii = 0;
  84         bool already_in;
  85         int i;
  86         int numsources = 0;
  87         TALLOC_CTX *ctx = talloc_tos();
  88         WERROR werr;
  89         DATA_BLOB blob;
  90
  91         if (!elogs) {
  92                 return False;
  93         }
  94
  95         for ( i = 0; elogs[i]; i++ ) {
  96                 if ( strequal( elogs[i], eventlog ) )
  97                         break;
  98         }
  99
 100         if ( !elogs[i] ) {
 101                 d_printf("Eventlog [%s] not found in list of valid event logs\n",
 102                          eventlog);
 103                 return false;   /* invalid named passed in */
 104         }
 105
 106         /* have to assume that the evenlog key itself exists at this point */
 107         /* add in a key of [sourcename] under the eventlog key */
 108
 109         /* todo add to Sources */
 110
 111         werr = regval_ctr_init(ctx, &values);
 112         if(!W_ERROR_IS_OK(werr)) {
 113                 d_printf("talloc() failure!\n");
 114                 return false;
 115         }
 116
 117         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
 118         if (!evtlogpath) {
 119                 TALLOC_FREE(values);
 120                 return false;
 121         }
 122
 123         regdb_fetch_values( evtlogpath, values );
 124
 125
 126         if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
 127                 d_printf("No Sources value for [%s]!\n", eventlog);
 128                 return False;
 129         }
 130         /* perhaps this adding a new string to a multi_sz should be a fn? */
 131         /* check to see if it's there already */
 132
 133         if ( regval_type(rval) != REG_MULTI_SZ ) {
 134                 d_printf("Wrong type for Sources, should be REG_MULTI_SZ\n");
 135                 return False;
 136         }
 137         /* convert to a 'regulah' chars to do some comparisons */
 138
 139         already_in = False;
 140         wrklist = NULL;
 141         dump_data(1, regval_data_p(rval), regval_size(rval));
 142
 143         blob = data_blob_const(regval_data_p(rval), regval_size(rval));
 144         if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) {
 145                 return false;
 146         }
 147
 148         for (ii=0; wrklist[ii]; ii++) {
 149                 numsources++;
 150         }
 151
 152         if (numsources > 0) {
 153                 /* see if it's in there already */
 154                 wp = wrklist;
 155
 156                 while (wp && *wp ) {
 157                         if ( strequal( *wp, sourcename ) ) {
 158                                 d_printf("Source name [%s] already in list for [%s] \n",
 159                                          sourcename, eventlog);
 160                                 already_in = True;
 161                                 break;
 162                         }
 163                         wp++;
 164                 }
 165         } else {
 166                 d_printf("Nothing in the sources list, this might be a problem\n");
 167         }
 168
 169         wp = wrklist;
 170
 171         if ( !already_in ) {
 172                 /* make a new list with an additional entry; copy values, add another */
 173                 wp = TALLOC_ARRAY(ctx, const char *, numsources + 2 );
 174
 175                 if ( !wp ) {
 176                         d_printf("talloc() failed \n");
 177                         return False;
 178                 }
 179                 memcpy( wp, wrklist, sizeof( char * ) * numsources );
 180                 *( wp + numsources ) = ( char * ) sourcename;
 181                 *( wp + numsources + 1 ) = NULL;
 182                 if (!push_reg_multi_sz(ctx, &blob, wp)) {
 183                         return false;
 184                 }
 185                 dump_data( 1, blob.data, blob.length);
 186                 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 187                                      blob.data, blob.length);
 188                 regdb_store_values( evtlogpath, values );
 189                 data_blob_free(&blob);
 190         } else {
 191                 d_printf("Source name [%s] found in existing list of sources\n",
 192                          sourcename);
 193         }
 194         TALLOC_FREE(values);
 195         TALLOC_FREE(wrklist);   /*  */
 196
 197         werr = regsubkey_ctr_init(ctx, &subkeys);
 198         if (!W_ERROR_IS_OK(werr)) {
 199                 d_printf("talloc() failure!\n");
 200                 return False;
 201         }
 202         TALLOC_FREE(evtlogpath);
 203         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
 204         if (!evtlogpath) {
 205                 TALLOC_FREE(subkeys);
 206                 return false;
 207         }
 208
 209         regdb_fetch_keys( evtlogpath, subkeys );
 210
 211         if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
 212                 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
 213                          sourcename, eventlog);
 214                 regsubkey_ctr_addkey( subkeys, sourcename );
 215                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
 216                         return False;
 217         }
 218         TALLOC_FREE(subkeys);
 219
 220         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 221
 222         /* now allocate room for the source's subkeys */
 223
 224         werr = regsubkey_ctr_init(ctx, &subkeys);
 225         if (!W_ERROR_IS_OK(werr)) {
 226                 d_printf("talloc() failure!\n");
 227                 return False;
 228         }
 229         TALLOC_FREE(evtlogpath);
 230         evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
 231                   KEY_EVENTLOG, eventlog, sourcename);
 232         if (!evtlogpath) {
 233                 TALLOC_FREE(subkeys);
 234                 return false;
 235         }
 236
 237         regdb_fetch_keys( evtlogpath, subkeys );
 238
 239         /* now add the values to the KEY_EVENTLOG/Application form key */
 240         werr = regval_ctr_init(ctx, &values);
 241         if (!W_ERROR_IS_OK(werr)) {
 242                 d_printf("talloc() failure!\n");
 243                 return False;
 244         }
 245         d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
 246                  messagefile, evtlogpath);
 247
 248         regdb_fetch_values( evtlogpath, values );
 249
 250         regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile);
 251         regdb_store_values( evtlogpath, values );
 252
 253         TALLOC_FREE(values);
 254
 255         return True;
 256 }
 257
 258 static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename )
 259 {
 260
 261         if ( argc < 3 ) {
 262                 printf( "need more arguments:\n" );
 263                 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
 264                 return -1;
 265         }
 266         /* must open the registry before we access it */
 267         if (!W_ERROR_IS_OK(regdb_init())) {
 268                 printf( "Can't open the registry.\n" );
 269                 return -1;
 270         }
 271
 272         if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) )
 273                 return -2;
 274         return 0;
 275 }
 276
 277 static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename )
 278 {
 279         FILE *f1;
 280         char *argfname;
 281         ELOG_TDB *etdb;
 282         NTSTATUS status;
 283
 284         /* fixed constants are bad bad bad  */
 285         char linein[1024];
 286         bool is_eor;
 287         struct eventlog_Record_tdb ee;
 288         uint32_t record_number = 0;
 289         TALLOC_CTX *mem_ctx = talloc_tos();
 290
 291         f1 = stdin;
 292         if ( !f1 ) {
 293                 printf( "Can't open STDIN\n" );
 294                 return -1;
 295         }
 296
 297         if ( debugflag ) {
 298                 printf( "Starting write for eventlog [%s]\n", argv[0] );
 299                 display_eventlog_names(  );
 300         }
 301
 302         argfname = argv[0];
 303
 304         if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) {
 305                 printf( "can't open the eventlog TDB (%s)\n", argfname );
 306                 return -1;
 307         }
 308
 309         ZERO_STRUCT( ee );      /* MUST initialize between records */
 310
 311         while ( !feof( f1 ) ) {
 312                 if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) {
 313                         break;
 314                 }
 315                 if ((strlen(linein) > 0)
 316                     && (linein[strlen(linein)-1] == '\n')) {
 317                         linein[strlen(linein)-1] = 0;
 318                 }
 319
 320                 if ( debugflag )
 321                         printf( "Read line [%s]\n", linein );
 322
 323                 is_eor = False;
 324
 325
 326                 parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor );
 327                 /* should we do something with the return code? */
 328
 329                 if ( is_eor ) {
 330                         fixup_eventlog_record_tdb( &ee );
 331
 332                         if ( opt_debug )
 333                                 printf( "record number [%d], tg [%d] , tw [%d]\n",
 334                                         ee.record_number, (int)ee.time_generated, (int)ee.time_written );
 335
 336                         if ( ee.time_generated != 0 ) {
 337
 338                                 /* printf("Writing to the event log\n"); */
 339
 340                                 status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb),
 341                                                                 &ee, &record_number );
 342                                 if ( !NT_STATUS_IS_OK(status) ) {
 343                                         printf( "Can't write to the event log: %s\n",
 344                                                 nt_errstr(status) );
 345                                 } else {
 346                                         if ( opt_debug )
 347                                                 printf( "Wrote record %d\n",
 348                                                         record_number );
 349                                 }
 350                         } else {
 351                                 if ( opt_debug )
 352                                         printf( "<null record>\n" );
 353                         }
 354                         ZERO_STRUCT( ee );      /* MUST initialize between records */
 355                 }
 356         }
 357
 358         elog_close_tdb( etdb , False );
 359
 360         return 0;
 361 }
 362
 363 static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename)
 364 {
 365         ELOG_TDB *etdb;
 366         TALLOC_CTX *mem_ctx = talloc_tos();
 367         const char *tdb_filename;
 368         uint32_t count = 1;
 369
 370         if (argc > 2) {
 371                 return -1;
 372         }
 373
 374         tdb_filename = argv[0];
 375
 376         if (argc > 1) {
 377                 count = atoi(argv[1]);
 378         }
 379
 380         etdb = elog_open_tdb(argv[0], false, true);
 381         if (!etdb) {
 382                 printf("can't open the eventlog TDB (%s)\n", argv[0]);
 383                 return -1;
 384         }
 385
 386         while (1) {
 387
 388                 struct eventlog_Record_tdb *r;
 389                 char *s;
 390
 391                 r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count);
 392                 if (!r) {
 393                         break;
 394                 }
 395
 396                 printf("displaying record: %d\n", count);
 397
 398                 s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r);
 399                 if (s) {
 400                         printf("%s\n", s);
 401                         talloc_free(s);
 402                 }
 403                 count++;
 404         }
 405
 406         elog_close_tdb(etdb, false);
 407
 408         return 0;
 409 }
 410
 411 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
 412
 413 int main( int argc, char *argv[] )
 414 {
 415         int opt, rc;
 416         char *exename;
 417         char *configfile = NULL;
 418         TALLOC_CTX *frame = talloc_stackframe();
 419
 420
 421         fstring opname;
 422
 423         load_case_tables();
 424
 425         opt_debug = 0;          /* todo set this from getopts */
 426
 427         exename = argv[0];
 428
 429         /* default */
 430
 431         fstrcpy( opname, "write" );     /* the default */
 432
 433 #if 0                           /* TESTING CODE */
 434         eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
 435 #endif
 436         while ( ( opt = getopt( argc, argv, "dho:s:" ) ) != EOF ) {
 437                 switch ( opt ) {
 438
 439                 case 'o':
 440                         fstrcpy( opname, optarg );
 441                         break;
 442
 443                 case 'h':
 444                         usage( exename );
 445                         display_eventlog_names(  );
 446                         exit( 0 );
 447                         break;
 448
 449                 case 'd':
 450                         opt_debug = 1;
 451                         break;
 452                 case 's':
 453                         configfile = talloc_strdup(frame, optarg);
 454                         break;
 455
 456                 }
 457         }
 458
 459         argc -= optind;
 460         argv += optind;
 461
 462         if ( argc < 1 ) {
 463                 printf( "\nNot enough arguments!\n" );
 464                 usage( exename );
 465                 exit( 1 );
 466         }
 467
 468         if ( configfile == NULL ) {
 469                 lp_load(get_dyn_CONFIGFILE(), True, False, False, True);
 470         } else if (!lp_load(configfile, True, False, False, True)) {
 471                 printf("Unable to parse configfile '%s'\n",configfile);
 472                 exit( 1 );
 473         }
 474
 475         /*  note that the separate command types should call usage if they need to... */
 476         while ( 1 ) {
 477                 if ( !StrCaseCmp( opname, "addsource" ) ) {
 478                         rc = DoAddSourceCommand( argc, argv, opt_debug,
 479                                                  exename );
 480                         break;
 481                 }
 482                 if ( !StrCaseCmp( opname, "write" ) ) {
 483                         rc = DoWriteCommand( argc, argv, opt_debug, exename );
 484                         break;
 485                 }
 486                 if ( !StrCaseCmp( opname, "dump" ) ) {
 487                         rc = DoDumpCommand( argc, argv, opt_debug, exename );
 488                         break;
 489                 }
 490                 printf( "unknown command [%s]\n", opname );
 491                 usage( exename );
 492                 exit( 1 );
 493                 break;
 494         }
 495         TALLOC_FREE(frame);
 496         return rc;
 497 }