3 * Samba Unix/Linux SMB client utility
4 * Write Eventlog records to a tdb, perform other eventlog related functions
7 * Copyright (C) Brian Moran 2005.
8 * Copyright (C) Guenther Deschner 2009.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 #include "lib/eventlog/eventlog.h"
28 #include "registry/reg_api.h"
29 #include "registry/reg_init_basic.h"
30 #include "registry/reg_util_token.h"
31 #include "../libcli/registry/util_reg.h"
38 static void usage( char *s
)
40 printf( "\nUsage: %s [OPTION]\n\n", s
);
41 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
42 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
43 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
44 printf( "\nMiscellaneous options:\n" );
45 printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
46 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
47 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
50 static void display_eventlog_names( void )
55 elogs
= lp_eventlog_list( );
56 printf( "Active eventlog names:\n" );
57 printf( "--------------------------------------\n" );
59 for ( i
= 0; elogs
[i
]; i
++ ) {
60 printf( "\t%s\n", elogs
[i
] );
64 printf( "\t<None specified>\n");
67 /*********************************************************************
68 for an eventlog, add in a source name. If the eventlog doesn't
69 exist (not in the list) do nothing. If a source for the log
70 already exists, change the information (remove, replace)
71 *********************************************************************/
72 static bool eventlog_add_source( const char *eventlog
, const char *sourcename
,
73 const char *messagefile
)
75 /* Find all of the eventlogs, add keys for each of them */
76 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
77 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
79 const char **elogs
= lp_eventlog_list( );
80 const char **wrklist
, **wp
;
81 char *evtlogpath
= NULL
;
86 TALLOC_CTX
*ctx
= talloc_stackframe();
88 struct registry_key
*key_hive
, *key_eventlog
, *key_source
;
89 struct security_token
*token
= NULL
;
90 const char *hive_name
, *relpath
;
91 enum winreg_CreateAction action
;
92 struct registry_value
*value
;
93 static const uint32 ACCESS
= REG_KEY_READ
| REG_KEY_WRITE
;
97 d_printf("No Eventlogs configured\n");
101 for ( i
= 0; elogs
[i
]; i
++ ) {
102 if ( strequal( elogs
[i
], eventlog
) )
107 d_printf("Eventlog [%s] not found in list of valid event logs\n",
112 /* have to assume that the evenlog key itself exists at this point */
113 /* add in a key of [sourcename] under the eventlog key */
115 /* todo add to Sources */
117 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
119 d_printf("Out of memory\n");
123 relpath
= strchr(evtlogpath
, '\\');
124 hive_name
= talloc_strndup(ctx
, evtlogpath
, relpath
- evtlogpath
);
126 d_printf("Out of memory\n");
131 werr
= ntstatus_to_werror(registry_create_admin_token(ctx
, &token
));
132 if (!W_ERROR_IS_OK(werr
)) {
133 d_printf("Failed to create admin token: %s\n", win_errstr(werr
));
137 werr
= reg_openhive(ctx
, hive_name
, ACCESS
, token
, &key_hive
);
138 if (!W_ERROR_IS_OK(werr
)) {
139 d_printf("Failed to open hive [%s]: %s\n", hive_name
, win_errstr(werr
));
143 werr
= reg_openkey(ctx
, key_hive
, relpath
, ACCESS
, &key_eventlog
);
144 if (!W_ERROR_IS_OK(werr
)) {
145 d_printf("Failed to open key [%s]: %s\n", evtlogpath
, win_errstr(werr
));
149 werr
= reg_queryvalue(ctx
, key_eventlog
, "Sources", &value
);
150 if (!W_ERROR_IS_OK(werr
)) {
151 d_printf("Failed to get value \"Sources\" for [%s]: %s\n", evtlogpath
, win_errstr(werr
));
154 /* perhaps this adding a new string to a multi_sz should be a fn? */
155 /* check to see if it's there already */
157 if ( value
->type
!= REG_MULTI_SZ
) {
158 d_printf("Wrong type for \"Sources\", should be REG_MULTI_SZ\n");
161 /* convert to a 'regulah' chars to do some comparisons */
165 dump_data(1, value
->data
.data
, value
->data
.length
);
167 if (!pull_reg_multi_sz(ctx
, &value
->data
, &wrklist
)) {
168 d_printf("Failed to pull REG_MULTI_SZ from \"Sources\"\n");
172 for (ii
=0; wrklist
[ii
]; ii
++) {
176 if (numsources
> 0) {
177 /* see if it's in there already */
181 if ( strequal( *wp
, sourcename
) ) {
182 d_printf("Source name [%s] already in list for [%s] \n",
183 sourcename
, eventlog
);
190 d_printf("Nothing in the sources list, this might be a problem\n");
194 /* make a new list with an additional entry; copy values, add another */
195 wp
= talloc_realloc(ctx
, wrklist
, const char *, numsources
+ 2 );
197 d_printf("Out of memory\n");
201 wp
[numsources
] = sourcename
;
202 wp
[numsources
+1] = NULL
;
203 if (!push_reg_multi_sz(ctx
, &value
->data
, wp
)) {
204 d_printf("Failed to push Sources\n");
207 dump_data( 1, value
->data
.data
, value
->data
.length
);
208 werr
= reg_setvalue(key_eventlog
, "Sources", value
);
209 if (!W_ERROR_IS_OK(werr
)) {
210 d_printf("Failed to set value Sources: %s\n", win_errstr(werr
));
214 d_printf("Source name [%s] found in existing list of sources\n",
218 werr
= reg_createkey(ctx
, key_eventlog
, sourcename
, ACCESS
, &key_source
, &action
);
219 if (!W_ERROR_IS_OK(werr
)) {
220 d_printf("Failed to create subkey \"%s\" of \"%s\": %s\n", sourcename
, evtlogpath
, win_errstr(werr
));
224 if (action
== REG_CREATED_NEW_KEY
) {
225 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
226 sourcename
, eventlog
);
229 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
231 /* now add the values to the KEY_EVENTLOG/Application form key */
232 d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
233 messagefile
, evtlogpath
);
235 if (!push_reg_sz(ctx
, &value
->data
, messagefile
)) {
236 d_printf("Failed to push \"EventMessageFile\"\n");
239 value
->type
= REG_SZ
;
241 werr
= reg_setvalue(key_source
, "EventMessageFile", value
);
242 if (!W_ERROR_IS_OK(werr
)) {
243 d_printf("Failed to set value \"EventMessageFile\": %s\n", win_errstr(werr
));
252 static int DoAddSourceCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
257 printf( "need more arguments:\n" );
258 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
262 /* must open the registry before we access it */
263 werr
= registry_init_common();
264 if (!W_ERROR_IS_OK(werr
)) {
265 printf("Can't open the registry: %s.\n", win_errstr(werr
));
269 if ( !eventlog_add_source( argv
[0], argv
[1], argv
[2] ) )
274 static int DoWriteCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
281 /* fixed constants are bad bad bad */
284 struct eventlog_Record_tdb ee
;
285 uint32_t record_number
= 0;
286 TALLOC_CTX
*mem_ctx
= talloc_tos();
290 printf( "Can't open STDIN\n" );
295 printf( "Starting write for eventlog [%s]\n", argv
[0] );
296 display_eventlog_names( );
301 if ( !( etdb
= elog_open_tdb( argfname
, False
, False
) ) ) {
302 printf( "can't open the eventlog TDB (%s)\n", argfname
);
306 ZERO_STRUCT( ee
); /* MUST initialize between records */
308 while ( !feof( f1
) ) {
309 if (fgets( linein
, sizeof( linein
) - 1, f1
) == NULL
) {
312 if ((strlen(linein
) > 0)
313 && (linein
[strlen(linein
)-1] == '\n')) {
314 linein
[strlen(linein
)-1] = 0;
318 printf( "Read line [%s]\n", linein
);
323 parse_logentry( mem_ctx
, ( char * ) &linein
, &ee
, &is_eor
);
324 /* should we do something with the return code? */
327 fixup_eventlog_record_tdb( &ee
);
330 printf( "record number [%d], tg [%d] , tw [%d]\n",
331 ee
.record_number
, (int)ee
.time_generated
, (int)ee
.time_written
);
333 if ( ee
.time_generated
!= 0 ) {
335 /* printf("Writing to the event log\n"); */
337 status
= evlog_push_record_tdb( mem_ctx
, ELOG_TDB_CTX(etdb
),
338 &ee
, &record_number
);
339 if ( !NT_STATUS_IS_OK(status
) ) {
340 printf( "Can't write to the event log: %s\n",
344 printf( "Wrote record %d\n",
349 printf( "<null record>\n" );
351 ZERO_STRUCT( ee
); /* MUST initialize between records */
355 elog_close_tdb( etdb
, False
);
360 static int DoDumpCommand(int argc
, char **argv
, bool debugflag
, char *exename
)
363 TALLOC_CTX
*mem_ctx
= talloc_tos();
371 count
= atoi(argv
[1]);
374 etdb
= elog_open_tdb(argv
[0], false, true);
376 printf("can't open the eventlog TDB (%s)\n", argv
[0]);
382 struct eventlog_Record_tdb
*r
;
385 r
= evlog_pull_record_tdb(mem_ctx
, etdb
->tdb
, count
);
390 printf("displaying record: %d\n", count
);
392 s
= NDR_PRINT_STRUCT_STRING(mem_ctx
, eventlog_Record_tdb
, r
);
400 elog_close_tdb(etdb
, false);
405 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
407 int main( int argc
, char *argv
[] )
411 char *configfile
= NULL
;
412 TALLOC_CTX
*frame
= talloc_stackframe();
419 opt_debug
= 0; /* todo set this from getopts */
425 fstrcpy( opname
, "write" ); /* the default */
427 #if 0 /* TESTING CODE */
428 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
430 while ( ( opt
= getopt( argc
, argv
, "dho:s:" ) ) != EOF
) {
434 fstrcpy( opname
, optarg
);
439 display_eventlog_names( );
447 configfile
= talloc_strdup(frame
, optarg
);
457 printf( "\nNot enough arguments!\n" );
462 if ( configfile
== NULL
) {
463 lp_load_global(get_dyn_CONFIGFILE());
464 } else if (!lp_load_global(configfile
)) {
465 printf("Unable to parse configfile '%s'\n",configfile
);
469 /* note that the separate command types should call usage if they need to... */
471 if ( !strcasecmp_m( opname
, "addsource" ) ) {
472 rc
= DoAddSourceCommand( argc
, argv
, opt_debug
,
476 if ( !strcasecmp_m( opname
, "write" ) ) {
477 rc
= DoWriteCommand( argc
, argv
, opt_debug
, exename
);
480 if ( !strcasecmp_m( opname
, "dump" ) ) {
481 rc
= DoDumpCommand( argc
, argv
, opt_debug
, exename
);
484 printf( "unknown command [%s]\n", opname
);