docs-xml/manpages-3/eventlogadm.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="eventlogadm.8">
   4
   5 <refmeta>
   6         <refentrytitle>eventlogadm</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">3.3</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>eventlogadm</refname>
  16         <refpurpose>push records into the Samba event log store</refpurpose>
  17 </refnamediv>
  18
  19 <refsynopsisdiv>
  20         <cmdsynopsis>
  21
  22                 <command>eventlogadm</command>
  23                 <arg><option>-d</option></arg>
  24                 <arg><option>-h</option></arg>
  25                 <arg choice="plain"><option>-o</option>
  26                 <literal>addsource</literal>
  27                 <replaceable>EVENTLOG</replaceable>
  28                 <replaceable>SOURCENAME</replaceable>
  29                 <replaceable>MSGFILE</replaceable>
  30                 </arg>
  31
  32         </cmdsynopsis>
  33         <cmdsynopsis>
  34                 <command>eventlogadm</command>
  35                 <arg><option>-d</option></arg>
  36                 <arg><option>-h</option></arg>
  37                 <arg choice="plain"><option>-o</option>
  38                 <literal>write</literal>
  39                 <replaceable>EVENTLOG</replaceable>
  40                 </arg>
  41
  42         </cmdsynopsis>
  43 </refsynopsisdiv>
  44
  45 <refsect1>
  46         <title>DESCRIPTION</title>
  47
  48         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  49         <manvolnum>1</manvolnum></citerefentry> suite.</para>
  50
  51         <para><command>eventlogadm</command> is a filter that accepts
  52         formatted event log records on standard input and writes them
  53         to the Samba event log store. Windows client can then manipulate
  54         these record using the usual administration tools.</para>
  55
  56 </refsect1>
  57
  58
  59 <refsect1>
  60         <title>OPTIONS</title>
  61
  62         <variablelist>
  63
  64                 <varlistentry>
  65                 <term><option>-d</option></term>
  66                 <listitem><para>
  67                 The <command>-d</command> option causes <command>eventlogadm</command> to emit debugging
  68                 information.
  69                 </para></listitem>
  70                 </varlistentry>
  71
  72                 <varlistentry>
  73                 <term>
  74                 <option>-o</option>
  75                 <literal>addsource</literal>
  76                 <replaceable>EVENTLOG</replaceable>
  77                 <replaceable>SOURCENAME</replaceable>
  78                 <replaceable>MSGFILE</replaceable>
  79                 </term>
  80                 <listitem><para>
  81                 The <command>-o addsource</command> option creates a
  82                 new event log source.
  83                 </para> </listitem>
  84                 </varlistentry>
  85
  86                 <varlistentry>
  87                 <term>
  88                 <option>-o</option>
  89                 <literal>write</literal>
  90                 <replaceable>EVENTLOG</replaceable>
  91                 </term>
  92                 <listitem><para>
  93                 The <command>-o write</command> reads event log
  94                 records from standard input and writes them to the Samba
  95                 event log store named by EVENTLOG.
  96                 </para> </listitem>
  97                 </varlistentry>
  98
  99                 <varlistentry>
 100                 <term><option>-h</option></term>
 101                 <listitem><para>
 102                 Print usage information.
 103                 </para></listitem>
 104                 </varlistentry>
 105
 106         </variablelist>
 107 </refsect1>
 108
 109
 110 <refsect1>
 111         <title>EVENTLOG RECORD FORMAT</title>
 112
 113         <para>For the write operation, <command>eventlogadm</command>
 114         expects to be able to read structured records from standard
 115         input. These records are a sequence of lines, with the record key
 116         and data separated by a colon character. Records are separated
 117         by at least one or more blank line.</para>
 118
 119         <para>The event log record field are:</para>
 120         <itemizedlist>
 121
 122                 <listitem><para>
 123                 <command>LEN</command> - This field should be 0, since <command>eventlogadm</command> will calculate this value.
 124                 </para></listitem>
 125
 126                 <listitem><para>
 127                 <command>RS1</command> - This must be the value 1699505740.
 128                 </para></listitem>
 129
 130                 <listitem><para>
 131                 <command>RCN</command> -  This field should be 0.
 132                 </para></listitem>
 133
 134                 <listitem><para>
 135                 <command>TMG</command> - The time the eventlog record
 136                 was generated; format is the number of seconds since
 137                 00:00:00 January 1, 1970, UTC.
 138                 </para></listitem>
 139
 140                 <listitem><para>
 141                 <command>TMW</command> - The time the eventlog record was
 142                 written; format is the number of seconds since 00:00:00
 143                 January 1, 1970, UTC.
 144                 </para></listitem>
 145
 146                 <listitem><para>
 147                 <command>EID</command> - The eventlog ID.
 148                 </para></listitem>
 149
 150                 <listitem><para>
 151                 <command>ETP</command> - The event type -- one of
 152                 &quot;INFO&quot;,
 153                 &quot;ERROR&quot;, &quot;WARNING&quot;, &quot;AUDIT
 154                 SUCCESS&quot; or &quot;AUDIT FAILURE&quot;.
 155                 </para></listitem>
 156
 157                 <listitem><para>
 158                 <command>ECT</command> - The event category; this depends
 159                 on the message file. It is primarily used as a means of
 160                 filtering in the eventlog viewer.
 161                 </para></listitem>
 162
 163                 <listitem><para>
 164                 <command>RS2</command> - This field should be 0.
 165                 </para></listitem>
 166
 167                 <listitem><para>
 168                 <command>CRN</command> - This field should be 0.
 169                 </para></listitem>
 170
 171                 <listitem><para>
 172                 <command>USL</command> - This field should be 0.
 173                 </para></listitem>
 174
 175                 <listitem><para>
 176                 <command>SRC</command> - This field contains the source
 177                 name associated with the event log. If a message file is
 178                 used with an event log, there will be a registry entry
 179                 for associating this source name with a message file DLL.
 180                 </para></listitem>
 181
 182                 <listitem><para>
 183                 <command>SRN</command> - The name of the machine on
 184                 which the eventlog was generated. This is typically the
 185                 host name.
 186                 </para></listitem>
 187
 188                 <listitem><para>
 189                 <command>STR</command> - The text associated with the
 190                 eventlog. There may be more than one string in a record.
 191                 </para></listitem>
 192
 193                 <listitem><para>
 194                 <command>DAT</command> - This field should be left unset.
 195                 </para></listitem>
 196
 197         </itemizedlist>
 198
 199 </refsect1>
 200
 201 <refsect1>
 202         <title>EXAMPLES</title>
 203         <para>An example of the record format accepted by <command>eventlogadm</command>:</para>
 204
 205         <programlisting>
 206         LEN: 0
 207         RS1: 1699505740
 208         RCN: 0
 209         TMG: 1128631322
 210         TMW: 1128631322
 211         EID: 1000
 212         ETP: INFO
 213         ECT: 0
 214         RS2: 0
 215         CRN: 0
 216         USL: 0
 217         SRC: cron
 218         SRN: dmlinux
 219         STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
 220         DAT:
 221         </programlisting>
 222
 223         <para>Set up an eventlog source, specifying a message file DLL:</para>
 224         <programlisting>
 225         eventlogadm -o addsource Application MyApplication | \\
 226                 %SystemRoot%/system32/MyApplication.dll
 227         </programlisting>
 228
 229         <para>Filter messages from the system log into an event log:</para>
 230         <programlisting>
 231         tail -f /var/log/messages | \\
 232                 my_program_to_parse_into_eventlog_records | \\
 233                 eventlogadm SystemLogEvents
 234         </programlisting>
 235
 236 </refsect1>
 237
 238 <refsect1>
 239         <title>VERSION</title>
 240         <para>This man page is correct for version 3.0.25 of the Samba suite.</para>
 241 </refsect1>
 242
 243 <refsect1>
 244         <title>AUTHOR</title>
 245
 246         <para> The original Samba software and related utilities were
 247         created by Andrew Tridgell.  Samba is now developed by the
 248         Samba Team as an Open Source project similar to the way the
 249         Linux kernel is developed.</para>
 250 </refsect1>
 251
 252 </refentry>