3 * Samba Unix/Linux SMB client utility
4 * Write Eventlog records to a tdb, perform other eventlog related functions
7 * Copyright (C) Brian Moran 2005.
8 * Copyright (C) Guenther Deschner 2009.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 #include "lib/eventlog/eventlog.h"
28 #include "registry/reg_backend_db.h"
31 #define DBGC_CLASS DBGC_UTIL_EVENTLOG
39 static void usage( char *s
)
41 printf( "\nUsage: %s [OPTION]\n\n", s
);
42 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
43 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
44 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
45 printf( "\nMiscellaneous options:\n" );
46 printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
47 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
48 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
51 static void display_eventlog_names( void )
56 elogs
= lp_eventlog_list( );
57 printf( "Active eventlog names:\n" );
58 printf( "--------------------------------------\n" );
60 for ( i
= 0; elogs
[i
]; i
++ ) {
61 printf( "\t%s\n", elogs
[i
] );
65 printf( "\t<None specified>\n");
68 static int DoAddSourceCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
72 printf( "need more arguments:\n" );
73 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
76 /* must open the registry before we access it */
77 if (!W_ERROR_IS_OK(regdb_init())) {
78 printf( "Can't open the registry.\n" );
82 if ( !eventlog_add_source( argv
[0], argv
[1], argv
[2] ) )
87 static int DoWriteCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
94 /* fixed constants are bad bad bad */
97 struct eventlog_Record_tdb ee
;
98 uint32_t record_number
= 0;
99 TALLOC_CTX
*mem_ctx
= talloc_tos();
103 printf( "Can't open STDIN\n" );
108 printf( "Starting write for eventlog [%s]\n", argv
[0] );
109 display_eventlog_names( );
114 if ( !( etdb
= elog_open_tdb( argfname
, False
, False
) ) ) {
115 printf( "can't open the eventlog TDB (%s)\n", argfname
);
119 ZERO_STRUCT( ee
); /* MUST initialize between records */
121 while ( !feof( f1
) ) {
122 if (fgets( linein
, sizeof( linein
) - 1, f1
) == NULL
) {
125 if ((strlen(linein
) > 0)
126 && (linein
[strlen(linein
)-1] == '\n')) {
127 linein
[strlen(linein
)-1] = 0;
131 printf( "Read line [%s]\n", linein
);
136 parse_logentry( mem_ctx
, ( char * ) &linein
, &ee
, &is_eor
);
137 /* should we do something with the return code? */
140 fixup_eventlog_record_tdb( &ee
);
143 printf( "record number [%d], tg [%d] , tw [%d]\n",
144 ee
.record_number
, (int)ee
.time_generated
, (int)ee
.time_written
);
146 if ( ee
.time_generated
!= 0 ) {
148 /* printf("Writing to the event log\n"); */
150 status
= evlog_push_record_tdb( mem_ctx
, ELOG_TDB_CTX(etdb
),
151 &ee
, &record_number
);
152 if ( !NT_STATUS_IS_OK(status
) ) {
153 printf( "Can't write to the event log: %s\n",
157 printf( "Wrote record %d\n",
162 printf( "<null record>\n" );
164 ZERO_STRUCT( ee
); /* MUST initialize between records */
168 elog_close_tdb( etdb
, False
);
173 static int DoDumpCommand(int argc
, char **argv
, bool debugflag
, char *exename
)
176 TALLOC_CTX
*mem_ctx
= talloc_tos();
177 const char *tdb_filename
;
184 tdb_filename
= argv
[0];
187 count
= atoi(argv
[1]);
190 etdb
= elog_open_tdb(argv
[0], false, true);
192 printf("can't open the eventlog TDB (%s)\n", argv
[0]);
198 struct eventlog_Record_tdb
*r
;
201 r
= evlog_pull_record_tdb(mem_ctx
, etdb
->tdb
, count
);
206 printf("displaying record: %d\n", count
);
208 s
= NDR_PRINT_STRUCT_STRING(mem_ctx
, eventlog_Record_tdb
, r
);
216 elog_close_tdb(etdb
, false);
221 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
223 int main( int argc
, char *argv
[] )
227 char *configfile
= NULL
;
228 TALLOC_CTX
*frame
= talloc_stackframe();
235 opt_debug
= 0; /* todo set this from getopts */
241 fstrcpy( opname
, "write" ); /* the default */
243 #if 0 /* TESTING CODE */
244 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
246 while ( ( opt
= getopt( argc
, argv
, "dho:s:" ) ) != EOF
) {
250 fstrcpy( opname
, optarg
);
255 display_eventlog_names( );
263 configfile
= talloc_strdup(frame
, optarg
);
273 printf( "\nNot enough arguments!\n" );
278 if ( configfile
== NULL
) {
279 lp_load(get_dyn_CONFIGFILE(), True
, False
, False
, True
);
280 } else if (!lp_load(configfile
, True
, False
, False
, True
)) {
281 printf("Unable to parse configfile '%s'\n",configfile
);
285 /* note that the separate command types should call usage if they need to... */
287 if ( !StrCaseCmp( opname
, "addsource" ) ) {
288 rc
= DoAddSourceCommand( argc
, argv
, opt_debug
,
292 if ( !StrCaseCmp( opname
, "write" ) ) {
293 rc
= DoWriteCommand( argc
, argv
, opt_debug
, exename
);
296 if ( !StrCaseCmp( opname
, "dump" ) ) {
297 rc
= DoDumpCommand( argc
, argv
, opt_debug
, exename
);
300 printf( "unknown command [%s]\n", opname
);