3 * Samba Unix/Linux SMB client utility
4 * Write Eventlog records to a tdb, perform other eventlog related functions
7 * Copyright (C) Brian Moran 2005.
8 * Copyright (C) Guenther Deschner 2009.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 #include "lib/eventlog/eventlog.h"
28 #include "registry/reg_backend_db.h"
29 #include "registry/reg_objects.h"
30 #include "../libcli/registry/util_reg.h"
37 static void usage( char *s
)
39 printf( "\nUsage: %s [OPTION]\n\n", s
);
40 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
41 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
42 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
43 printf( "\nMiscellaneous options:\n" );
44 printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
45 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
46 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
49 static void display_eventlog_names( void )
54 elogs
= lp_eventlog_list( );
55 printf( "Active eventlog names:\n" );
56 printf( "--------------------------------------\n" );
58 for ( i
= 0; elogs
[i
]; i
++ ) {
59 printf( "\t%s\n", elogs
[i
] );
63 printf( "\t<None specified>\n");
66 /*********************************************************************
67 for an eventlog, add in a source name. If the eventlog doesn't
68 exist (not in the list) do nothing. If a source for the log
69 already exists, change the information (remove, replace)
70 *********************************************************************/
71 static bool eventlog_add_source( const char *eventlog
, const char *sourcename
,
72 const char *messagefile
)
74 /* Find all of the eventlogs, add keys for each of them */
75 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
76 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
78 const char **elogs
= lp_eventlog_list( );
79 const char **wrklist
, **wp
;
80 char *evtlogpath
= NULL
;
81 struct regsubkey_ctr
*subkeys
;
82 struct regval_ctr
*values
;
83 struct regval_blob
*rval
;
88 TALLOC_CTX
*ctx
= talloc_tos();
96 for ( i
= 0; elogs
[i
]; i
++ ) {
97 if ( strequal( elogs
[i
], eventlog
) )
102 d_printf("Eventlog [%s] not found in list of valid event logs\n",
104 return false; /* invalid named passed in */
107 /* have to assume that the evenlog key itself exists at this point */
108 /* add in a key of [sourcename] under the eventlog key */
110 /* todo add to Sources */
112 werr
= regval_ctr_init(ctx
, &values
);
113 if(!W_ERROR_IS_OK(werr
)) {
114 d_printf("talloc() failure!\n");
118 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
124 regdb_fetch_values( evtlogpath
, values
);
127 if ( !( rval
= regval_ctr_getvalue( values
, "Sources" ) ) ) {
128 d_printf("No Sources value for [%s]!\n", eventlog
);
131 /* perhaps this adding a new string to a multi_sz should be a fn? */
132 /* check to see if it's there already */
134 if ( regval_type(rval
) != REG_MULTI_SZ
) {
135 d_printf("Wrong type for Sources, should be REG_MULTI_SZ\n");
138 /* convert to a 'regulah' chars to do some comparisons */
142 dump_data(1, regval_data_p(rval
), regval_size(rval
));
144 blob
= data_blob_const(regval_data_p(rval
), regval_size(rval
));
145 if (!pull_reg_multi_sz(talloc_tos(), &blob
, &wrklist
)) {
149 for (ii
=0; wrklist
[ii
]; ii
++) {
153 if (numsources
> 0) {
154 /* see if it's in there already */
158 if ( strequal( *wp
, sourcename
) ) {
159 d_printf("Source name [%s] already in list for [%s] \n",
160 sourcename
, eventlog
);
167 d_printf("Nothing in the sources list, this might be a problem\n");
173 /* make a new list with an additional entry; copy values, add another */
174 wp
= TALLOC_ARRAY(ctx
, const char *, numsources
+ 2 );
177 d_printf("talloc() failed \n");
180 memcpy( wp
, wrklist
, sizeof( char * ) * numsources
);
181 *( wp
+ numsources
) = (const char * ) sourcename
;
182 *( wp
+ numsources
+ 1 ) = NULL
;
183 if (!push_reg_multi_sz(ctx
, &blob
, wp
)) {
186 dump_data( 1, blob
.data
, blob
.length
);
187 regval_ctr_addvalue( values
, "Sources", REG_MULTI_SZ
,
188 blob
.data
, blob
.length
);
189 regdb_store_values( evtlogpath
, values
);
190 data_blob_free(&blob
);
192 d_printf("Source name [%s] found in existing list of sources\n",
196 TALLOC_FREE(wrklist
); /* */
198 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
199 if (!W_ERROR_IS_OK(werr
)) {
200 d_printf("talloc() failure!\n");
203 TALLOC_FREE(evtlogpath
);
204 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
206 TALLOC_FREE(subkeys
);
210 regdb_fetch_keys( evtlogpath
, subkeys
);
212 if ( !regsubkey_ctr_key_exists( subkeys
, sourcename
) ) {
213 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
214 sourcename
, eventlog
);
215 regsubkey_ctr_addkey( subkeys
, sourcename
);
216 if ( !regdb_store_keys( evtlogpath
, subkeys
) )
219 TALLOC_FREE(subkeys
);
221 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
223 /* now allocate room for the source's subkeys */
225 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
226 if (!W_ERROR_IS_OK(werr
)) {
227 d_printf("talloc() failure!\n");
230 TALLOC_FREE(evtlogpath
);
231 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s\\%s",
232 KEY_EVENTLOG
, eventlog
, sourcename
);
234 TALLOC_FREE(subkeys
);
238 regdb_fetch_keys( evtlogpath
, subkeys
);
240 /* now add the values to the KEY_EVENTLOG/Application form key */
241 werr
= regval_ctr_init(ctx
, &values
);
242 if (!W_ERROR_IS_OK(werr
)) {
243 d_printf("talloc() failure!\n");
246 d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
247 messagefile
, evtlogpath
);
249 regdb_fetch_values( evtlogpath
, values
);
251 regval_ctr_addvalue_sz(values
, "EventMessageFile", messagefile
);
252 regdb_store_values( evtlogpath
, values
);
259 static int DoAddSourceCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
263 printf( "need more arguments:\n" );
264 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
267 /* must open the registry before we access it */
268 if (!W_ERROR_IS_OK(regdb_init())) {
269 printf( "Can't open the registry.\n" );
273 if ( !eventlog_add_source( argv
[0], argv
[1], argv
[2] ) )
278 static int DoWriteCommand( int argc
, char **argv
, bool debugflag
, char *exename
)
285 /* fixed constants are bad bad bad */
288 struct eventlog_Record_tdb ee
;
289 uint32_t record_number
= 0;
290 TALLOC_CTX
*mem_ctx
= talloc_tos();
294 printf( "Can't open STDIN\n" );
299 printf( "Starting write for eventlog [%s]\n", argv
[0] );
300 display_eventlog_names( );
305 if ( !( etdb
= elog_open_tdb( argfname
, False
, False
) ) ) {
306 printf( "can't open the eventlog TDB (%s)\n", argfname
);
310 ZERO_STRUCT( ee
); /* MUST initialize between records */
312 while ( !feof( f1
) ) {
313 if (fgets( linein
, sizeof( linein
) - 1, f1
) == NULL
) {
316 if ((strlen(linein
) > 0)
317 && (linein
[strlen(linein
)-1] == '\n')) {
318 linein
[strlen(linein
)-1] = 0;
322 printf( "Read line [%s]\n", linein
);
327 parse_logentry( mem_ctx
, ( char * ) &linein
, &ee
, &is_eor
);
328 /* should we do something with the return code? */
331 fixup_eventlog_record_tdb( &ee
);
334 printf( "record number [%d], tg [%d] , tw [%d]\n",
335 ee
.record_number
, (int)ee
.time_generated
, (int)ee
.time_written
);
337 if ( ee
.time_generated
!= 0 ) {
339 /* printf("Writing to the event log\n"); */
341 status
= evlog_push_record_tdb( mem_ctx
, ELOG_TDB_CTX(etdb
),
342 &ee
, &record_number
);
343 if ( !NT_STATUS_IS_OK(status
) ) {
344 printf( "Can't write to the event log: %s\n",
348 printf( "Wrote record %d\n",
353 printf( "<null record>\n" );
355 ZERO_STRUCT( ee
); /* MUST initialize between records */
359 elog_close_tdb( etdb
, False
);
364 static int DoDumpCommand(int argc
, char **argv
, bool debugflag
, char *exename
)
367 TALLOC_CTX
*mem_ctx
= talloc_tos();
375 count
= atoi(argv
[1]);
378 etdb
= elog_open_tdb(argv
[0], false, true);
380 printf("can't open the eventlog TDB (%s)\n", argv
[0]);
386 struct eventlog_Record_tdb
*r
;
389 r
= evlog_pull_record_tdb(mem_ctx
, etdb
->tdb
, count
);
394 printf("displaying record: %d\n", count
);
396 s
= NDR_PRINT_STRUCT_STRING(mem_ctx
, eventlog_Record_tdb
, r
);
404 elog_close_tdb(etdb
, false);
409 /* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
411 int main( int argc
, char *argv
[] )
415 char *configfile
= NULL
;
416 TALLOC_CTX
*frame
= talloc_stackframe();
423 opt_debug
= 0; /* todo set this from getopts */
429 fstrcpy( opname
, "write" ); /* the default */
431 #if 0 /* TESTING CODE */
432 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
434 while ( ( opt
= getopt( argc
, argv
, "dho:s:" ) ) != EOF
) {
438 fstrcpy( opname
, optarg
);
443 display_eventlog_names( );
451 configfile
= talloc_strdup(frame
, optarg
);
461 printf( "\nNot enough arguments!\n" );
466 if ( configfile
== NULL
) {
467 lp_load(get_dyn_CONFIGFILE(), True
, False
, False
, True
);
468 } else if (!lp_load(configfile
, True
, False
, False
, True
)) {
469 printf("Unable to parse configfile '%s'\n",configfile
);
473 /* note that the separate command types should call usage if they need to... */
475 if ( !strcasecmp_m( opname
, "addsource" ) ) {
476 rc
= DoAddSourceCommand( argc
, argv
, opt_debug
,
480 if ( !strcasecmp_m( opname
, "write" ) ) {
481 rc
= DoWriteCommand( argc
, argv
, opt_debug
, exename
);
484 if ( !strcasecmp_m( opname
, "dump" ) ) {
485 rc
= DoDumpCommand( argc
, argv
, opt_debug
, exename
);
488 printf( "unknown command [%s]\n", opname
);