1 2/* 3 * Samba Unix/Linux SMB client utility 4 * Write Eventlog records to a tdb, perform other eventlog related functions 5 * 6 * 7 * Copyright (C) Brian Moran 2005. 8 * Copyright (C) Guenther Deschner 2009. 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License as published by 12 * the Free Software Foundation; either version 3 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 * GNU General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, see <http://www.gnu.org/licenses/>. 22 */ 23 24 25#include "includes.h" 26 27#undef DBGC_CLASS 28#define DBGC_CLASS DBGC_UTIL_EVENTLOG 29 30 31extern int optind; 32extern char *optarg; 33 34int opt_debug = 0; 35 36static void usage( char *s ) 37{ 38 printf( "\nUsage: %s [OPTION]\n\n", s ); 39 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" ); 40 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" ); 41 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" ); 42 printf( "\nMiscellaneous options:\n" ); 43 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" ); 44 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" ); 45} 46 47static void display_eventlog_names( void ) 48{ 49 const char **elogs; 50 int i; 51 52 elogs = lp_eventlog_list( ); 53 printf( "Active eventlog names (from smb.conf):\n" ); 54 printf( "--------------------------------------\n" ); 55 if ( elogs ) { 56 for ( i = 0; elogs[i]; i++ ) { 57 printf( "\t%s\n", elogs[i] ); 58 } 59 } 60 else 61 printf( "\t<None specified>\n"); 62} 63 64static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename ) 65{ 66 67 if ( argc < 3 ) { 68 printf( "need more arguments:\n" ); 69 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" ); 70 return -1; 71 } 72 /* must open the registry before we access it */ 73 if (!W_ERROR_IS_OK(regdb_init())) { 74 printf( "Can't open the registry.\n" ); 75 return -1; 76 } 77 78 if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) ) 79 return -2; 80 return 0; 81} 82 83static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename ) 84{ 85 FILE *f1; 86 char *argfname; 87 ELOG_TDB *etdb; 88 NTSTATUS status; 89 90 /* fixed constants are bad bad bad */ 91 char linein[1024]; 92 bool is_eor; 93 struct eventlog_Record_tdb ee; 94 uint32_t record_number = 0; 95 TALLOC_CTX *mem_ctx = talloc_tos(); 96 97 f1 = stdin; 98 if ( !f1 ) { 99 printf( "Can't open STDIN\n" ); 100 return -1; 101 } 102 103 if ( debugflag ) { 104 printf( "Starting write for eventlog [%s]\n", argv[0] ); 105 display_eventlog_names( ); 106 } 107 108 argfname = argv[0]; 109 110 if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) { 111 printf( "can't open the eventlog TDB (%s)\n", argfname ); 112 return -1; 113 } 114 115 ZERO_STRUCT( ee ); /* MUST initialize between records */ 116 117 while ( !feof( f1 ) ) { 118 if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) { 119 break; 120 } 121 if ((strlen(linein) > 0) 122 && (linein[strlen(linein)-1] == '\n')) { 123 linein[strlen(linein)-1] = 0; 124 } 125 126 if ( debugflag ) 127 printf( "Read line [%s]\n", linein ); 128 129 is_eor = False; 130 131 132 parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor ); 133 /* should we do something with the return code? */ 134 135 if ( is_eor ) { 136 fixup_eventlog_record_tdb( &ee ); 137 138 if ( opt_debug ) 139 printf( "record number [%d], tg [%d] , tw [%d]\n", 140 ee.record_number, (int)ee.time_generated, (int)ee.time_written ); 141 142 if ( ee.time_generated != 0 ) { 143 144 /* printf("Writing to the event log\n"); */ 145 146 status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb), 147 &ee, &record_number ); 148 if ( !NT_STATUS_IS_OK(status) ) { 149 printf( "Can't write to the event log: %s\n", 150 nt_errstr(status) ); 151 } else { 152 if ( opt_debug ) 153 printf( "Wrote record %d\n", 154 record_number ); 155 } 156 } else { 157 if ( opt_debug ) 158 printf( "<null record>\n" ); 159 } 160 ZERO_STRUCT( ee ); /* MUST initialize between records */ 161 } 162 } 163 164 elog_close_tdb( etdb , False ); 165 166 return 0; 167} 168 169static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename) 170{ 171 ELOG_TDB *etdb; 172 TALLOC_CTX *mem_ctx = talloc_tos(); 173 const char *tdb_filename; 174 uint32_t count = 1; 175 176 if (argc > 2) { 177 return -1; 178 } 179 180 tdb_filename = argv[0]; 181 182 if (argc > 1) { 183 count = atoi(argv[1]); 184 } 185 186 etdb = elog_open_tdb(argv[0], false, true); 187 if (!etdb) { 188 printf("can't open the eventlog TDB (%s)\n", argv[0]); 189 return -1; 190 } 191 192 while (1) { 193 194 struct eventlog_Record_tdb *r; 195 char *s; 196 197 r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count); 198 if (!r) { 199 break; 200 } 201 202 printf("displaying record: %d\n", count); 203 204 s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r); 205 if (s) { 206 printf("%s\n", s); 207 talloc_free(s); 208 } 209 count++; 210 } 211 212 elog_close_tdb(etdb, false); 213 214 return 0; 215} 216 217/* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */ 218 219int main( int argc, char *argv[] ) 220{ 221 int opt, rc; 222 char *exename; 223 TALLOC_CTX *frame = talloc_stackframe(); 224 225 226 fstring opname; 227 228 load_case_tables(); 229 230 opt_debug = 0; /* todo set this from getopts */ 231 232 lp_load(get_dyn_CONFIGFILE(), True, False, False, True); 233 234 exename = argv[0]; 235 236 /* default */ 237 238 fstrcpy( opname, "write" ); /* the default */ 239 240#if 0 /* TESTING CODE */ 241 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" ); 242#endif 243 while ( ( opt = getopt( argc, argv, "dho:" ) ) != EOF ) { 244 switch ( opt ) { 245 246 case 'o': 247 fstrcpy( opname, optarg ); 248 break; 249 250 case 'h': 251 usage( exename ); 252 display_eventlog_names( ); 253 exit( 0 ); 254 break; 255 256 case 'd': 257 opt_debug = 1; 258 break; 259 } 260 } 261 262 argc -= optind; 263 argv += optind; 264 265 if ( argc < 1 ) { 266 printf( "\nNot enough arguments!\n" ); 267 usage( exename ); 268 exit( 1 ); 269 } 270 271 /* note that the separate command types should call usage if they need to... */ 272 while ( 1 ) { 273 if ( !StrCaseCmp( opname, "addsource" ) ) { 274 rc = DoAddSourceCommand( argc, argv, opt_debug, 275 exename ); 276 break; 277 } 278 if ( !StrCaseCmp( opname, "write" ) ) { 279 rc = DoWriteCommand( argc, argv, opt_debug, exename ); 280 break; 281 } 282 if ( !StrCaseCmp( opname, "dump" ) ) { 283 rc = DoDumpCommand( argc, argv, opt_debug, exename ); 284 break; 285 } 286 printf( "unknown command [%s]\n", opname ); 287 usage( exename ); 288 exit( 1 ); 289 break; 290 } 291 TALLOC_FREE(frame); 292 return rc; 293} 294