source: branches/samba-3.3.x/docs-xml/manpages-3/eventlogadm.8.xml@ 1067

Last change on this file since 1067 was 221, checked in by Herwig Bauernfeind, 16 years ago

Update Samba 3.3 to 3.3.1
File size: 6.7 KB
Line 
1<?xml version="1.0" encoding="iso-8859-1"?>
2<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3<refentry id="eventlogadm.8">
4
5<refmeta>
6 <refentrytitle>eventlogadm</refentrytitle>
7 <manvolnum>8</manvolnum>
8 <refmiscinfo class="source">Samba</refmiscinfo>
9 <refmiscinfo class="manual">System Administration tools</refmiscinfo>
10 <refmiscinfo class="version">3.3</refmiscinfo>
11</refmeta>
12
13
14<refnamediv>
15 <refname>eventlogadm</refname>
16 <refpurpose>push records into the Samba event log store</refpurpose>
17</refnamediv>
18
19<refsynopsisdiv>
20 <cmdsynopsis>
21
22 <command>eventlogadm</command>
23 <arg><option>-d</option></arg>
24 <arg><option>-h</option></arg>
25 <arg choice="plain"><option>-o</option>
26 <literal>addsource</literal>
27 <replaceable>EVENTLOG</replaceable>
28 <replaceable>SOURCENAME</replaceable>
29 <replaceable>MSGFILE</replaceable>
30 </arg>
31
32 </cmdsynopsis>
33 <cmdsynopsis>
34 <command>eventlogadm</command>
35 <arg><option>-d</option></arg>
36 <arg><option>-h</option></arg>
37 <arg choice="plain"><option>-o</option>
38 <literal>write</literal>
39 <replaceable>EVENTLOG</replaceable>
40 </arg>
41
42 </cmdsynopsis>
43</refsynopsisdiv>
44
45<refsect1>
46 <title>DESCRIPTION</title>
47
48 <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
49 <manvolnum>1</manvolnum></citerefentry> suite.</para>
50
51 <para><command>eventlogadm</command> is a filter that accepts
52 formatted event log records on standard input and writes them
53 to the Samba event log store. Windows client can then manipulate
54 these record using the usual administration tools.</para>
55
56</refsect1>
57
58
59<refsect1>
60 <title>OPTIONS</title>
61
62 <variablelist>
63
64 <varlistentry>
65 <term><option>-d</option></term>
66 <listitem><para>
67 The <command>-d</command> option causes <command>eventlogadm</command> to emit debugging
68 information.
69 </para></listitem>
70 </varlistentry>
71
72 <varlistentry>
73 <term>
74 <option>-o</option>
75 <literal>addsource</literal>
76 <replaceable>EVENTLOG</replaceable>
77 <replaceable>SOURCENAME</replaceable>
78 <replaceable>MSGFILE</replaceable>
79 </term>
80 <listitem><para>
81 The <command>-o addsource</command> option creates a
82 new event log source.
83 </para> </listitem>
84 </varlistentry>
85
86 <varlistentry>
87 <term>
88 <option>-o</option>
89 <literal>write</literal>
90 <replaceable>EVENTLOG</replaceable>
91 </term>
92 <listitem><para>
93 The <command>-o write</command> reads event log
94 records from standard input and writes them to the Samba
95 event log store named by EVENTLOG.
96 </para> </listitem>
97 </varlistentry>
98
99 <varlistentry>
100 <term><option>-h</option></term>
101 <listitem><para>
102 Print usage information.
103 </para></listitem>
104 </varlistentry>
105
106 </variablelist>
107</refsect1>
108
109
110<refsect1>
111 <title>EVENTLOG RECORD FORMAT</title>
112
113 <para>For the write operation, <command>eventlogadm</command>
114 expects to be able to read structured records from standard
115 input. These records are a sequence of lines, with the record key
116 and data separated by a colon character. Records are separated
117 by at least one or more blank line.</para>
118
119 <para>The event log record field are:</para>
120 <itemizedlist>
121
122 <listitem><para>
123 <command>LEN</command> - This field should be 0, since <command>eventlogadm</command> will calculate this value.
124 </para></listitem>
125
126 <listitem><para>
127 <command>RS1</command> - This must be the value 1699505740.
128 </para></listitem>
129
130 <listitem><para>
131 <command>RCN</command> - This field should be 0.
132 </para></listitem>
133
134 <listitem><para>
135 <command>TMG</command> - The time the eventlog record
136 was generated; format is the number of seconds since
137 00:00:00 January 1, 1970, UTC.
138 </para></listitem>
139
140 <listitem><para>
141 <command>TMW</command> - The time the eventlog record was
142 written; format is the number of seconds since 00:00:00
143 January 1, 1970, UTC.
144 </para></listitem>
145
146 <listitem><para>
147 <command>EID</command> - The eventlog ID.
148 </para></listitem>
149
150 <listitem><para>
151 <command>ETP</command> - The event type -- one of
152 &quot;INFO&quot;,
153 &quot;ERROR&quot;, &quot;WARNING&quot;, &quot;AUDIT
154 SUCCESS&quot; or &quot;AUDIT FAILURE&quot;.
155 </para></listitem>
156
157 <listitem><para>
158 <command>ECT</command> - The event category; this depends
159 on the message file. It is primarily used as a means of
160 filtering in the eventlog viewer.
161 </para></listitem>
162
163 <listitem><para>
164 <command>RS2</command> - This field should be 0.
165 </para></listitem>
166
167 <listitem><para>
168 <command>CRN</command> - This field should be 0.
169 </para></listitem>
170
171 <listitem><para>
172 <command>USL</command> - This field should be 0.
173 </para></listitem>
174
175 <listitem><para>
176 <command>SRC</command> - This field contains the source
177 name associated with the event log. If a message file is
178 used with an event log, there will be a registry entry
179 for associating this source name with a message file DLL.
180 </para></listitem>
181
182 <listitem><para>
183 <command>SRN</command> - The name of the machine on
184 which the eventlog was generated. This is typically the
185 host name.
186 </para></listitem>
187
188 <listitem><para>
189 <command>STR</command> - The text associated with the
190 eventlog. There may be more than one string in a record.
191 </para></listitem>
192
193 <listitem><para>
194 <command>DAT</command> - This field should be left unset.
195 </para></listitem>
196
197 </itemizedlist>
198
199</refsect1>
200
201<refsect1>
202 <title>EXAMPLES</title>
203 <para>An example of the record format accepted by <command>eventlogadm</command>:</para>
204
205 <programlisting>
206 LEN: 0
207 RS1: 1699505740
208 RCN: 0
209 TMG: 1128631322
210 TMW: 1128631322
211 EID: 1000
212 ETP: INFO
213 ECT: 0
214 RS2: 0
215 CRN: 0
216 USL: 0
217 SRC: cron
218 SRN: dmlinux
219 STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
220 DAT:
221 </programlisting>
222
223 <para>Set up an eventlog source, specifying a message file DLL:</para>
224 <programlisting>
225 eventlogadm -o addsource Application MyApplication | \\
226 %SystemRoot%/system32/MyApplication.dll
227 </programlisting>
228
229 <para>Filter messages from the system log into an event log:</para>
230 <programlisting>
231 tail -f /var/log/messages | \\
232 my_program_to_parse_into_eventlog_records | \\
233 eventlogadm SystemLogEvents
234 </programlisting>
235
236</refsect1>
237
238<refsect1>
239 <title>VERSION</title>
240 <para>This man page is correct for version 3.0.25 of the Samba suite.</para>
241</refsect1>
242
243<refsect1>
244 <title>AUTHOR</title>
245
246 <para> The original Samba software and related utilities were
247 created by Andrew Tridgell. Samba is now developed by the
248 Samba Team as an Open Source project similar to the way the
249 Linux kernel is developed.</para>
250</refsect1>
251
252</refentry>
Note: See TracBrowser for help on using the repository browser.