source: trunk/server/source3/utils/eventlogadm.c@ 938

Last change on this file since 938 was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 12.5 KB
Line 
1
2/*
3 * Samba Unix/Linux SMB client utility
4 * Write Eventlog records to a tdb, perform other eventlog related functions
5 *
6 *
7 * Copyright (C) Brian Moran 2005.
8 * Copyright (C) Guenther Deschner 2009.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 */
23
24
25#include "includes.h"
26#include "lib/eventlog/eventlog.h"
27#include "registry.h"
28#include "registry/reg_backend_db.h"
29#include "registry/reg_objects.h"
30#include "../libcli/registry/util_reg.h"
31
32extern int optind;
33extern char *optarg;
34
35int opt_debug = 0;
36
37static void usage( char *s )
38{
39 printf( "\nUsage: %s [OPTION]\n\n", s );
40 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
41 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
42 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
43 printf( "\nMiscellaneous options:\n" );
44 printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
45 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
46 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
47}
48
49static void display_eventlog_names( void )
50{
51 const char **elogs;
52 int i;
53
54 elogs = lp_eventlog_list( );
55 printf( "Active eventlog names:\n" );
56 printf( "--------------------------------------\n" );
57 if ( elogs ) {
58 for ( i = 0; elogs[i]; i++ ) {
59 printf( "\t%s\n", elogs[i] );
60 }
61 }
62 else
63 printf( "\t<None specified>\n");
64}
65
66/*********************************************************************
67 for an eventlog, add in a source name. If the eventlog doesn't
68 exist (not in the list) do nothing. If a source for the log
69 already exists, change the information (remove, replace)
70*********************************************************************/
71static bool eventlog_add_source( const char *eventlog, const char *sourcename,
72 const char *messagefile )
73{
74 /* Find all of the eventlogs, add keys for each of them */
75 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
76 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
77
78 const char **elogs = lp_eventlog_list( );
79 const char **wrklist, **wp;
80 char *evtlogpath = NULL;
81 struct regsubkey_ctr *subkeys;
82 struct regval_ctr *values;
83 struct regval_blob *rval;
84 int ii = 0;
85 bool already_in;
86 int i;
87 int numsources = 0;
88 TALLOC_CTX *ctx = talloc_tos();
89 WERROR werr;
90 DATA_BLOB blob;
91
92 if (!elogs) {
93 return False;
94 }
95
96 for ( i = 0; elogs[i]; i++ ) {
97 if ( strequal( elogs[i], eventlog ) )
98 break;
99 }
100
101 if ( !elogs[i] ) {
102 d_printf("Eventlog [%s] not found in list of valid event logs\n",
103 eventlog);
104 return false; /* invalid named passed in */
105 }
106
107 /* have to assume that the evenlog key itself exists at this point */
108 /* add in a key of [sourcename] under the eventlog key */
109
110 /* todo add to Sources */
111
112 werr = regval_ctr_init(ctx, &values);
113 if(!W_ERROR_IS_OK(werr)) {
114 d_printf("talloc() failure!\n");
115 return false;
116 }
117
118 evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
119 if (!evtlogpath) {
120 TALLOC_FREE(values);
121 return false;
122 }
123
124 regdb_fetch_values( evtlogpath, values );
125
126
127 if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
128 d_printf("No Sources value for [%s]!\n", eventlog);
129 return False;
130 }
131 /* perhaps this adding a new string to a multi_sz should be a fn? */
132 /* check to see if it's there already */
133
134 if ( regval_type(rval) != REG_MULTI_SZ ) {
135 d_printf("Wrong type for Sources, should be REG_MULTI_SZ\n");
136 return False;
137 }
138 /* convert to a 'regulah' chars to do some comparisons */
139
140 already_in = False;
141 wrklist = NULL;
142 dump_data(1, regval_data_p(rval), regval_size(rval));
143
144 blob = data_blob_const(regval_data_p(rval), regval_size(rval));
145 if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) {
146 return false;
147 }
148
149 for (ii=0; wrklist[ii]; ii++) {
150 numsources++;
151 }
152
153 if (numsources > 0) {
154 /* see if it's in there already */
155 wp = wrklist;
156
157 while (wp && *wp ) {
158 if ( strequal( *wp, sourcename ) ) {
159 d_printf("Source name [%s] already in list for [%s] \n",
160 sourcename, eventlog);
161 already_in = True;
162 break;
163 }
164 wp++;
165 }
166 } else {
167 d_printf("Nothing in the sources list, this might be a problem\n");
168 }
169
170 wp = wrklist;
171
172 if ( !already_in ) {
173 /* make a new list with an additional entry; copy values, add another */
174 wp = TALLOC_ARRAY(ctx, const char *, numsources + 2 );
175
176 if ( !wp ) {
177 d_printf("talloc() failed \n");
178 return False;
179 }
180 memcpy( wp, wrklist, sizeof( char * ) * numsources );
181 *( wp + numsources ) = ( char * ) sourcename;
182 *( wp + numsources + 1 ) = NULL;
183 if (!push_reg_multi_sz(ctx, &blob, wp)) {
184 return false;
185 }
186 dump_data( 1, blob.data, blob.length);
187 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
188 blob.data, blob.length);
189 regdb_store_values( evtlogpath, values );
190 data_blob_free(&blob);
191 } else {
192 d_printf("Source name [%s] found in existing list of sources\n",
193 sourcename);
194 }
195 TALLOC_FREE(values);
196 TALLOC_FREE(wrklist); /* */
197
198 werr = regsubkey_ctr_init(ctx, &subkeys);
199 if (!W_ERROR_IS_OK(werr)) {
200 d_printf("talloc() failure!\n");
201 return False;
202 }
203 TALLOC_FREE(evtlogpath);
204 evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
205 if (!evtlogpath) {
206 TALLOC_FREE(subkeys);
207 return false;
208 }
209
210 regdb_fetch_keys( evtlogpath, subkeys );
211
212 if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
213 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
214 sourcename, eventlog);
215 regsubkey_ctr_addkey( subkeys, sourcename );
216 if ( !regdb_store_keys( evtlogpath, subkeys ) )
217 return False;
218 }
219 TALLOC_FREE(subkeys);
220
221 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
222
223 /* now allocate room for the source's subkeys */
224
225 werr = regsubkey_ctr_init(ctx, &subkeys);
226 if (!W_ERROR_IS_OK(werr)) {
227 d_printf("talloc() failure!\n");
228 return False;
229 }
230 TALLOC_FREE(evtlogpath);
231 evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
232 KEY_EVENTLOG, eventlog, sourcename);
233 if (!evtlogpath) {
234 TALLOC_FREE(subkeys);
235 return false;
236 }
237
238 regdb_fetch_keys( evtlogpath, subkeys );
239
240 /* now add the values to the KEY_EVENTLOG/Application form key */
241 werr = regval_ctr_init(ctx, &values);
242 if (!W_ERROR_IS_OK(werr)) {
243 d_printf("talloc() failure!\n");
244 return False;
245 }
246 d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
247 messagefile, evtlogpath);
248
249 regdb_fetch_values( evtlogpath, values );
250
251 regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile);
252 regdb_store_values( evtlogpath, values );
253
254 TALLOC_FREE(values);
255
256 return True;
257}
258
259static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename )
260{
261
262 if ( argc < 3 ) {
263 printf( "need more arguments:\n" );
264 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
265 return -1;
266 }
267 /* must open the registry before we access it */
268 if (!W_ERROR_IS_OK(regdb_init())) {
269 printf( "Can't open the registry.\n" );
270 return -1;
271 }
272
273 if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) )
274 return -2;
275 return 0;
276}
277
278static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename )
279{
280 FILE *f1;
281 char *argfname;
282 ELOG_TDB *etdb;
283 NTSTATUS status;
284
285 /* fixed constants are bad bad bad */
286 char linein[1024];
287 bool is_eor;
288 struct eventlog_Record_tdb ee;
289 uint32_t record_number = 0;
290 TALLOC_CTX *mem_ctx = talloc_tos();
291
292 f1 = stdin;
293 if ( !f1 ) {
294 printf( "Can't open STDIN\n" );
295 return -1;
296 }
297
298 if ( debugflag ) {
299 printf( "Starting write for eventlog [%s]\n", argv[0] );
300 display_eventlog_names( );
301 }
302
303 argfname = argv[0];
304
305 if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) {
306 printf( "can't open the eventlog TDB (%s)\n", argfname );
307 return -1;
308 }
309
310 ZERO_STRUCT( ee ); /* MUST initialize between records */
311
312 while ( !feof( f1 ) ) {
313 if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) {
314 break;
315 }
316 if ((strlen(linein) > 0)
317 && (linein[strlen(linein)-1] == '\n')) {
318 linein[strlen(linein)-1] = 0;
319 }
320
321 if ( debugflag )
322 printf( "Read line [%s]\n", linein );
323
324 is_eor = False;
325
326
327 parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor );
328 /* should we do something with the return code? */
329
330 if ( is_eor ) {
331 fixup_eventlog_record_tdb( &ee );
332
333 if ( opt_debug )
334 printf( "record number [%d], tg [%d] , tw [%d]\n",
335 ee.record_number, (int)ee.time_generated, (int)ee.time_written );
336
337 if ( ee.time_generated != 0 ) {
338
339 /* printf("Writing to the event log\n"); */
340
341 status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb),
342 &ee, &record_number );
343 if ( !NT_STATUS_IS_OK(status) ) {
344 printf( "Can't write to the event log: %s\n",
345 nt_errstr(status) );
346 } else {
347 if ( opt_debug )
348 printf( "Wrote record %d\n",
349 record_number );
350 }
351 } else {
352 if ( opt_debug )
353 printf( "<null record>\n" );
354 }
355 ZERO_STRUCT( ee ); /* MUST initialize between records */
356 }
357 }
358
359 elog_close_tdb( etdb , False );
360
361 return 0;
362}
363
364static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename)
365{
366 ELOG_TDB *etdb;
367 TALLOC_CTX *mem_ctx = talloc_tos();
368 const char *tdb_filename;
369 uint32_t count = 1;
370
371 if (argc > 2) {
372 return -1;
373 }
374
375 tdb_filename = argv[0];
376
377 if (argc > 1) {
378 count = atoi(argv[1]);
379 }
380
381 etdb = elog_open_tdb(argv[0], false, true);
382 if (!etdb) {
383 printf("can't open the eventlog TDB (%s)\n", argv[0]);
384 return -1;
385 }
386
387 while (1) {
388
389 struct eventlog_Record_tdb *r;
390 char *s;
391
392 r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count);
393 if (!r) {
394 break;
395 }
396
397 printf("displaying record: %d\n", count);
398
399 s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r);
400 if (s) {
401 printf("%s\n", s);
402 talloc_free(s);
403 }
404 count++;
405 }
406
407 elog_close_tdb(etdb, false);
408
409 return 0;
410}
411
412/* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
413
414int main( int argc, char *argv[] )
415{
416 int opt, rc;
417 char *exename;
418 char *configfile = NULL;
419 TALLOC_CTX *frame = talloc_stackframe();
420
421
422 fstring opname;
423
424 load_case_tables();
425
426 opt_debug = 0; /* todo set this from getopts */
427
428 exename = argv[0];
429
430 /* default */
431
432 fstrcpy( opname, "write" ); /* the default */
433
434#if 0 /* TESTING CODE */
435 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
436#endif
437 while ( ( opt = getopt( argc, argv, "dho:s:" ) ) != EOF ) {
438 switch ( opt ) {
439
440 case 'o':
441 fstrcpy( opname, optarg );
442 break;
443
444 case 'h':
445 usage( exename );
446 display_eventlog_names( );
447 exit( 0 );
448 break;
449
450 case 'd':
451 opt_debug = 1;
452 break;
453 case 's':
454 configfile = talloc_strdup(frame, optarg);
455 break;
456
457 }
458 }
459
460 argc -= optind;
461 argv += optind;
462
463 if ( argc < 1 ) {
464 printf( "\nNot enough arguments!\n" );
465 usage( exename );
466 exit( 1 );
467 }
468
469 if ( configfile == NULL ) {
470 lp_load(get_dyn_CONFIGFILE(), True, False, False, True);
471 } else if (!lp_load(configfile, True, False, False, True)) {
472 printf("Unable to parse configfile '%s'\n",configfile);
473 exit( 1 );
474 }
475
476 /* note that the separate command types should call usage if they need to... */
477 while ( 1 ) {
478 if ( !StrCaseCmp( opname, "addsource" ) ) {
479 rc = DoAddSourceCommand( argc, argv, opt_debug,
480 exename );
481 break;
482 }
483 if ( !StrCaseCmp( opname, "write" ) ) {
484 rc = DoWriteCommand( argc, argv, opt_debug, exename );
485 break;
486 }
487 if ( !StrCaseCmp( opname, "dump" ) ) {
488 rc = DoDumpCommand( argc, argv, opt_debug, exename );
489 break;
490 }
491 printf( "unknown command [%s]\n", opname );
492 usage( exename );
493 exit( 1 );
494 break;
495 }
496 TALLOC_FREE(frame);
497 return rc;
498}
Note: See TracBrowser for help on using the repository browser.