source: vendor/current/source3/utils/eventlogadm.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 12.6 KB
Line 
1
2/*
3 * Samba Unix/Linux SMB client utility
4 * Write Eventlog records to a tdb, perform other eventlog related functions
5 *
6 *
7 * Copyright (C) Brian Moran 2005.
8 * Copyright (C) Guenther Deschner 2009.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 */
23
24
25#include "includes.h"
26#include "lib/eventlog/eventlog.h"
27#include "registry.h"
28#include "registry/reg_api.h"
29#include "registry/reg_init_basic.h"
30#include "registry/reg_util_token.h"
31#include "registry/reg_backend_db.h"
32#include "../libcli/registry/util_reg.h"
33
34extern int optind;
35extern char *optarg;
36
37int opt_debug = 0;
38
39static void usage( char *s )
40{
41 printf( "\nUsage: %s [OPTION]\n\n", s );
42 printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" );
43 printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" );
44 printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" );
45 printf( "\nMiscellaneous options:\n" );
46 printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n");
47 printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" );
48 printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" );
49}
50
51static void display_eventlog_names( void )
52{
53 const char **elogs;
54 int i;
55
56 elogs = lp_eventlog_list( );
57 printf( "Active eventlog names:\n" );
58 printf( "--------------------------------------\n" );
59 if ( elogs ) {
60 for ( i = 0; elogs[i]; i++ ) {
61 printf( "\t%s\n", elogs[i] );
62 }
63 }
64 else
65 printf( "\t<None specified>\n");
66}
67
68/*********************************************************************
69 for an eventlog, add in a source name. If the eventlog doesn't
70 exist (not in the list) do nothing. If a source for the log
71 already exists, change the information (remove, replace)
72*********************************************************************/
73static bool eventlog_add_source( const char *eventlog, const char *sourcename,
74 const char *messagefile )
75{
76 /* Find all of the eventlogs, add keys for each of them */
77 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
78 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
79
80 const char **elogs = lp_eventlog_list( );
81 const char **wrklist, **wp;
82 char *evtlogpath = NULL;
83 int ii = 0;
84 bool already_in;
85 int i;
86 int numsources = 0;
87 TALLOC_CTX *ctx = talloc_stackframe();
88 WERROR werr;
89 struct registry_key *key_hive, *key_eventlog, *key_source;
90 struct security_token *token = NULL;
91 const char *hive_name, *relpath;
92 enum winreg_CreateAction action;
93 struct registry_value *value;
94 static const uint32_t ACCESS = REG_KEY_READ | REG_KEY_WRITE;
95 bool ret = false;
96
97 if (!elogs) {
98 d_printf("No Eventlogs configured\n");
99 goto done;
100 }
101
102 for ( i = 0; elogs[i]; i++ ) {
103 if ( strequal( elogs[i], eventlog ) )
104 break;
105 }
106
107 if ( !elogs[i] ) {
108 d_printf("Eventlog [%s] not found in list of valid event logs\n",
109 eventlog);
110 goto done;
111 }
112
113 /* have to assume that the evenlog key itself exists at this point */
114 /* add in a key of [sourcename] under the eventlog key */
115
116 /* todo add to Sources */
117
118 evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
119 if (!evtlogpath) {
120 d_printf("Out of memory\n");
121 goto done;
122 }
123
124 relpath = evtlogpath + sizeof(KEY_EVENTLOG);
125 hive_name = talloc_strndup(ctx, evtlogpath, relpath - evtlogpath);
126 if (!hive_name) {
127 d_printf("Out of memory\n");
128 goto done;
129 }
130 relpath++;
131
132 werr = ntstatus_to_werror(registry_create_admin_token(ctx, &token));
133 if (!W_ERROR_IS_OK(werr)) {
134 d_printf("Failed to create admin token: %s\n", win_errstr(werr));
135 goto done;
136 }
137
138 werr = reg_openhive(ctx, hive_name, ACCESS, token, &key_hive);
139 if (!W_ERROR_IS_OK(werr)) {
140 d_printf("Failed to open hive [%s]: %s\n", hive_name, win_errstr(werr));
141 goto done;
142 }
143
144 werr = reg_openkey(ctx, key_hive, relpath, ACCESS, &key_eventlog);
145 if (!W_ERROR_IS_OK(werr)) {
146 d_printf("Failed to open key [%s]: %s\n", evtlogpath, win_errstr(werr));
147 goto done;
148 }
149
150 werr = reg_queryvalue(ctx, key_eventlog, "Sources", &value);
151 if (!W_ERROR_IS_OK(werr)) {
152 d_printf("Failed to get value \"Sources\" for [%s]: %s\n", evtlogpath, win_errstr(werr));
153 goto done;
154 }
155 /* perhaps this adding a new string to a multi_sz should be a fn? */
156 /* check to see if it's there already */
157
158 if ( value->type != REG_MULTI_SZ ) {
159 d_printf("Wrong type for \"Sources\", should be REG_MULTI_SZ\n");
160 goto done;
161 }
162 /* convert to a 'regulah' chars to do some comparisons */
163
164 already_in = false;
165 wrklist = NULL;
166 dump_data(1, value->data.data, value->data.length);
167
168 if (!pull_reg_multi_sz(ctx, &value->data, &wrklist)) {
169 d_printf("Failed to pull REG_MULTI_SZ from \"Sources\"\n");
170 goto done;
171 }
172
173 for (ii=0; wrklist[ii]; ii++) {
174 numsources++;
175 }
176
177 if (numsources > 0) {
178 /* see if it's in there already */
179 wp = wrklist;
180
181 while (wp && *wp ) {
182 if ( strequal( *wp, sourcename ) ) {
183 d_printf("Source name [%s] already in list for [%s] \n",
184 sourcename, eventlog);
185 already_in = true;
186 break;
187 }
188 wp++;
189 }
190 } else {
191 d_printf("Nothing in the sources list, this might be a problem\n");
192 }
193
194 if ( !already_in ) {
195 /* make a new list with an additional entry; copy values, add another */
196 wp = talloc_realloc(ctx, wrklist, const char *, numsources + 2 );
197 if ( !wp ) {
198 d_printf("Out of memory\n");
199 goto done;
200 }
201
202 wp[numsources] = sourcename;
203 wp[numsources+1] = NULL;
204 if (!push_reg_multi_sz(ctx, &value->data, wp)) {
205 d_printf("Failed to push Sources\n");
206 goto done;
207 }
208 dump_data( 1, value->data.data, value->data.length);
209 werr = reg_setvalue(key_eventlog, "Sources", value);
210 if (!W_ERROR_IS_OK(werr)) {
211 d_printf("Failed to set value Sources: %s\n", win_errstr(werr));
212 goto done;
213 }
214 } else {
215 d_printf("Source name [%s] found in existing list of sources\n",
216 sourcename);
217 }
218
219 werr = reg_createkey(ctx, key_eventlog, sourcename, ACCESS, &key_source, &action);
220 if (!W_ERROR_IS_OK(werr)) {
221 d_printf("Failed to create subkey \"%s\" of \"%s\": %s\n", sourcename, evtlogpath, win_errstr(werr));
222 goto done;
223 }
224
225 if (action == REG_CREATED_NEW_KEY) {
226 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
227 sourcename, eventlog);
228 }
229
230 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
231
232 /* now add the values to the KEY_EVENTLOG/Application form key */
233 d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
234 messagefile, evtlogpath);
235
236 if (!push_reg_sz(ctx, &value->data, messagefile)) {
237 d_printf("Failed to push \"EventMessageFile\"\n");
238 goto done;
239 }
240 value->type = REG_SZ;
241
242 werr = reg_setvalue(key_source, "EventMessageFile", value);
243 if (!W_ERROR_IS_OK(werr)) {
244 d_printf("Failed to set value \"EventMessageFile\": %s\n", win_errstr(werr));
245 return false;
246 }
247 ret = true;
248done:
249 talloc_free(ctx);
250 return ret;
251}
252
253static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename )
254{
255 WERROR werr;
256
257 if ( argc < 3 ) {
258 printf( "need more arguments:\n" );
259 printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" );
260 return -1;
261 }
262
263 /* must open the registry before we access it */
264 werr = registry_init_common();
265 if (!W_ERROR_IS_OK(werr)) {
266 printf("Can't open the registry: %s.\n", win_errstr(werr));
267 return -1;
268 }
269 werr = regdb_transaction_start();
270 if (!W_ERROR_IS_OK(werr)) {
271 printf("Can't start transaction on registry: %s.\n", win_errstr(werr));
272 return -1;
273 }
274
275 if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) ) {
276 regdb_transaction_cancel();
277 return -2;
278 }
279 werr = regdb_transaction_commit();
280 if (!W_ERROR_IS_OK(werr)) {
281 printf("Failed to commit transaction on registry: %s.\n", win_errstr(werr));
282 return -1;
283 }
284 return 0;
285}
286
287static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename )
288{
289 FILE *f1;
290 char *argfname;
291 ELOG_TDB *etdb;
292 NTSTATUS status;
293
294 /* fixed constants are bad bad bad */
295 char linein[1024];
296 bool is_eor;
297 struct eventlog_Record_tdb ee;
298 uint32_t record_number = 0;
299 TALLOC_CTX *mem_ctx = talloc_tos();
300
301 f1 = stdin;
302 if ( !f1 ) {
303 printf( "Can't open STDIN\n" );
304 return -1;
305 }
306
307 if ( debugflag ) {
308 printf( "Starting write for eventlog [%s]\n", argv[0] );
309 display_eventlog_names( );
310 }
311
312 argfname = argv[0];
313
314 if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) {
315 printf( "can't open the eventlog TDB (%s)\n", argfname );
316 return -1;
317 }
318
319 ZERO_STRUCT( ee ); /* MUST initialize between records */
320
321 while ( !feof( f1 ) ) {
322 if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) {
323 break;
324 }
325 if ((strlen(linein) > 0)
326 && (linein[strlen(linein)-1] == '\n')) {
327 linein[strlen(linein)-1] = 0;
328 }
329
330 if ( debugflag )
331 printf( "Read line [%s]\n", linein );
332
333 is_eor = False;
334
335
336 parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor );
337 /* should we do something with the return code? */
338
339 if ( is_eor ) {
340 fixup_eventlog_record_tdb( &ee );
341
342 if ( opt_debug )
343 printf( "record number [%d], tg [%d] , tw [%d]\n",
344 ee.record_number, (int)ee.time_generated, (int)ee.time_written );
345
346 if ( ee.time_generated != 0 ) {
347
348 /* printf("Writing to the event log\n"); */
349
350 status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb),
351 &ee, &record_number );
352 if ( !NT_STATUS_IS_OK(status) ) {
353 printf( "Can't write to the event log: %s\n",
354 nt_errstr(status) );
355 } else {
356 if ( opt_debug )
357 printf( "Wrote record %d\n",
358 record_number );
359 }
360 } else {
361 if ( opt_debug )
362 printf( "<null record>\n" );
363 }
364 ZERO_STRUCT( ee ); /* MUST initialize between records */
365 }
366 }
367
368 elog_close_tdb( etdb , False );
369
370 return 0;
371}
372
373static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename)
374{
375 ELOG_TDB *etdb;
376 TALLOC_CTX *mem_ctx = talloc_tos();
377 uint32_t count = 1;
378
379 if (argc > 2) {
380 return -1;
381 }
382
383 if (argc > 1) {
384 count = atoi(argv[1]);
385 }
386
387 etdb = elog_open_tdb(argv[0], false, true);
388 if (!etdb) {
389 printf("can't open the eventlog TDB (%s)\n", argv[0]);
390 return -1;
391 }
392
393 while (1) {
394
395 struct eventlog_Record_tdb *r;
396 char *s;
397
398 r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count);
399 if (!r) {
400 break;
401 }
402
403 printf("displaying record: %d\n", count);
404
405 s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r);
406 if (s) {
407 printf("%s\n", s);
408 talloc_free(s);
409 }
410 count++;
411 }
412
413 elog_close_tdb(etdb, false);
414
415 return 0;
416}
417
418/* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */
419
420int main( int argc, char *argv[] )
421{
422 int opt, rc;
423 char *exename;
424 char *configfile = NULL;
425 TALLOC_CTX *frame = talloc_stackframe();
426
427
428 fstring opname;
429
430 smb_init_locale();
431
432 opt_debug = 0; /* todo set this from getopts */
433
434 exename = argv[0];
435
436 /* default */
437
438 fstrcpy( opname, "write" ); /* the default */
439
440#if 0 /* TESTING CODE */
441 eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" );
442#endif
443 while ( ( opt = getopt( argc, argv, "dho:s:" ) ) != EOF ) {
444 switch ( opt ) {
445
446 case 'o':
447 fstrcpy( opname, optarg );
448 break;
449
450 case 'h':
451 usage( exename );
452 display_eventlog_names( );
453 exit( 0 );
454 break;
455
456 case 'd':
457 opt_debug = 1;
458 break;
459 case 's':
460 configfile = talloc_strdup(frame, optarg);
461 break;
462
463 }
464 }
465
466 argc -= optind;
467 argv += optind;
468
469 if ( argc < 1 ) {
470 printf( "\nNot enough arguments!\n" );
471 usage( exename );
472 exit( 1 );
473 }
474
475 if ( configfile == NULL ) {
476 lp_load_global(get_dyn_CONFIGFILE());
477 } else if (!lp_load_global(configfile)) {
478 printf("Unable to parse configfile '%s'\n",configfile);
479 exit( 1 );
480 }
481
482 /* note that the separate command types should call usage if they need to... */
483 while ( 1 ) {
484 if ( !strcasecmp_m( opname, "addsource" ) ) {
485 rc = DoAddSourceCommand( argc, argv, opt_debug,
486 exename );
487 break;
488 }
489 if ( !strcasecmp_m( opname, "write" ) ) {
490 rc = DoWriteCommand( argc, argv, opt_debug, exename );
491 break;
492 }
493 if ( !strcasecmp_m( opname, "dump" ) ) {
494 rc = DoDumpCommand( argc, argv, opt_debug, exename );
495 break;
496 }
497 printf( "unknown command [%s]\n", opname );
498 usage( exename );
499 exit( 1 );
500 break;
501 }
502 TALLOC_FREE(frame);
503 return rc;
504}
Note: See TracBrowser for help on using the repository browser.