summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--source3/include/proto.h2
-rw-r--r--source3/rpc_server/srv_eventlog_lib.c93
-rw-r--r--source3/utils/eventlogadm.c23
3 files changed, 55 insertions, 63 deletions
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 0b58460beb..9f0caa2fa8 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -6262,7 +6262,7 @@ ELOG_TDB *elog_open_tdb( const char *logname, bool force_clear, bool read_only )
int elog_close_tdb( ELOG_TDB *etdb, bool force_close );
int write_eventlog_tdb( TDB_CONTEXT * the_tdb, Eventlog_entry * ee );
void fixup_eventlog_entry( Eventlog_entry * ee );
-bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bool * eor );
+bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, struct eventlog_Record_tdb *entry, bool * eor );
size_t fixup_eventlog_record_tdb(struct eventlog_Record_tdb *r);
struct eventlog_Record_tdb *evlog_pull_record_tdb(TALLOC_CTX *mem_ctx,
TDB_CONTEXT *tdb,
diff --git a/source3/rpc_server/srv_eventlog_lib.c b/source3/rpc_server/srv_eventlog_lib.c
index 73aa5f94aa..85200d56ba 100644
--- a/source3/rpc_server/srv_eventlog_lib.c
+++ b/source3/rpc_server/srv_eventlog_lib.c
@@ -594,7 +594,7 @@ void fixup_eventlog_entry( Eventlog_entry * ee )
going in.
********************************************************************/
-bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bool * eor )
+bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, struct eventlog_Record_tdb *entry, bool * eor )
{
char *start = NULL, *stop = NULL;
@@ -615,32 +615,32 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo
if ( 0 == strncmp( start, "LEN", stop - start ) ) {
/* This will get recomputed later anyway -- probably not necessary */
- entry->record.length = atoi( stop + 1 );
+ entry->size = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "RS1", stop - start ) ) {
/* For now all these reserved entries seem to have the same value,
which can be hardcoded to int(1699505740) for now */
- entry->record.reserved1 = atoi( stop + 1 );
+ entry->reserved = talloc_strdup(mem_ctx, "eLfL");
} else if ( 0 == strncmp( start, "RCN", stop - start ) ) {
- entry->record.record_number = atoi( stop + 1 );
+ entry->record_number = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "TMG", stop - start ) ) {
- entry->record.time_generated = atoi( stop + 1 );
+ entry->time_generated = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "TMW", stop - start ) ) {
- entry->record.time_written = atoi( stop + 1 );
+ entry->time_written = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "EID", stop - start ) ) {
- entry->record.event_id = atoi( stop + 1 );
+ entry->event_id = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "ETP", stop - start ) ) {
if ( strstr( start, "ERROR" ) ) {
- entry->record.event_type = EVENTLOG_ERROR_TYPE;
+ entry->event_type = EVENTLOG_ERROR_TYPE;
} else if ( strstr( start, "WARNING" ) ) {
- entry->record.event_type = EVENTLOG_WARNING_TYPE;
+ entry->event_type = EVENTLOG_WARNING_TYPE;
} else if ( strstr( start, "INFO" ) ) {
- entry->record.event_type = EVENTLOG_INFORMATION_TYPE;
+ entry->event_type = EVENTLOG_INFORMATION_TYPE;
} else if ( strstr( start, "AUDIT_SUCCESS" ) ) {
- entry->record.event_type = EVENTLOG_AUDIT_SUCCESS;
+ entry->event_type = EVENTLOG_AUDIT_SUCCESS;
} else if ( strstr( start, "AUDIT_FAILURE" ) ) {
- entry->record.event_type = EVENTLOG_AUDIT_FAILURE;
+ entry->event_type = EVENTLOG_AUDIT_FAILURE;
} else if ( strstr( start, "SUCCESS" ) ) {
- entry->record.event_type = EVENTLOG_SUCCESS;
+ entry->event_type = EVENTLOG_SUCCESS;
} else {
/* some other eventlog type -- currently not defined in MSDN docs, so error out */
return False;
@@ -650,27 +650,26 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo
/*
else if(0 == strncmp(start, "NST", stop - start))
{
- entry->record.num_strings = atoi(stop + 1);
+ entry->num_of_strings = atoi(stop + 1);
}
*/
else if ( 0 == strncmp( start, "ECT", stop - start ) ) {
- entry->record.event_category = atoi( stop + 1 );
+ entry->event_category = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "RS2", stop - start ) ) {
- entry->record.reserved2 = atoi( stop + 1 );
+ entry->reserved_flags = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "CRN", stop - start ) ) {
- entry->record.closing_record_number = atoi( stop + 1 );
+ entry->closing_record_number = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "USL", stop - start ) ) {
- entry->record.user_sid_length = atoi( stop + 1 );
+ entry->sid_length = atoi( stop + 1 );
} else if ( 0 == strncmp( start, "SRC", stop - start ) ) {
stop++;
while ( isspace( stop[0] ) ) {
stop++;
}
- entry->data_record.source_name_len = rpcstr_push_talloc(mem_ctx,
- &entry->data_record.source_name,
- stop);
- if (entry->data_record.source_name_len == (uint32_t)-1 ||
- entry->data_record.source_name == NULL) {
+ entry->source_name_len = strlen_m_term(stop);
+ entry->source_name = talloc_strdup(mem_ctx, stop);
+ if (entry->source_name_len == (uint32_t)-1 ||
+ entry->source_name == NULL) {
return false;
}
} else if ( 0 == strncmp( start, "SRN", stop - start ) ) {
@@ -678,54 +677,43 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo
while ( isspace( stop[0] ) ) {
stop++;
}
- entry->data_record.computer_name_len = rpcstr_push_talloc(mem_ctx,
- &entry->data_record.computer_name,
- stop);
- if (entry->data_record.computer_name_len == (uint32_t)-1 ||
- entry->data_record.computer_name == NULL) {
+ entry->computer_name_len = strlen_m_term(stop);
+ entry->computer_name = talloc_strdup(mem_ctx, stop);
+ if (entry->computer_name_len == (uint32_t)-1 ||
+ entry->computer_name == NULL) {
return false;
}
} else if ( 0 == strncmp( start, "SID", stop - start ) ) {
+ smb_ucs2_t *dummy = NULL;
stop++;
while ( isspace( stop[0] ) ) {
stop++;
}
- entry->record.user_sid_length = rpcstr_push_talloc(mem_ctx,
- &entry->data_record.sid,
+ entry->sid_length = rpcstr_push_talloc(mem_ctx,
+ &dummy,
stop);
- if (entry->record.user_sid_length == (uint32_t)-1 ||
- entry->data_record.sid == NULL) {
+ entry->sid = data_blob_talloc(mem_ctx, dummy, entry->sid_length);
+ if (entry->sid_length == (uint32_t)-1 ||
+ entry->sid.data == NULL) {
return false;
}
} else if ( 0 == strncmp( start, "STR", stop - start ) ) {
- smb_ucs2_t *temp = NULL;
size_t tmp_len;
- uint32_t old_len;
/* skip past initial ":" */
stop++;
/* now skip any other leading whitespace */
while ( isspace(stop[0])) {
stop++;
}
- tmp_len = rpcstr_push_talloc(mem_ctx,
- &temp,
- stop);
- if (tmp_len == (size_t)-1 || !temp) {
+ tmp_len = strlen_m_term(stop);
+ if (tmp_len == (size_t)-1) {
return false;
}
- old_len = entry->data_record.strings_len;
- entry->data_record.strings = (smb_ucs2_t *)TALLOC_REALLOC_ARRAY(mem_ctx,
- entry->data_record.strings,
- char,
- old_len + tmp_len);
- if (!entry->data_record.strings) {
+ if (!add_string_to_array(mem_ctx, stop, &entry->strings,
+ (int *)&entry->num_of_strings)) {
return false;
}
- memcpy(((char *)entry->data_record.strings) + old_len,
- temp,
- tmp_len);
- entry->data_record.strings_len += tmp_len;
- entry->record.num_strings++;
+ entry->strings_len += tmp_len;
} else if ( 0 == strncmp( start, "DAT", stop - start ) ) {
/* skip past initial ":" */
stop++;
@@ -733,10 +721,9 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo
while ( isspace( stop[0] ) ) {
stop++;
}
- entry->data_record.user_data_len = strlen(stop);
- entry->data_record.user_data = talloc_strdup(mem_ctx,
- stop);
- if (!entry->data_record.user_data) {
+ entry->data_length = strlen_m(stop);
+ entry->data = data_blob_talloc(mem_ctx, stop, entry->data_length);
+ if (!entry->data.data) {
return false;
}
} else {
diff --git a/source3/utils/eventlogadm.c b/source3/utils/eventlogadm.c
index b957ec2fab..d134ea8fea 100644
--- a/source3/utils/eventlogadm.c
+++ b/source3/utils/eventlogadm.c
@@ -5,6 +5,7 @@
*
*
* Copyright (C) Brian Moran 2005.
+ * Copyright (C) Guenther Deschner 2009.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -84,12 +85,13 @@ static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename
FILE *f1;
char *argfname;
ELOG_TDB *etdb;
+ NTSTATUS status;
/* fixed constants are bad bad bad */
char linein[1024];
bool is_eor;
- Eventlog_entry ee;
- int rcnum;
+ struct eventlog_Record_tdb ee;
+ uint32_t record_number;
TALLOC_CTX *mem_ctx = talloc_tos();
f1 = stdin;
@@ -128,22 +130,25 @@ static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename
/* should we do something with the return code? */
if ( is_eor ) {
- fixup_eventlog_entry( &ee );
+ fixup_eventlog_record_tdb( &ee );
if ( opt_debug )
- printf( "record number [%d], tg [%d] , tw [%d]\n", ee.record.record_number, ee.record.time_generated, ee.record.time_written );
+ printf( "record number [%d], tg [%d] , tw [%d]\n",
+ ee.record_number, (int)ee.time_generated, (int)ee.time_written );
- if ( ee.record.time_generated != 0 ) {
+ if ( ee.time_generated != 0 ) {
/* printf("Writing to the event log\n"); */
- rcnum = write_eventlog_tdb( ELOG_TDB_CTX(etdb), &ee );
- if ( !rcnum ) {
- printf( "Can't write to the event log\n" );
+ status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb),
+ &ee, &record_number );
+ if ( !NT_STATUS_IS_OK(status) ) {
+ printf( "Can't write to the event log: %s\n",
+ nt_errstr(status) );
} else {
if ( opt_debug )
printf( "Wrote record %d\n",
- rcnum );
+ record_number );
}
} else {
if ( opt_debug )
generated by cgit (git 2.34.1) at 2024-11-23 16:58:37 +0000