1 files changed, 109 insertions, 0 deletions
diff --git a/source3/utils/net_eventlog.c b/source3/utils/net_eventlog.c
index 034f0612cc..197a7cd330 100644
--- a/source3/utils/net_eventlog.c
+++ b/source3/utils/net_eventlog.c
@@ -167,6 +167,106 @@ static int net_eventlog_import(struct net_context *c, int argc,
 }
 
 /**
+ * Export internal eventlog tdb representation to an *evt win32 eventlog file
+ *
+ * @param argc  Standard main() style argc.
+ * @param argv  Standard main() style argv. Initial components are already
+ *              stripped.
+ *
+ * @return A shell status integer (0 for success).
+ **/
+
+static int net_eventlog_export(struct net_context *c, int argc,
+			       const char **argv)
+{
+	int ret = -1;
+	NTSTATUS status;
+	TALLOC_CTX *ctx = talloc_stackframe();
+	enum ndr_err_code ndr_err;
+	DATA_BLOB blob;
+	uint32_t num_records = 0;
+	struct EVENTLOG_EVT_FILE evt;
+	ELOG_TDB *etdb = NULL;
+	uint32_t count = 1;
+	size_t endoffset = 0;
+
+	if (argc < 2 || c->display_usage) {
+		d_fprintf(stderr, "usage: net eventlog export <file> <eventlog>\n");
+		goto done;
+	}
+
+	etdb = elog_open_tdb(argv[1], false, true);
+	if (!etdb) {
+		d_fprintf(stderr, "can't open the eventlog TDB (%s)\n", argv[1]);
+		goto done;
+	}
+
+	ZERO_STRUCT(evt);
+
+	while (1) {
+
+		struct eventlog_Record_tdb *r;
+		struct EVENTLOGRECORD e;
+
+		r = evlog_pull_record_tdb(ctx, etdb->tdb, count);
+		if (!r) {
+			break;
+		}
+
+		status = evlog_tdb_entry_to_evt_entry(ctx, r, &e);
+		if (!NT_STATUS_IS_OK(status)) {
+			goto done;
+		}
+
+		endoffset += ndr_size_EVENTLOGRECORD(&e, NULL, 0);
+
+		ADD_TO_ARRAY(ctx, struct EVENTLOGRECORD, e, &evt.records, &num_records);
+		count++;
+	}
+
+	evt.hdr.StartOffset		= 0x30;
+	evt.hdr.EndOffset		= evt.hdr.StartOffset + endoffset;
+	evt.hdr.CurrentRecordNumber	= count;
+	evt.hdr.OldestRecordNumber	= 1;
+	evt.hdr.MaxSize			= tdb_fetch_int32(etdb->tdb, EVT_MAXSIZE);
+	evt.hdr.Flags			= 0;
+	evt.hdr.Retention		= tdb_fetch_int32(etdb->tdb, EVT_RETENTION);
+
+	if (DEBUGLEVEL >= 10) {
+		NDR_PRINT_DEBUG(EVENTLOGHEADER, &evt.hdr);
+	}
+
+	evt.eof.BeginRecord		= 0x30;
+	evt.eof.EndRecord		= evt.hdr.StartOffset + endoffset;
+	evt.eof.CurrentRecordNumber	= evt.hdr.CurrentRecordNumber;
+	evt.eof.OldestRecordNumber	= evt.hdr.OldestRecordNumber;
+
+	if (DEBUGLEVEL >= 10) {
+		NDR_PRINT_DEBUG(EVENTLOGEOF, &evt.eof);
+	}
+
+	ndr_err = ndr_push_struct_blob(&blob, ctx, NULL, &evt,
+		   (ndr_push_flags_fn_t)ndr_push_EVENTLOG_EVT_FILE);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		d_fprintf(stderr, "evt push failed: %s\n", ndr_errstr(ndr_err));
+		goto done;
+	}
+
+	if (!file_save(argv[0], blob.data, blob.length)) {
+		d_fprintf(stderr, "failed to save evt file: %s\n", argv[0]);
+		goto done;
+	}
+
+	ret = 0;
+ done:
+
+	elog_close_tdb(etdb, false);
+
+	TALLOC_FREE(ctx);
+	return ret;
+}
+
+/**
  * 'net rpc eventlog' entrypoint.
  * @param argc  Standard main() style argc.
  * @param argv  Standard main() style argv. Initial components are already
@@ -194,6 +294,15 @@ int net_eventlog(struct net_context *c, int argc, const char **argv)
 			"net eventlog import\n"
 			"    Import win32 *.evt eventlog file"
 		},
+		{
+			"export",
+			net_eventlog_export,
+			NET_TRANSPORT_LOCAL,
+			"Export eventlog",
+			"net eventlog export\n"
+			"    Export win32 *.evt eventlog file"
+		},
+
 
 	{ NULL, NULL, 0, NULL, NULL }
 	};