4c399a30cfd8015f7393bac8167d4ef3d47993b4
[ira/wip.git] / docs-xml / manpages-3 / eventlogadm.8.xml
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <refentry id="eventlogadm.8">
4
5 <refmeta>
6         <refentrytitle>eventlogadm</refentrytitle>
7         <manvolnum>8</manvolnum>
8         <refmiscinfo class="source">Samba</refmiscinfo>
9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
10         <refmiscinfo class="version">3.6</refmiscinfo>
11 </refmeta>
12
13
14 <refnamediv>
15         <refname>eventlogadm</refname>
16         <refpurpose>push records into the Samba event log store</refpurpose>
17 </refnamediv>
18
19 <refsynopsisdiv>
20         <cmdsynopsis>
21
22                 <command>eventlogadm</command>
23                 <arg><option>-d</option></arg>
24                 <arg><option>-h</option></arg>
25                 <arg choice="plain"><option>-o</option>
26                 <literal>addsource</literal>
27                 <replaceable>EVENTLOG</replaceable>
28                 <replaceable>SOURCENAME</replaceable>
29                 <replaceable>MSGFILE</replaceable>
30                 </arg>
31
32         </cmdsynopsis>
33         <cmdsynopsis>
34                 <command>eventlogadm</command>
35                 <arg><option>-d</option></arg>
36                 <arg><option>-h</option></arg>
37                 <arg choice="plain"><option>-o</option>
38                 <literal>write</literal>
39                 <replaceable>EVENTLOG</replaceable>
40                 </arg>
41
42         </cmdsynopsis>
43         <cmdsynopsis>
44                 <command>eventlogadm</command>
45                 <arg><option>-d</option></arg>
46                 <arg><option>-h</option></arg>
47                 <arg choice="plain"><option>-o</option>
48                 <literal>dump</literal>
49                 <replaceable>EVENTLOG</replaceable>
50                 <replaceable>RECORD_NUMBER</replaceable>
51                 </arg>
52
53         </cmdsynopsis>
54
55 </refsynopsisdiv>
56
57 <refsect1>
58         <title>DESCRIPTION</title>
59
60         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
61         <manvolnum>1</manvolnum></citerefentry> suite.</para>
62
63         <para><command>eventlogadm</command> is a filter that accepts
64         formatted event log records on standard input and writes them
65         to the Samba event log store. Windows client can then manipulate
66         these record using the usual administration tools.</para>
67
68 </refsect1>
69
70
71 <refsect1>
72         <title>OPTIONS</title>
73
74         <variablelist>
75
76                 <varlistentry>
77                 <term><option>-d</option></term>
78                 <listitem><para>
79                 The <command>-d</command> option causes <command>eventlogadm</command> to emit debugging
80                 information.
81                 </para></listitem>
82                 </varlistentry>
83
84                 <varlistentry>
85                 <term>
86                 <option>-o</option>
87                 <literal>addsource</literal>
88                 <replaceable>EVENTLOG</replaceable>
89                 <replaceable>SOURCENAME</replaceable>
90                 <replaceable>MSGFILE</replaceable>
91                 </term>
92                 <listitem><para>
93                 The <command>-o addsource</command> option creates a
94                 new event log source.
95                 </para> </listitem>
96                 </varlistentry>
97
98                 <varlistentry>
99                 <term>
100                 <option>-o</option>
101                 <literal>write</literal>
102                 <replaceable>EVENTLOG</replaceable>
103                 </term>
104                 <listitem><para>
105                 The <command>-o write</command> reads event log
106                 records from standard input and writes them to the Samba
107                 event log store named by EVENTLOG.
108                 </para> </listitem>
109                 </varlistentry>
110
111                 <varlistentry>
112                 <term>
113                 <option>-o</option>
114                 <literal>write</literal>
115                 <replaceable>EVENTLOG</replaceable>
116                 <replaceable>RECORD_NUMBER</replaceable>
117                 </term>
118                 <listitem><para>
119                 The <command>-o dump</command> reads event log
120                 records from a EVENTLOG tdb and dumps them to standard
121                 output on screen.
122                 </para> </listitem>
123                 </varlistentry>
124
125                 <varlistentry>
126                 <term><option>-h</option></term>
127                 <listitem><para>
128                 Print usage information.
129                 </para></listitem>
130                 </varlistentry>
131
132         </variablelist>
133 </refsect1>
134
135
136 <refsect1>
137         <title>EVENTLOG RECORD FORMAT</title>
138
139         <para>For the write operation, <command>eventlogadm</command>
140         expects to be able to read structured records from standard
141         input. These records are a sequence of lines, with the record key
142         and data separated by a colon character. Records are separated
143         by at least one or more blank line.</para>
144
145         <para>The event log record field are:</para>
146         <itemizedlist>
147
148                 <listitem><para>
149                 <command>LEN</command> - This field should be 0, since <command>eventlogadm</command> will calculate this value.
150                 </para></listitem>
151
152                 <listitem><para>
153                 <command>RS1</command> - This must be the value 1699505740.
154                 </para></listitem>
155
156                 <listitem><para>
157                 <command>RCN</command> -  This field should be 0.
158                 </para></listitem>
159
160                 <listitem><para>
161                 <command>TMG</command> - The time the eventlog record
162                 was generated; format is the number of seconds since
163                 00:00:00 January 1, 1970, UTC.
164                 </para></listitem>
165
166                 <listitem><para>
167                 <command>TMW</command> - The time the eventlog record was
168                 written; format is the number of seconds since 00:00:00
169                 January 1, 1970, UTC.
170                 </para></listitem>
171
172                 <listitem><para>
173                 <command>EID</command> - The eventlog ID.
174                 </para></listitem>
175
176                 <listitem><para>
177                 <command>ETP</command> - The event type -- one of
178                 &quot;INFO&quot;,
179                 &quot;ERROR&quot;, &quot;WARNING&quot;, &quot;AUDIT
180                 SUCCESS&quot; or &quot;AUDIT FAILURE&quot;.
181                 </para></listitem>
182
183                 <listitem><para>
184                 <command>ECT</command> - The event category; this depends
185                 on the message file. It is primarily used as a means of
186                 filtering in the eventlog viewer.
187                 </para></listitem>
188
189                 <listitem><para>
190                 <command>RS2</command> - This field should be 0.
191                 </para></listitem>
192
193                 <listitem><para>
194                 <command>CRN</command> - This field should be 0.
195                 </para></listitem>
196
197                 <listitem><para>
198                 <command>USL</command> - This field should be 0.
199                 </para></listitem>
200
201                 <listitem><para>
202                 <command>SRC</command> - This field contains the source
203                 name associated with the event log. If a message file is
204                 used with an event log, there will be a registry entry
205                 for associating this source name with a message file DLL.
206                 </para></listitem>
207
208                 <listitem><para>
209                 <command>SRN</command> - The name of the machine on
210                 which the eventlog was generated. This is typically the
211                 host name.
212                 </para></listitem>
213
214                 <listitem><para>
215                 <command>STR</command> - The text associated with the
216                 eventlog. There may be more than one string in a record.
217                 </para></listitem>
218
219                 <listitem><para>
220                 <command>DAT</command> - This field should be left unset.
221                 </para></listitem>
222
223         </itemizedlist>
224
225 </refsect1>
226
227 <refsect1>
228         <title>EXAMPLES</title>
229         <para>An example of the record format accepted by <command>eventlogadm</command>:</para>
230
231         <programlisting>
232         LEN: 0
233         RS1: 1699505740
234         RCN: 0
235         TMG: 1128631322
236         TMW: 1128631322
237         EID: 1000
238         ETP: INFO
239         ECT: 0
240         RS2: 0
241         CRN: 0
242         USL: 0
243         SRC: cron
244         SRN: dmlinux
245         STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
246         DAT:
247         </programlisting>
248
249         <para>Set up an eventlog source, specifying a message file DLL:</para>
250         <programlisting>
251         eventlogadm -o addsource Application MyApplication | \\
252                 %SystemRoot%/system32/MyApplication.dll
253         </programlisting>
254
255         <para>Filter messages from the system log into an event log:</para>
256         <programlisting>
257         tail -f /var/log/messages | \\
258                 my_program_to_parse_into_eventlog_records | \\
259                 eventlogadm SystemLogEvents
260         </programlisting>
261
262 </refsect1>
263
264 <refsect1>
265         <title>VERSION</title>
266         <para>This man page is correct for version 3.0.25 of the Samba suite.</para>
267 </refsect1>
268
269 <refsect1>
270         <title>AUTHOR</title>
271
272         <para> The original Samba software and related utilities were
273         created by Andrew Tridgell.  Samba is now developed by the
274         Samba Team as an Open Source project similar to the way the
275         Linux kernel is developed.</para>
276 </refsect1>
277
278 </refentry>