docs: Update doc to use absolute path for 'dedicated keytab file'
[sfrench/samba-autobuild/.git] / docs-xml / manpages / eventlogadm.8.xml
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <refentry id="eventlogadm.8">
4
5 <refmeta>
6         <refentrytitle>eventlogadm</refentrytitle>
7         <manvolnum>8</manvolnum>
8         <refmiscinfo class="source">Samba</refmiscinfo>
9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
10         <refmiscinfo class="version">4.6</refmiscinfo>
11 </refmeta>
12
13
14 <refnamediv>
15         <refname>eventlogadm</refname>
16         <refpurpose>push records into the Samba event log store</refpurpose>
17 </refnamediv>
18
19 <refsynopsisdiv>
20         <cmdsynopsis>
21
22                 <command>eventlogadm</command>
23                 <arg><option>-s</option></arg>
24                 <arg><option>-d</option></arg>
25                 <arg><option>-h</option></arg>
26                 <arg choice="plain"><option>-o</option>
27                 <literal>addsource</literal>
28                 <replaceable>EVENTLOG</replaceable>
29                 <replaceable>SOURCENAME</replaceable>
30                 <replaceable>MSGFILE</replaceable>
31                 </arg>
32
33         </cmdsynopsis>
34         <cmdsynopsis>
35                 <command>eventlogadm</command>
36                 <arg><option>-s</option></arg>
37                 <arg><option>-d</option></arg>
38                 <arg><option>-h</option></arg>
39                 <arg choice="plain"><option>-o</option>
40                 <literal>write</literal>
41                 <replaceable>EVENTLOG</replaceable>
42                 </arg>
43
44         </cmdsynopsis>
45         <cmdsynopsis>
46                 <command>eventlogadm</command>
47                 <arg><option>-s</option></arg>
48                 <arg><option>-d</option></arg>
49                 <arg><option>-h</option></arg>
50                 <arg choice="plain"><option>-o</option>
51                 <literal>dump</literal>
52                 <replaceable>EVENTLOG</replaceable>
53                 <replaceable>RECORD_NUMBER</replaceable>
54                 </arg>
55
56         </cmdsynopsis>
57
58 </refsynopsisdiv>
59
60 <refsect1>
61         <title>DESCRIPTION</title>
62
63         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
64         <manvolnum>1</manvolnum></citerefentry> suite.</para>
65
66         <para><command>eventlogadm</command> is a filter that accepts
67         formatted event log records on standard input and writes them
68         to the Samba event log store. Windows client can then manipulate
69         these record using the usual administration tools.</para>
70
71 </refsect1>
72
73
74 <refsect1>
75         <title>OPTIONS</title>
76
77         <variablelist>
78                 <varlistentry>
79                 <term>
80                 <option>-s</option>
81                 <replaceable>FILENAME</replaceable>
82                 </term>
83                 <listitem><para>
84                 The <command>-s</command> option causes <command>eventlogadm</command> to load the
85                 configuration file given as FILENAME instead of the default one used by Samba.
86                 </para></listitem>
87                 </varlistentry>
88
89                 <varlistentry>
90                 <term><option>-d</option></term>
91                 <listitem><para>
92                 The <command>-d</command> option causes <command>eventlogadm</command> to emit debugging
93                 information.
94                 </para></listitem>
95                 </varlistentry>
96
97                 <varlistentry>
98                 <term>
99                 <option>-o</option>
100                 <literal>addsource</literal>
101                 <replaceable>EVENTLOG</replaceable>
102                 <replaceable>SOURCENAME</replaceable>
103                 <replaceable>MSGFILE</replaceable>
104                 </term>
105                 <listitem><para>
106                 The <command>-o addsource</command> option creates a
107                 new event log source.
108                 </para> </listitem>
109                 </varlistentry>
110
111                 <varlistentry>
112                 <term>
113                 <option>-o</option>
114                 <literal>write</literal>
115                 <replaceable>EVENTLOG</replaceable>
116                 </term>
117                 <listitem><para>
118                 The <command>-o write</command> reads event log
119                 records from standard input and writes them to the Samba
120                 event log store named by EVENTLOG.
121                 </para> </listitem>
122                 </varlistentry>
123
124                 <varlistentry>
125                 <term>
126                 <option>-o</option>
127                 <literal>dump</literal>
128                 <replaceable>EVENTLOG</replaceable>
129                 <replaceable>RECORD_NUMBER</replaceable>
130                 </term>
131                 <listitem><para>
132                 The <command>-o dump</command> reads event log
133                 records from a EVENTLOG tdb and dumps them to standard
134                 output on screen.
135                 </para> </listitem>
136                 </varlistentry>
137
138                 <varlistentry>
139                 <term><option>-h</option></term>
140                 <listitem><para>
141                 Print usage information.
142                 </para></listitem>
143                 </varlistentry>
144
145         </variablelist>
146 </refsect1>
147
148
149 <refsect1>
150         <title>EVENTLOG RECORD FORMAT</title>
151
152         <para>For the write operation, <command>eventlogadm</command>
153         expects to be able to read structured records from standard
154         input. These records are a sequence of lines, with the record key
155         and data separated by a colon character. Records are separated
156         by at least one or more blank line.</para>
157
158         <para>The event log record field are:</para>
159         <itemizedlist>
160
161                 <listitem><para>
162                 <command>LEN</command> - This field should be 0, since <command>eventlogadm</command> will calculate this value.
163                 </para></listitem>
164
165                 <listitem><para>
166                 <command>RS1</command> - This must be the value 1699505740.
167                 </para></listitem>
168
169                 <listitem><para>
170                 <command>RCN</command> -  This field should be 0.
171                 </para></listitem>
172
173                 <listitem><para>
174                 <command>TMG</command> - The time the eventlog record
175                 was generated; format is the number of seconds since
176                 00:00:00 January 1, 1970, UTC.
177                 </para></listitem>
178
179                 <listitem><para>
180                 <command>TMW</command> - The time the eventlog record was
181                 written; format is the number of seconds since 00:00:00
182                 January 1, 1970, UTC.
183                 </para></listitem>
184
185                 <listitem><para>
186                 <command>EID</command> - The eventlog ID.
187                 </para></listitem>
188
189                 <listitem><para>
190                 <command>ETP</command> - The event type -- one of
191                 &quot;INFO&quot;,
192                 &quot;ERROR&quot;, &quot;WARNING&quot;, &quot;AUDIT
193                 SUCCESS&quot; or &quot;AUDIT FAILURE&quot;.
194                 </para></listitem>
195
196                 <listitem><para>
197                 <command>ECT</command> - The event category; this depends
198                 on the message file. It is primarily used as a means of
199                 filtering in the eventlog viewer.
200                 </para></listitem>
201
202                 <listitem><para>
203                 <command>RS2</command> - This field should be 0.
204                 </para></listitem>
205
206                 <listitem><para>
207                 <command>CRN</command> - This field should be 0.
208                 </para></listitem>
209
210                 <listitem><para>
211                 <command>USL</command> - This field should be 0.
212                 </para></listitem>
213
214                 <listitem><para>
215                 <command>SRC</command> - This field contains the source
216                 name associated with the event log. If a message file is
217                 used with an event log, there will be a registry entry
218                 for associating this source name with a message file DLL.
219                 </para></listitem>
220
221                 <listitem><para>
222                 <command>SRN</command> - The name of the machine on
223                 which the eventlog was generated. This is typically the
224                 host name.
225                 </para></listitem>
226
227                 <listitem><para>
228                 <command>STR</command> - The text associated with the
229                 eventlog. There may be more than one string in a record.
230                 </para></listitem>
231
232                 <listitem><para>
233                 <command>DAT</command> - This field should be left unset.
234                 </para></listitem>
235
236         </itemizedlist>
237
238 </refsect1>
239
240 <refsect1>
241         <title>EXAMPLES</title>
242         <para>An example of the record format accepted by <command>eventlogadm</command>:</para>
243
244         <programlisting>
245         LEN: 0
246         RS1: 1699505740
247         RCN: 0
248         TMG: 1128631322
249         TMW: 1128631322
250         EID: 1000
251         ETP: INFO
252         ECT: 0
253         RS2: 0
254         CRN: 0
255         USL: 0
256         SRC: cron
257         SRN: dmlinux
258         STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
259         DAT:
260         </programlisting>
261
262         <para>Set up an eventlog source, specifying a message file DLL:</para>
263         <programlisting>
264         eventlogadm -o addsource Application MyApplication | \\
265                 %SystemRoot%/system32/MyApplication.dll
266         </programlisting>
267
268         <para>Filter messages from the system log into an event log:</para>
269         <programlisting>
270         tail -f /var/log/messages | \\
271                 my_program_to_parse_into_eventlog_records | \\
272                 eventlogadm SystemLogEvents
273         </programlisting>
274
275 </refsect1>
276
277 <refsect1>
278         <title>VERSION</title>
279         <para>This man page is correct for version 3.0.25 of the Samba suite.</para>
280 </refsect1>
281
282 <refsect1>
283         <title>AUTHOR</title>
284
285         <para> The original Samba software and related utilities were
286         created by Andrew Tridgell.  Samba is now developed by the
287         Samba Team as an Open Source project similar to the way the
288         Linux kernel is developed.</para>
289 </refsect1>
290
291 </refentry>