docs-xml/manpages/eventlogadm.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="eventlogadm.8">
   4
   5 <refmeta>
   6         <refentrytitle>eventlogadm</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">4.4</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>eventlogadm</refname>
  16         <refpurpose>push records into the Samba event log store</refpurpose>
  17 </refnamediv>
  18
  19 <refsynopsisdiv>
  20         <cmdsynopsis>
  21
  22                 <command>eventlogadm</command>
  23                 <arg><option>-s</option></arg>
  24                 <arg><option>-d</option></arg>
  25                 <arg><option>-h</option></arg>
  26                 <arg choice="plain"><option>-o</option>
  27                 <literal>addsource</literal>
  28                 <replaceable>EVENTLOG</replaceable>
  29                 <replaceable>SOURCENAME</replaceable>
  30                 <replaceable>MSGFILE</replaceable>
  31                 </arg>
  32
  33         </cmdsynopsis>
  34         <cmdsynopsis>
  35                 <command>eventlogadm</command>
  36                 <arg><option>-s</option></arg>
  37                 <arg><option>-d</option></arg>
  38                 <arg><option>-h</option></arg>
  39                 <arg choice="plain"><option>-o</option>
  40                 <literal>write</literal>
  41                 <replaceable>EVENTLOG</replaceable>
  42                 </arg>
  43
  44         </cmdsynopsis>
  45         <cmdsynopsis>
  46                 <command>eventlogadm</command>
  47                 <arg><option>-s</option></arg>
  48                 <arg><option>-d</option></arg>
  49                 <arg><option>-h</option></arg>
  50                 <arg choice="plain"><option>-o</option>
  51                 <literal>dump</literal>
  52                 <replaceable>EVENTLOG</replaceable>
  53                 <replaceable>RECORD_NUMBER</replaceable>
  54                 </arg>
  55
  56         </cmdsynopsis>
  57
  58 </refsynopsisdiv>
  59
  60 <refsect1>
  61         <title>DESCRIPTION</title>
  62
  63         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  64         <manvolnum>1</manvolnum></citerefentry> suite.</para>
  65
  66         <para><command>eventlogadm</command> is a filter that accepts
  67         formatted event log records on standard input and writes them
  68         to the Samba event log store. Windows client can then manipulate
  69         these record using the usual administration tools.</para>
  70
  71 </refsect1>
  72
  73
  74 <refsect1>
  75         <title>OPTIONS</title>
  76
  77         <variablelist>
  78                 <varlistentry>
  79                 <term>
  80                 <option>-s</option>
  81                 <replaceable>FILENAME</replaceable>
  82                 </term>
  83                 <listitem><para>
  84                 The <command>-s</command> option causes <command>eventlogadm</command> to load the
  85                 configuration file given as FILENAME instead of the default one used by Samba.
  86                 </para></listitem>
  87                 </varlistentry>
  88
  89                 <varlistentry>
  90                 <term><option>-d</option></term>
  91                 <listitem><para>
  92                 The <command>-d</command> option causes <command>eventlogadm</command> to emit debugging
  93                 information.
  94                 </para></listitem>
  95                 </varlistentry>
  96
  97                 <varlistentry>
  98                 <term>
  99                 <option>-o</option>
 100                 <literal>addsource</literal>
 101                 <replaceable>EVENTLOG</replaceable>
 102                 <replaceable>SOURCENAME</replaceable>
 103                 <replaceable>MSGFILE</replaceable>
 104                 </term>
 105                 <listitem><para>
 106                 The <command>-o addsource</command> option creates a
 107                 new event log source.
 108                 </para> </listitem>
 109                 </varlistentry>
 110
 111                 <varlistentry>
 112                 <term>
 113                 <option>-o</option>
 114                 <literal>write</literal>
 115                 <replaceable>EVENTLOG</replaceable>
 116                 </term>
 117                 <listitem><para>
 118                 The <command>-o write</command> reads event log
 119                 records from standard input and writes them to the Samba
 120                 event log store named by EVENTLOG.
 121                 </para> </listitem>
 122                 </varlistentry>
 123
 124                 <varlistentry>
 125                 <term>
 126                 <option>-o</option>
 127                 <literal>dump</literal>
 128                 <replaceable>EVENTLOG</replaceable>
 129                 <replaceable>RECORD_NUMBER</replaceable>
 130                 </term>
 131                 <listitem><para>
 132                 The <command>-o dump</command> reads event log
 133                 records from a EVENTLOG tdb and dumps them to standard
 134                 output on screen.
 135                 </para> </listitem>
 136                 </varlistentry>
 137
 138                 <varlistentry>
 139                 <term><option>-h</option></term>
 140                 <listitem><para>
 141                 Print usage information.
 142                 </para></listitem>
 143                 </varlistentry>
 144
 145         </variablelist>
 146 </refsect1>
 147
 148
 149 <refsect1>
 150         <title>EVENTLOG RECORD FORMAT</title>
 151
 152         <para>For the write operation, <command>eventlogadm</command>
 153         expects to be able to read structured records from standard
 154         input. These records are a sequence of lines, with the record key
 155         and data separated by a colon character. Records are separated
 156         by at least one or more blank line.</para>
 157
 158         <para>The event log record field are:</para>
 159         <itemizedlist>
 160
 161                 <listitem><para>
 162                 <command>LEN</command> - This field should be 0, since <command>eventlogadm</command> will calculate this value.
 163                 </para></listitem>
 164
 165                 <listitem><para>
 166                 <command>RS1</command> - This must be the value 1699505740.
 167                 </para></listitem>
 168
 169                 <listitem><para>
 170                 <command>RCN</command> -  This field should be 0.
 171                 </para></listitem>
 172
 173                 <listitem><para>
 174                 <command>TMG</command> - The time the eventlog record
 175                 was generated; format is the number of seconds since
 176                 00:00:00 January 1, 1970, UTC.
 177                 </para></listitem>
 178
 179                 <listitem><para>
 180                 <command>TMW</command> - The time the eventlog record was
 181                 written; format is the number of seconds since 00:00:00
 182                 January 1, 1970, UTC.
 183                 </para></listitem>
 184
 185                 <listitem><para>
 186                 <command>EID</command> - The eventlog ID.
 187                 </para></listitem>
 188
 189                 <listitem><para>
 190                 <command>ETP</command> - The event type -- one of
 191                 &quot;INFO&quot;,
 192                 &quot;ERROR&quot;, &quot;WARNING&quot;, &quot;AUDIT
 193                 SUCCESS&quot; or &quot;AUDIT FAILURE&quot;.
 194                 </para></listitem>
 195
 196                 <listitem><para>
 197                 <command>ECT</command> - The event category; this depends
 198                 on the message file. It is primarily used as a means of
 199                 filtering in the eventlog viewer.
 200                 </para></listitem>
 201
 202                 <listitem><para>
 203                 <command>RS2</command> - This field should be 0.
 204                 </para></listitem>
 205
 206                 <listitem><para>
 207                 <command>CRN</command> - This field should be 0.
 208                 </para></listitem>
 209
 210                 <listitem><para>
 211                 <command>USL</command> - This field should be 0.
 212                 </para></listitem>
 213
 214                 <listitem><para>
 215                 <command>SRC</command> - This field contains the source
 216                 name associated with the event log. If a message file is
 217                 used with an event log, there will be a registry entry
 218                 for associating this source name with a message file DLL.
 219                 </para></listitem>
 220
 221                 <listitem><para>
 222                 <command>SRN</command> - The name of the machine on
 223                 which the eventlog was generated. This is typically the
 224                 host name.
 225                 </para></listitem>
 226
 227                 <listitem><para>
 228                 <command>STR</command> - The text associated with the
 229                 eventlog. There may be more than one string in a record.
 230                 </para></listitem>
 231
 232                 <listitem><para>
 233                 <command>DAT</command> - This field should be left unset.
 234                 </para></listitem>
 235
 236         </itemizedlist>
 237
 238 </refsect1>
 239
 240 <refsect1>
 241         <title>EXAMPLES</title>
 242         <para>An example of the record format accepted by <command>eventlogadm</command>:</para>
 243
 244         <programlisting>
 245         LEN: 0
 246         RS1: 1699505740
 247         RCN: 0
 248         TMG: 1128631322
 249         TMW: 1128631322
 250         EID: 1000
 251         ETP: INFO
 252         ECT: 0
 253         RS2: 0
 254         CRN: 0
 255         USL: 0
 256         SRC: cron
 257         SRN: dmlinux
 258         STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
 259         DAT:
 260         </programlisting>
 261
 262         <para>Set up an eventlog source, specifying a message file DLL:</para>
 263         <programlisting>
 264         eventlogadm -o addsource Application MyApplication | \\
 265                 %SystemRoot%/system32/MyApplication.dll
 266         </programlisting>
 267
 268         <para>Filter messages from the system log into an event log:</para>
 269         <programlisting>
 270         tail -f /var/log/messages | \\
 271                 my_program_to_parse_into_eventlog_records | \\
 272                 eventlogadm SystemLogEvents
 273         </programlisting>
 274
 275 </refsect1>
 276
 277 <refsect1>
 278         <title>VERSION</title>
 279         <para>This man page is correct for version 3.0.25 of the Samba suite.</para>
 280 </refsect1>
 281
 282 <refsect1>
 283         <title>AUTHOR</title>
 284
 285         <para> The original Samba software and related utilities were
 286         created by Andrew Tridgell.  Samba is now developed by the
 287         Samba Team as an Open Source project similar to the way the
 288         Linux kernel is developed.</para>
 289 </refsect1>
 290
 291 </refentry>