manpages-3/eventlogadm.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="eventlogadm.8">
   4
   5 <refmeta>
   6         <refentrytitle>eventlogadm</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8 </refmeta>
   9
  10
  11 <refnamediv>
  12         <refname>eventlogadm</refname>
  13         <refpurpose>push records into the Samba event log store</refpurpose>
  14 </refnamediv>
  15
  16 <refsynopsisdiv>
  17         <cmdsynopsis>
  18
  19                 <command>eventlogadm</command>
  20                 <arg><option>-d</option></arg>
  21                 <arg><option>-h</option></arg>
  22                 <arg choice="plain"><option>-o</option>
  23                 <literal>addsource</literal>
  24                 <replaceable>EVENTLOG</replaceable>
  25                 <replaceable>SOURCENAME</replaceable>
  26                 <replaceable>MSGFILE</replaceable>
  27                 </arg>
  28
  29         </cmdsynopsis>
  30         <cmdsynopsis>
  31                 <command>eventlogadm</command>
  32                 <arg><option>-d</option></arg>
  33                 <arg><option>-h</option></arg>
  34                 <arg choice="plain"><option>-o</option>
  35                 <literal>write</literal>
  36                 <replaceable>EVENTLOG</replaceable>
  37                 </arg>
  38
  39         </cmdsynopsis>
  40 </refsynopsisdiv>
  41
  42 <refsect1>
  43         <title>DESCRIPTION</title>
  44
  45         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  46         <manvolnum>1</manvolnum></citerefentry> suite.</para>
  47
  48         <para><command>eventlogadm</command> is a filter that accepts
  49         formatted event log records on standard input and writes them
  50         to the Samba event log store. Windows client can then manipulate
  51         these record using the usual administration tools.</para>
  52
  53 </refsect1>
  54
  55
  56 <refsect1>
  57         <title>OPTIONS</title>
  58
  59         <variablelist>
  60
  61                 <varlistentry>
  62                 <term><option>-d</option></term>
  63                 <listitem><para>
  64                 The <command>-d</command> option causes <command>eventlogadm</command> to emit debugging
  65                 information.
  66                 </para></listitem>
  67                 </varlistentry>
  68
  69                 <varlistentry>
  70                 <term>
  71                 <option>-o</option>
  72                 <literal>addsource</literal>
  73                 <replaceable>EVENTLOG</replaceable>
  74                 <replaceable>SOURCENAME</replaceable>
  75                 <replaceable>MSGFILE</replaceable>
  76                 </term>
  77                 <listitem><para>
  78                 The <command>-o addsource</command> option creates a
  79                 new event log source.
  80                 </para> </listitem>
  81                 </varlistentry>
  82
  83                 <varlistentry>
  84                 <term>
  85                 <option>-o</option>
  86                 <literal>write</literal>
  87                 <replaceable>EVENTLOG</replaceable>
  88                 </term>
  89                 <listitem><para>
  90                 The <command>-o write</command> reads event log
  91                 records from standard input and writes them to theSamba
  92                 event log store named by EVENTLOG.
  93                 </para> </listitem>
  94                 </varlistentry>
  95
  96                 <varlistentry>
  97                 <term><option>-h</option></term>
  98                 <listitem><para>
  99                 Print usage information.
 100                 </para></listitem>
 101                 </varlistentry>
 102
 103         </variablelist>
 104 </refsect1>
 105
 106
 107 <refsect1>
 108         <title>EVENTLOG RECORD FORMAT</title>
 109
 110         <para>For the write operation, <command>eventlogadm</command>
 111         expects to be able to read structured records from standard
 112         input. These records are a sequence of lines, with the record key
 113         and data separated by a colon character. Records are separated
 114         by at least one or more blank line.</para>
 115
 116         <para>The event log record field are:</para>
 117         <itemizedlist>
 118
 119                 <listitem><para>
 120                 <command>LEN</command> - This field should be 0, since <command>eventlogadm</command> will calculate this value.
 121                 </para></listitem>
 122
 123                 <listitem><para>
 124                 <command>RS1</command> - This must be the value 1699505740.
 125                 </para></listitem>
 126
 127                 <listitem><para>
 128                 <command>RCN</command> -  This field should be 0.
 129                 </para></listitem>
 130
 131                 <listitem><para>
 132                 <command>TMG</command> - The time the eventlog record
 133                 was generated; format is the number of seconds since
 134                 00:00:00 January 1, 1970, UTC.
 135                 </para></listitem>
 136
 137                 <listitem><para>
 138                 <command>TMW</command> - The time the eventlog record was
 139                 written; format is the number of seconds since 00:00:00
 140                 January 1, 1970, UTC.
 141                 </para></listitem>
 142
 143                 <listitem><para>
 144                 <command>EID</command> - The eventlog ID.
 145                 </para></listitem>
 146
 147                 <listitem><para>
 148                 <command>ETP</command> - The event type -- one of
 149                 &quot;INFO&quot;,
 150                 &quot;ERROR&quot;, &quot;WARNING&quot;, &quot;AUDIT
 151                 SUCCESS&quot; or &quot;AUDIT FAILURE&quot;.
 152                 </para></listitem>
 153
 154                 <listitem><para>
 155                 <command>ECT</command> - The event category; this depends
 156                 on the message file. It is primarily used as a means of
 157                 filtering in the eventlog viewer.
 158                 </para></listitem>
 159
 160                 <listitem><para>
 161                 <command>RS2</command> - This field should be 0.
 162                 </para></listitem>
 163
 164                 <listitem><para>
 165                 <command>CRN</command> - This field should be 0.
 166                 </para></listitem>
 167
 168                 <listitem><para>
 169                 <command>USL</command> - This field should be 0.
 170                 </para></listitem>
 171
 172                 <listitem><para>
 173                 <command>SRC</command> - This field contains the source
 174                 name associated with the event log. If a message file is
 175                 used with an event log, there will be a registry entry
 176                 for associating this source name with a message file DLL.
 177                 </para></listitem>
 178
 179                 <listitem><para>
 180                 <command>SRN</command> - he name of the machine on
 181                 which the eventlog was generated. This is typically the
 182                 host name.
 183                 </para></listitem>
 184
 185                 <listitem><para>
 186                 <command>STR</command> - The text associated with the
 187                 eventlog. There may be more than one string in a record.
 188                 </para></listitem>
 189
 190                 <listitem><para>
 191                 <command>DAT</command> - This field should be left unset.
 192                 </para></listitem>
 193
 194         </itemizedlist>
 195
 196 </refsect1>
 197
 198 <refsect1>
 199         <title>EXAMPLES</title>
 200         <para>An example of the record format accepted by <command>eventlogadm</command>:</para>
 201
 202         <programlisting>
 203         LEN: 0
 204         RS1: 1699505740
 205         RCN: 0
 206         TMG: 1128631322
 207         TMW: 1128631322
 208         EID: 1000
 209         ETP: INFO
 210         ECT: 0
 211         RS2: 0
 212         CRN: 0
 213         USL: 0
 214         SRC: cron
 215         SRN: dmlinux
 216         STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
 217         DAT:
 218         </programlisting>
 219
 220         <para>Set up an eventlog source, specifying a message file DLL:</para>
 221         <programlisting>
 222         eventlogadm -o addsource Application MyApplication | \\
 223                 %SystemRoot%/system32/MyApplication.dll
 224         </programlisting>
 225
 226         <para>Filter messages from the system log into an event log:</para>
 227         <programlisting>
 228         tail -f /var/log/messages | \\
 229                 my_program_to_parse_into_eventlog_records | \\
 230                 eventlogadm SystemLogEvents
 231         </programlisting>
 232
 233 </refsect1>
 234
 235 <refsect1>
 236         <title>VERSION</title>
 237         <para>This man page is correct for version 3.0.25 of the Samba suite.</para>
 238 </refsect1>
 239
 240 <refsect1>
 241         <title>AUTHOR</title>
 242
 243         <para> The original Samba software and related utilities were
 244         created by Andrew Tridgell.  Samba is now developed by the
 245         Samba Team as an Open Source project similar to the way the
 246         Linux kernel is developed.</para>
 247 </refsect1>
 248
 249 </refentry>