]> git.saurik.com Git - apple/syslog.git/blob - util.tproj/syslog.c
projects / apple / syslog.git / blob
? search:


ab2f8657391faa9b32fa1d13d0c81921f2251706
[apple/syslog.git] / util.tproj / syslog.c
1 /*
2 * Copyright (c) 2007-2008 Apple Inc. All rights reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <unistd.h>
27 #include <ctype.h>
28 #include <time.h>
29 #include <string.h>
30 #include <errno.h>
31 #include <dirent.h>
32 #include <fcntl.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
35 #include <netinet/in.h>
36 #include <arpa/inet.h>
37 #include <mach/mach.h>
38 #include <servers/bootstrap.h>
39 #include <netdb.h>
40 #include <notify.h>
41 #include <asl.h>
42 #include <asl_private.h>
43 #include <asl_ipc.h>
44 #include <asl_core.h>
45 #include <asl_store.h>
46 #include <asl_file.h>
47
48 #define MOD_CASE_FOLD 'C'
49 #define MOD_REGEX 'R'
50 #define MOD_SUBSTRING 'S'
51 #define MOD_PREFIX 'A'
52 #define MOD_SUFFIX 'Z'
53 #define MOD_NUMERIC 'N'
54
55 #define OP_EQ "eq"
56 #define OP_NE "ne"
57 #define OP_GT "gt"
58 #define OP_GE "ge"
59 #define OP_LT "lt"
60 #define OP_LE "le"
61
62 #define ASL_QUERY_OP_NOT 0x1000
63
64 #define QUERY_FLAG_SEARCH_REVERSE 0x00000001
65
66 #define FACILITY_CONSOLE "com.apple.console"
67
68 #define SEARCH_EOF -1
69 #define SEARCH_NULL 0
70 #define SEARCH_MATCH 1
71
72 #define PROC_NOT_FOUND -1
73 #define PROC_NOT_UNIQUE -2
74
75 #define RC_MASTER -1
76 #define RC_SYSLOGD -2
77
78 #define CHUNK 64
79 #define forever for(;;)
80
81 #define SEND_FORMAT_LEGACY 0
82 #define SEND_FORMAT_ASL 1
83
84 #define TIME_SEC 0x00000010
85 #define TIME_UTC 0x00000020
86 #define TIME_LCL 0x00000040
87
88 #define FORMAT_RAW 0x00000100
89 #define FORMAT_LEGACY 0x00000200
90 #define FORMAT_STD 0x00000400
91 #define FORMAT_XML 0x00000800
92
93 #define EXPORT 0x00000100
94
95 #define ASL_FILTER_MASK_PACEWNID 0xff
96 #define ASL_FILTER_MASK_PACEWNI 0x7f
97 #define ASL_FILTER_MASK_PACEWN 0x3f
98 #define ASL_FILTER_MASK_PACEW 0x1f
99 #define ASL_FILTER_MASK_PACE 0x0f
100 #define ASL_FILTER_MASK_PAC 0x07
101
102 #define FETCH_BATCH 1024
103
104 #define DB_SELECT_STORE 0
105 #define DB_SELECT_FILES 1
106 #define DB_SELECT_SYSLOGD 2
107 #define DB_SELECT_LEGACY 3
108
109 static asl_file_list_t *db_files = NULL;
110 static asl_store_t *store = NULL;
111 static asl_file_t *legacy = NULL;
112 static uint32_t dbselect = DB_SELECT_STORE;
113 static asl_file_t *export = NULL;
114
115 /* notify SPI */
116 uint32_t notify_register_plain(const char *name, int *out_token);
117
118 extern char *asl_msg_to_string(aslmsg msg, uint32_t *len);
119 extern asl_msg_t *asl_msg_from_string(const char *buf);
120 extern char *asl_list_to_string(asl_search_result_t *list, uint32_t *outlen);
121 extern asl_search_result_t *asl_list_from_string(const char *buf);
122 extern int asl_msg_cmp(asl_msg_t *a, asl_msg_t *b);
123 extern time_t asl_parse_time(const char *in);
124 /* END PRIVATE API */
125
126 #define ASL_SERVICE_NAME "com.apple.system.logger"
127 static mach_port_t asl_server_port = MACH_PORT_NULL;
128
129 static const char *myname = "syslog";
130
131 void
132 usage()
133 {
134 fprintf(stderr, "usage:\n");
135 fprintf(stderr, "%s -s [-r host] [-l level] message...\n", myname);
136 fprintf(stderr, " send a message\n");
137 fprintf(stderr, "\n");
138 fprintf(stderr, "%s -s [-r host] -k key val [key val]...\n", myname);
139 fprintf(stderr, " send a message with the given keys and values\n");
140 fprintf(stderr, "\n");
141 fprintf(stderr, "%s -c process [filter]\n", myname);
142 fprintf(stderr, " get (set if filter is specified) syslog filter for process (pid or name)\n");
143 fprintf(stderr, " level may be any combination of the characters \"p a c e w n i d\"\n");
144 fprintf(stderr, " p = Emergency (\"Panic\")\n");
145 fprintf(stderr, " a = Alert\n");
146 fprintf(stderr, " c = Critical\n");
147 fprintf(stderr, " e = Error\n");
148 fprintf(stderr, " w = Warning\n");
149 fprintf(stderr, " n = Notice\n");
150 fprintf(stderr, " i = Info\n");
151 fprintf(stderr, " d = Debug\n");
152 fprintf(stderr, " a minus sign preceeding a single letter means \"up to\" that level\n");
153 fprintf(stderr, "\n");
154 fprintf(stderr, "%s [-f file...] [-d path...] [-x file] [-w [N]] [-F format] [-u] [-k key [[op] val]]... [-o -k key [[op] val]] ...]...\n", myname);
155 fprintf(stderr, " -f read named file[s], rather than standard log message store.\n");
156 fprintf(stderr, " -d read all file in named directory path, rather than standard log message store.\n");
157 fprintf(stderr, " -x export to named ASL format file, rather than printing\n");
158 fprintf(stderr, " -w watch data store (^C to quit)\n");
159 fprintf(stderr, " prints the last N matching lines (default 10) before waiting\n");
160 fprintf(stderr, " \"-w 0\" prints all matching lines before waiting\n");
161 fprintf(stderr, " -F output format may be \"std\", \"raw\", \"bsd\", or \"xml\"\n");
162 fprintf(stderr, " format may also be a string containing variables of the form\n");
163 fprintf(stderr, " $Key or $(Key) - use the latter for non-whitespace delimited variables\n");
164 fprintf(stderr, " -T timestamp format may be \"sec\" (seconds), \"utc\" (UTC), or \"local\" (local timezone)\n");
165 fprintf(stderr, " -E text encoding may be \"vis\", \"safe\", or \"none\"\n");
166 fprintf(stderr, " -u print timestamps using UTC (equivalent to \"-T utc\")\n");
167 fprintf(stderr, " -k key/value match\n");
168 fprintf(stderr, " if no operator or value is given, checks for the existance of the key\n");
169 fprintf(stderr, " if no operator is given, default is \"%s\"\n", OP_EQ);
170 fprintf(stderr, " -C alias for \"-k Facility com.apple.console\"\n");
171 fprintf(stderr, " -o begins a new query\n");
172 fprintf(stderr, " queries are \'OR\'ed together\n");
173 fprintf(stderr, "operators are zero or more modifiers followed by a comparison\n");
174 fprintf(stderr, " %s equal\n", OP_EQ);
175 fprintf(stderr, " %s not equal\n", OP_NE);
176 fprintf(stderr, " %s greater than\n", OP_GT);
177 fprintf(stderr, " %s greater or equal\n", OP_GE);
178 fprintf(stderr, " %s less than\n", OP_LT);
179 fprintf(stderr, " %s less or equal\n", OP_LE);
180 fprintf(stderr, "optional modifiers for operators\n");
181 fprintf(stderr, " %c case-fold\n", MOD_CASE_FOLD);
182 fprintf(stderr, " %c regular expression\n", MOD_REGEX);
183 fprintf(stderr, " %c substring\n", MOD_SUBSTRING);
184 fprintf(stderr, " %c prefix\n", MOD_PREFIX);
185 fprintf(stderr, " %c suffix\n", MOD_SUFFIX);
186 fprintf(stderr, " %c numeric comparison\n", MOD_NUMERIC);
187 }
188
189 const char *
190 notify_status_string(int status)
191 {
192 if (status == NOTIFY_STATUS_OK) return "OK";
193 if (status == NOTIFY_STATUS_INVALID_NAME) return "Process not registered";
194 if (status == NOTIFY_STATUS_NOT_AUTHORIZED) return "Not authorized";
195 return "Operation failed";
196 }
197
198 const char *
199 asl_level_string(int level)
200 {
201 if (level == ASL_LEVEL_EMERG) return ASL_STRING_EMERG;
202 if (level == ASL_LEVEL_ALERT) return ASL_STRING_ALERT;
203 if (level == ASL_LEVEL_CRIT) return ASL_STRING_CRIT;
204 if (level == ASL_LEVEL_ERR) return ASL_STRING_ERR;
205 if (level == ASL_LEVEL_WARNING) return ASL_STRING_WARNING;
206 if (level == ASL_LEVEL_NOTICE) return ASL_STRING_NOTICE;
207 if (level == ASL_LEVEL_INFO) return ASL_STRING_INFO;
208 if (level == ASL_LEVEL_DEBUG) return ASL_STRING_DEBUG;
209 return "Unknown";
210 }
211
212 int
213 procinfo(char *pname, int *pid, int *uid)
214 {
215 int mib[4];
216 int i, status, nprocs;
217 size_t miblen, size;
218 struct kinfo_proc *procs, *newprocs;
219
220 size = 0;
221 procs = NULL;
222
223 mib[0] = CTL_KERN;
224 mib[1] = KERN_PROC;
225 mib[2] = KERN_PROC_ALL;
226 mib[3] = 0;
227 miblen = 3;
228
229 status = sysctl(mib, miblen, NULL, &size, NULL, 0);
230 do
231 {
232 size += size / 10;
233 newprocs = reallocf(procs, size);
234 if (newprocs == NULL)
235 {
236 if (procs != NULL) free(procs);
237 return PROC_NOT_FOUND;
238 }
239
240 procs = newprocs;
241 status = sysctl(mib, miblen, procs, &size, NULL, 0);
242 } while ((status == -1) && (errno == ENOMEM));
243
244 if (status == -1)
245 {
246 if (procs != NULL) free(procs);
247 return PROC_NOT_FOUND;
248 }
249
250 if (size % sizeof(struct kinfo_proc) != 0)
251 {
252 if (procs != NULL) free(procs);
253 return PROC_NOT_FOUND;
254 }
255
256 if (procs == NULL) return PROC_NOT_FOUND;
257
258 nprocs = size / sizeof(struct kinfo_proc);
259
260 if (pname == NULL)
261 {
262 /* Search for a pid */
263 for (i = 0; i < nprocs; i++)
264 {
265 if (*pid == procs[i].kp_proc.p_pid)
266 {
267 *uid = procs[i].kp_eproc.e_ucred.cr_uid;
268 return 0;
269 }
270 }
271
272 return PROC_NOT_FOUND;
273 }
274
275 *pid = PROC_NOT_FOUND;
276
277 for (i = 0; i < nprocs; i++)
278 {
279 if (!strcmp(procs[i].kp_proc.p_comm, pname))
280 {
281 if (*pid != PROC_NOT_FOUND)
282 {
283 free(procs);
284 return PROC_NOT_UNIQUE;
285 }
286
287 *pid = procs[i].kp_proc.p_pid;
288 *uid = procs[i].kp_eproc.e_ucred.cr_uid;
289 }
290 }
291
292 free(procs);
293 if (*pid == PROC_NOT_FOUND) return PROC_NOT_FOUND;
294
295 return 0;
296 }
297
298 int
299 rcontrol_get_string(const char *prefix, int pid, int *val)
300 {
301 int t, status;
302 char *name;
303 uint64_t x;
304
305 status = NOTIFY_STATUS_OK;
306
307 if (pid == RC_SYSLOGD)
308 {
309 status = notify_register_plain(NOTIFY_SYSTEM_ASL_FILTER, &t);
310 }
311 else if (pid == RC_MASTER)
312 {
313 status = notify_register_plain(NOTIFY_SYSTEM_MASTER, &t);
314 }
315 else
316 {
317 name = NULL;
318 asprintf(&name, "%s.%d", prefix, pid);
319 if (name == NULL) return NOTIFY_STATUS_FAILED;
320
321 status = notify_register_plain(name, &t);
322 free(name);
323 }
324
325 if (status != NOTIFY_STATUS_OK) return status;
326
327 x = 0;
328 status = notify_get_state(t, &x);
329 notify_cancel(t);
330
331 *val = x;
332
333 return status;
334 }
335
336 int
337 rcontrol_set_string(const char *prefix, int pid, int filter)
338 {
339 int t, status;
340 char *name;
341 uint64_t x;
342
343 status = NOTIFY_STATUS_OK;
344
345 if (pid == RC_SYSLOGD)
346 {
347 status = notify_register_plain(NOTIFY_SYSTEM_ASL_FILTER, &t);
348 }
349 else if (pid == RC_MASTER)
350 {
351 status = notify_register_plain(NOTIFY_SYSTEM_MASTER, &t);
352 }
353 else
354 {
355 name = NULL;
356 asprintf(&name, "%s.%d", prefix, pid);
357 if (name == NULL) return NOTIFY_STATUS_FAILED;
358
359 status = notify_register_plain(name, &t);
360 free(name);
361 }
362
363 if (status != NOTIFY_STATUS_OK) return status;
364
365 x = filter;
366 status = notify_set_state(t, x);
367 if ((pid == RC_SYSLOGD) && (status == NOTIFY_STATUS_OK)) status = notify_post(NOTIFY_SYSTEM_ASL_FILTER);
368 notify_cancel(t);
369 return status;
370 }
371
372 int
373 asl_string_to_filter(char *s)
374 {
375 int f, i;
376
377 if (s == NULL) return 0;
378 if (s[0] == '\0') return 0;
379
380 if ((s[0] >= '0') && (s[0] <= '9')) return ASL_FILTER_MASK(atoi(s));
381
382 if (s[0] == '-')
383 {
384 if ((s[1] == 'P') || (s[1] == 'p')) i = ASL_LEVEL_EMERG;
385 else if ((s[1] == 'A') || (s[1] == 'a')) i = ASL_LEVEL_ALERT;
386 else if ((s[1] == 'C') || (s[1] == 'c')) i = ASL_LEVEL_CRIT;
387 else if ((s[1] == 'E') || (s[1] == 'e')) i = ASL_LEVEL_ERR;
388 else if ((s[1] == 'X') || (s[1] == 'x')) i = ASL_LEVEL_ERR;
389 else if ((s[1] == 'W') || (s[1] == 'w')) i = ASL_LEVEL_WARNING;
390 else if ((s[1] == 'N') || (s[1] == 'n')) i = ASL_LEVEL_NOTICE;
391 else if ((s[1] == 'I') || (s[1] == 'i')) i = ASL_LEVEL_INFO;
392 else if ((s[1] == 'D') || (s[1] == 'd')) i = ASL_LEVEL_DEBUG;
393 else i = atoi(s + 1);
394 f = ASL_FILTER_MASK_UPTO(i);
395 return f;
396 }
397
398 f = 0;
399 for (i = 0; s[i] != '\0'; i++)
400 {
401 if ((s[i] == 'P') || (s[i] == 'p')) f |= ASL_FILTER_MASK_EMERG;
402 else if ((s[i] == 'A') || (s[i] == 'a')) f |= ASL_FILTER_MASK_ALERT;
403 else if ((s[i] == 'C') || (s[i] == 'c')) f |= ASL_FILTER_MASK_CRIT;
404 else if ((s[i] == 'E') || (s[i] == 'e')) f |= ASL_FILTER_MASK_ERR;
405 else if ((s[i] == 'X') || (s[i] == 'x')) f |= ASL_FILTER_MASK_ERR;
406 else if ((s[i] == 'W') || (s[i] == 'w')) f |= ASL_FILTER_MASK_WARNING;
407 else if ((s[i] == 'N') || (s[i] == 'n')) f |= ASL_FILTER_MASK_NOTICE;
408 else if ((s[i] == 'I') || (s[i] == 'i')) f |= ASL_FILTER_MASK_INFO;
409 else if ((s[i] == 'D') || (s[i] == 'd')) f |= ASL_FILTER_MASK_DEBUG;
410 }
411
412 return f;
413 }
414
415 char *
416 asl_filter_string(int f)
417 {
418 static char str[1024];
419 int i;
420
421 memset(str, 0, sizeof(str));
422 i = 0;
423
424 if ((f == ASL_FILTER_MASK_PACEWNID) != 0)
425 {
426 strcat(str, "Emergency - Debug");
427 return str;
428 }
429
430 if ((f == ASL_FILTER_MASK_PACEWNI) != 0)
431 {
432 strcat(str, "Emergency - Info");
433 return str;
434 }
435
436 if ((f == ASL_FILTER_MASK_PACEWN) != 0)
437 {
438 strcat(str, "Emergency - Notice");
439 return str;
440 }
441
442 if ((f == ASL_FILTER_MASK_PACEW) != 0)
443 {
444 strcat(str, "Emergency - Warning");
445 return str;
446 }
447
448 if ((f == ASL_FILTER_MASK_PACE) != 0)
449 {
450 strcat(str, "Emergency - Error");
451 return str;
452 }
453
454 if ((f == ASL_FILTER_MASK_PAC) != 0)
455 {
456 strcat(str, "Emergency - Critical");
457 return str;
458 }
459
460 if ((f & ASL_FILTER_MASK_EMERG) != 0)
461 {
462 strcat(str, "Emergency");
463 i++;
464 }
465
466 if ((f & ASL_FILTER_MASK_ALERT) != 0)
467 {
468 if (i > 0) strcat(str, ", ");
469 strcat(str, "Alert");
470 i++;
471 }
472
473 if ((f & ASL_FILTER_MASK_CRIT) != 0)
474 {
475 if (i > 0) strcat(str, ", ");
476 strcat(str, "Critical");
477 i++;
478 }
479
480 if ((f & ASL_FILTER_MASK_ERR) != 0)
481 {
482 if (i > 0) strcat(str, ", ");
483 strcat(str, "Error");
484 i++;
485 }
486
487 if ((f & ASL_FILTER_MASK_WARNING) != 0)
488 {
489 if (i > 0) strcat(str, ", ");
490 strcat(str, "Warning");
491 i++;
492 }
493
494 if ((f & ASL_FILTER_MASK_NOTICE) != 0)
495 {
496 if (i > 0) strcat(str, ", ");
497 strcat(str, "Notice");
498 i++;
499 }
500
501 if ((f & ASL_FILTER_MASK_INFO) != 0)
502 {
503 if (i > 0) strcat(str, ", ");
504 strcat(str, "Info");
505 i++;
506 }
507
508 if ((f & ASL_FILTER_MASK_DEBUG) != 0)
509 {
510 if (i > 0) strcat(str, ", ");
511 strcat(str, "Debug");
512 i++;
513 }
514
515 if (i == 0) sprintf(str, "Off");
516
517 return str;
518 }
519
520 int
521 rcontrol_get(const char *prefix, int pid)
522 {
523 int filter, status;
524 const char *name;
525
526 filter = 0;
527
528 if (pid < 0)
529 {
530 name = "Master";
531 if (pid == RC_SYSLOGD) name = "ASL Data Store";
532
533 status = rcontrol_get_string(NULL, pid, &filter);
534 if (status == NOTIFY_STATUS_OK)
535 {
536 printf("%s filter mask: %s\n", name, asl_filter_string(filter));
537 return 0;
538 }
539
540 printf("Unable to determine %s filter mask\n", name);
541 return -1;
542 }
543
544 status = rcontrol_get_string(prefix, pid, &filter);
545 if (status == NOTIFY_STATUS_OK)
546 {
547 printf("Process %d syslog filter mask: %s\n", pid, asl_filter_string(filter));
548 return 0;
549 }
550
551 printf("Unable to determine syslog filter mask for pid %d\n", pid);
552 return -1;
553 }
554
555 int
556 rcontrol_set(const char *prefix, int pid, int filter)
557 {
558 int status;
559 const char *name;
560
561 if (pid < 0)
562 {
563 name = "Master";
564 if (pid == RC_SYSLOGD) name = "ASL Data Store";
565 status = rcontrol_set_string(NULL, pid, filter);
566
567 if (status == NOTIFY_STATUS_OK)
568 {
569 printf("Set %s syslog filter mask: %s\n", name, asl_filter_string(filter));
570 return 0;
571 }
572
573 printf("Unable to set %s syslog filter mask: %s\n", name, notify_status_string(status));
574 return -1;
575 }
576
577 status = rcontrol_set_string(prefix, pid, filter);
578 if (status == NOTIFY_STATUS_OK)
579 {
580 printf("Set process %d syslog filter mask set: %s\n", pid, asl_filter_string(filter));
581 return 0;
582 }
583
584 printf("Unable to set syslog filter mask for pid %d: %s\n", pid, notify_status_string(status));
585 return -1;
586 }
587
588 int
589 rsend(aslmsg msg, char *rhost)
590 {
591 char *str, *out;
592 uint32_t len, level;
593 char *timestr;
594 const char *val;
595 time_t tick;
596 struct tm gtime;
597 int s;
598 struct sockaddr_in dst;
599 struct hostent *h;
600 char myname[MAXHOSTNAMELEN + 1];
601
602 if (msg == NULL) return 0;
603
604 h = gethostbyname(rhost);
605 if (h == NULL) return -1;
606
607 s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
608 if (s <= 0) return -1;
609
610 memset(&dst, 0, sizeof(struct sockaddr_in));
611 memcpy(&(dst.sin_addr.s_addr), h->h_addr_list[0], 4);
612 dst.sin_family = AF_INET;
613 dst.sin_port = 514;
614 dst.sin_len = sizeof(struct sockaddr_in);
615
616 level = ASL_LEVEL_DEBUG;
617
618 val = asl_get(msg, ASL_KEY_LEVEL);
619 if (val != NULL) level = atoi(val);
620
621 memset(&gtime, 0, sizeof(struct tm));
622 timestr = NULL;
623
624 tick = time(NULL);
625 gmtime_r(&tick, &gtime);
626
627 /* Canonical form: YYYY.MM.DD hh:mm:ss UTC */
628 asprintf(&timestr, "%d.%02d.%02d %02d:%02d:%02d UTC", gtime.tm_year + 1900, gtime.tm_mon + 1, gtime.tm_mday, gtime.tm_hour, gtime.tm_min, gtime.tm_sec);
629
630 if (timestr != NULL)
631 {
632 asl_set(msg, ASL_KEY_TIME, timestr);
633 free(timestr);
634 }
635
636 if (gethostname(myname, MAXHOSTNAMELEN) == 0) asl_set(msg, ASL_KEY_HOST, myname);
637
638 len = 0;
639 str = asl_msg_to_string(msg, &len);
640 if (str == NULL) return -1;
641
642 asprintf(&out, "%10u %s\n", len+1, str);
643 free(str);
644 if (out == NULL) return -1;
645
646 sendto(s, out, len+12, 0, (const struct sockaddr *)&dst, sizeof(struct sockaddr_in));
647
648 free(out);
649 close(s);
650 return 0;
651 }
652
653 int
654 rlegacy(char *msg, int level, char *rhost)
655 {
656 char *out;
657 uint32_t len;
658 time_t tick;
659 char *ltime;
660 int s;
661 struct sockaddr_in dst;
662 struct hostent *h;
663 char myname[MAXHOSTNAMELEN + 1];
664
665 if (msg == NULL) return 0;
666
667 h = gethostbyname(rhost);
668 if (h == NULL) return -1;
669
670 s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
671 if (s <= 0) return -1;
672
673 memset(&dst, 0, sizeof(struct sockaddr_in));
674 memcpy(&(dst.sin_addr.s_addr), h->h_addr_list[0], 4);
675 dst.sin_family = AF_INET;
676 dst.sin_port = 514;
677 dst.sin_len = sizeof(struct sockaddr_in);
678
679 tick = time(NULL);
680 ltime = ctime(&tick);
681 ltime[19] = '\0';
682
683 gethostname(myname, MAXHOSTNAMELEN);
684
685 asprintf(&out, "<%d>%s %s syslog[%d]: %s", level, ltime+4, myname, getpid(), msg);
686 len = strlen(out);
687 sendto(s, out, len, 0, (const struct sockaddr *)&dst, sizeof(struct sockaddr_in));
688
689 free(out);
690 close(s);
691 return 0;
692 }
693
694 static int
695 _isanumber(char *s)
696 {
697 int i;
698
699 if (s == NULL) return 0;
700
701 i = 0;
702 if ((s[0] == '-') || (s[0] == '+')) i = 1;
703
704 if (s[i] == '\0') return 0;
705
706 for (; s[i] != '\0'; i++)
707 {
708 if (!isdigit(s[i])) return 0;
709 }
710
711 return 1;
712 }
713
714 int
715 asl_string_to_level(const char *s)
716 {
717 if (s == NULL) return -1;
718
719 if ((s[0] >= '0') && (s[0] <= '7') && (s[1] == '\0')) return atoi(s);
720
721 if (!strncasecmp(s, "em", 2)) return ASL_LEVEL_EMERG;
722 else if (!strncasecmp(s, "p", 1)) return ASL_LEVEL_EMERG;
723 else if (!strncasecmp(s, "a", 1)) return ASL_LEVEL_ALERT;
724 else if (!strncasecmp(s, "c", 1)) return ASL_LEVEL_CRIT;
725 else if (!strncasecmp(s, "er", 2)) return ASL_LEVEL_ERR;
726 else if (!strncasecmp(s, "x", 1)) return ASL_LEVEL_ERR;
727 else if (!strncasecmp(s, "w", 1)) return ASL_LEVEL_WARNING;
728 else if (!strncasecmp(s, "n", 1)) return ASL_LEVEL_NOTICE;
729 else if (!strncasecmp(s, "i", 1)) return ASL_LEVEL_INFO;
730 else if (!strncasecmp(s, "d", 1)) return ASL_LEVEL_DEBUG;
731
732 return -1;
733 }
734
735 int
736 syslog_remote_control(int argc, char *argv[])
737 {
738 int pid, uid, status, mask;
739 const char *prefix;
740
741 if ((argc < 3) || (argc > 4))
742 {
743 fprintf(stderr, "usage:\n");
744 fprintf(stderr, "%s -c process [mask]\n", myname);
745 fprintf(stderr, " get (set if mask is specified) syslog filter mask for process (pid or name)\n");
746 fprintf(stderr, " process may be pid or process name\n");
747 fprintf(stderr, " use \"-c 0\" to get master syslog filter mask\n");
748 fprintf(stderr, " use \"-c 0 off\" to disable master syslog filter mask\n");
749 fprintf(stderr, "\n");
750 return -1;
751 }
752
753 pid = RC_MASTER;
754 uid = -2;
755
756 status = PROC_NOT_FOUND;
757
758 if ((!strcmp(argv[2], "syslogd")) || (!strcmp(argv[2], "syslog")))
759 {
760 pid = RC_SYSLOGD;
761 uid = 0;
762 status = 0;
763 }
764 else if (_isanumber(argv[2]) != 0)
765 {
766 pid = atoi(argv[2]);
767 status = procinfo(NULL, &pid, &uid);
768 }
769 else
770 {
771 status = procinfo(argv[2], &pid, &uid);
772 }
773
774 if (status == PROC_NOT_FOUND)
775 {
776 fprintf(stderr, "%s: process not found\n", argv[2]);
777 return -1;
778 }
779
780 if (status == PROC_NOT_UNIQUE)
781 {
782 fprintf(stderr, "%s: multiple processes found\n", argv[2]);
783 fprintf(stderr, "use pid to identify a process uniquely\n");
784 return -1;
785 }
786
787 if (pid == 0) pid = RC_MASTER;
788
789 prefix = NOTIFY_PREFIX_USER;
790 if (uid == 0) prefix = NOTIFY_PREFIX_SYSTEM;
791
792 if (argc == 4)
793 {
794 if ((pid == RC_MASTER) && (!strcasecmp(argv[3], "off"))) mask = 0;
795 else if ((pid == RC_SYSLOGD) && (!strcasecmp(argv[3], "off"))) mask = 0;
796 else
797 {
798 mask = asl_string_to_filter(argv[3]);
799 if (mask < 0)
800 {
801 printf("unknown syslog mask: %s\n", argv[3]);
802 return -1;
803 }
804 }
805
806 rcontrol_set(prefix, pid, mask);
807 }
808 else
809 {
810 rcontrol_get(prefix, pid);
811 }
812
813 return 0;
814 }
815
816 int
817 syslog_send(int argc, char *argv[])
818 {
819 int i, start, kv, len, rfmt, rlevel, filter, status;
820 aslclient asl;
821 aslmsg m;
822 char tmp[64], *str, *rhost;
823
824 kv = 0;
825 rhost = NULL;
826 rfmt = SEND_FORMAT_LEGACY;
827 start = 1;
828 rlevel = 7;
829
830 for (i = 1; i < argc; i++)
831 {
832 if (!strcmp(argv[i], "-s")) start = i+1;
833 else if (!strcmp(argv[i], "-k"))
834 {
835 kv = 1;
836 rfmt = SEND_FORMAT_ASL;
837 }
838 else if (!strcmp(argv[i], "-r"))
839 {
840 rhost = argv[++i];
841 start = i+1;
842 }
843 else if (!strcmp(argv[i], "-l"))
844 {
845 rlevel = asl_string_to_level(argv[++i]);
846 if (rlevel < 0)
847 {
848 fprintf(stderr, "Unknown level: %s\n", argv[i]);
849 return(-1);
850 }
851 start = i+1;
852 }
853 }
854
855 asl = asl_open(myname, "syslog", 0);
856 asl_set_filter(asl, ASL_FILTER_MASK_UPTO(ASL_LEVEL_DEBUG));
857
858 m = asl_new(ASL_TYPE_MSG);
859 asl_set(m, ASL_KEY_SENDER, myname);
860
861 sprintf(tmp, "%d", rlevel);
862 asl_set(m, ASL_KEY_LEVEL, tmp);
863
864 str = NULL;
865
866 if (kv == 0)
867 {
868 len = 0;
869 for (i = start; i < argc; i++) len += (strlen(argv[i]) + 1);
870 str = calloc(len + 1, 1);
871 if (str == NULL) return -1;
872
873 for (i = start; i < argc; i++)
874 {
875 strcat(str, argv[i]);
876 if ((i+1) < argc) strcat(str, " ");
877 }
878 asl_set(m, ASL_KEY_MSG, str);
879 }
880 else
881 {
882 for (i = start + 1; i < argc; i += 2)
883 {
884 if (!strcmp(argv[i], "-k")) i++;
885 asl_set(m, argv[i], argv[i + 1]);
886 if (!strcmp(argv[i], ASL_KEY_LEVEL)) rlevel = atoi(argv[i + 1]);
887 }
888 }
889
890 if (rhost == NULL)
891 {
892 filter = 0;
893 status = rcontrol_get_string(NULL, RC_SYSLOGD, &filter);
894 if (status != 0)
895 {
896 fprintf(stderr, "Warning: Can't get current syslogd ASL filter value\n");
897 }
898 else if ((ASL_FILTER_MASK(rlevel) & filter) == 0)
899 {
900 fprintf(stderr, "Warning: The current syslogd ASL filter value (%s)\n", asl_filter_string(filter));
901 fprintf(stderr, " will exclude this message from the ASL database\n");
902 }
903
904 asl_send(asl, m);
905 }
906 else if (rfmt == SEND_FORMAT_ASL)
907 {
908 rsend(m, rhost);
909 }
910 else if ((rfmt == SEND_FORMAT_LEGACY) && (str != NULL))
911 {
912 rlegacy(str, rlevel, rhost);
913 }
914
915 asl_free(m);
916
917 if (str != NULL) free(str);
918
919 asl_close(asl);
920
921 return 0;
922 }
923
924 static void
925 print_xml_header(FILE *f)
926 {
927 if (f == NULL) return;
928
929 fprintf(f, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
930 fprintf(f, "<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n");
931 fprintf(f, "<plist version=\"1.0\">\n");
932 fprintf(f, "<array>\n");
933 }
934
935 static void
936 print_xml_trailer(FILE *f)
937 {
938 if (f == NULL) return;
939
940 fprintf(f, "</array>\n");
941 fprintf(f, "</plist>\n");
942 }
943
944 static void
945 printmsg(FILE *f, asl_msg_t *msg, char *fmt, int pflags)
946 {
947 char *str;
948 const char *mf, *tf;
949 uint32_t encode, len, status;
950 uint64_t xid;
951
952 if (f == NULL)
953 {
954 if (export != NULL)
955 {
956 xid = 0;
957 status = asl_file_save(export, msg, &xid);
958 if (status != ASL_STATUS_OK)
959 {
960 fprintf(stderr, "export file write failed: %s\n", asl_core_error(status));
961 asl_file_close(export);
962 export = NULL;
963 }
964 }
965
966 return;
967 }
968
969 encode = pflags & 0x0000000f;
970
971 mf = ASL_MSG_FMT_RAW;
972 if (fmt != NULL) mf = (const char *)fmt;
973 else if (pflags & FORMAT_STD) mf = ASL_MSG_FMT_STD;
974 else if (pflags & FORMAT_LEGACY) mf = ASL_MSG_FMT_BSD;
975 else if (pflags & FORMAT_XML) mf = ASL_MSG_FMT_XML;
976
977 tf = ASL_TIME_FMT_SEC;
978 if (pflags & TIME_UTC) tf = ASL_TIME_FMT_UTC;
979 if (pflags & TIME_LCL) tf = ASL_TIME_FMT_LCL;
980
981 len = 0;
982 str = asl_format_message(msg, mf, tf, encode, &len);
983 if (str != NULL)
984 {
985 fprintf(f, "%s", str);
986 free(str);
987 }
988 }
989
990 asl_search_result_t *
991 store_query(asl_search_result_t *q, uint64_t start, int count, int dir, uint64_t *last)
992 {
993 uint32_t status;
994 asl_search_result_t *res;
995
996 if (store == NULL)
997 {
998 status = asl_store_open_read(NULL, &store);
999 if (status != 0) return NULL;
1000 }
1001
1002 res = NULL;
1003 status = asl_store_match(store, q, &res, last, start, count, dir);
1004 if (status != 0) return NULL;
1005
1006 return res;
1007 }
1008
1009 asl_search_result_t *
1010 file_query(asl_search_result_t *q, uint64_t start, int count, int dir, uint64_t *last)
1011 {
1012 uint32_t status;
1013 asl_search_result_t *res;
1014
1015 res = NULL;
1016 status = asl_file_list_match(db_files, q, &res, last, start, count, dir);
1017 if (status != 0) return NULL;
1018
1019 return res;
1020 }
1021
1022 asl_search_result_t *
1023 legacy_query(asl_search_result_t *q, uint64_t start, int count, int dir, uint64_t *last)
1024 {
1025 uint32_t status;
1026 asl_search_result_t *res;
1027
1028 res = NULL;
1029 status = asl_file_match(legacy, q, &res, last, start, count, dir);
1030 if (status != 0) return NULL;
1031
1032 return res;
1033 }
1034
1035 asl_search_result_t *
1036 syslogd_query(asl_search_result_t *q, uint64_t start, int count, int dir, uint64_t *last)
1037 {
1038 char *str, *res;
1039 caddr_t vmstr;
1040 uint32_t len, reslen, status;
1041 int flags;
1042 kern_return_t kstatus;
1043 security_token_t sec;
1044 asl_search_result_t *l;
1045
1046 if (asl_server_port == MACH_PORT_NULL)
1047 {
1048 kstatus = bootstrap_look_up(bootstrap_port, ASL_SERVICE_NAME, &asl_server_port);
1049 if (kstatus != KERN_SUCCESS)
1050 {
1051 fprintf(stderr, "query failed: can't contact syslogd\n");
1052 return NULL;
1053 }
1054 }
1055
1056 len = 0;
1057 str = asl_list_to_string(q, &len);
1058
1059 kstatus = vm_allocate(mach_task_self(), (vm_address_t *)&vmstr, len, TRUE);
1060 if (kstatus != KERN_SUCCESS)
1061 {
1062 free(str);
1063 return NULL;
1064 }
1065
1066 memmove(vmstr, str, len);
1067 free(str);
1068
1069 res = NULL;
1070 reslen = 0;
1071 sec.val[0] = -1;
1072 sec.val[1] = -1;
1073 status = 0;
1074 flags = 0;
1075 if (dir < 0) flags = QUERY_FLAG_SEARCH_REVERSE;
1076
1077 kstatus = _asl_server_query(asl_server_port, (caddr_t)vmstr, len, start, count, flags, (caddr_t *)&res, &reslen, last, (int *)&status, &sec);
1078
1079 if (res == NULL) return NULL;
1080 l = asl_list_from_string(res);
1081 vm_deallocate(mach_task_self(), (vm_address_t)res, reslen);
1082 return l;
1083 }
1084
1085 void
1086 search_once(FILE *f, char *pfmt, int pflags, asl_search_result_t *ql, uint64_t qmin, uint64_t *cmax, uint32_t count, uint32_t batch, int dir, uint32_t tail)
1087 {
1088 asl_search_result_t *res;
1089 int i, more, total;
1090
1091 if (pflags & FORMAT_XML) print_xml_header(f);
1092
1093 res = NULL;
1094 more = 1;
1095 total = 0;
1096
1097 while (more == 1)
1098 {
1099 if (dbselect == DB_SELECT_STORE) res = store_query(ql, qmin, batch, dir, cmax);
1100 else if (dbselect == DB_SELECT_FILES) res = file_query(ql, qmin, batch, dir, cmax);
1101 else if (dbselect == DB_SELECT_SYSLOGD) res = syslogd_query(ql, qmin, batch, dir, cmax);
1102 else if (dbselect == DB_SELECT_LEGACY) res = legacy_query(ql, qmin, batch, dir, cmax);
1103
1104 if ((dir >= 0) && (*cmax > qmin)) qmin = *cmax;
1105 else if ((dir < 0) && (*cmax < qmin)) qmin = *cmax;
1106
1107 if (res == NULL)
1108 {
1109 more = 0;
1110 }
1111 else
1112 {
1113 if ((batch > 0) && (res->count < batch)) more = 0;
1114 total += res->count;
1115 if ((count > 0) && (total >= count)) more = 0;
1116
1117 i = 0;
1118 if (tail != 0)
1119 {
1120 i = res->count - tail;
1121 tail = 0;
1122 if (i < 0) i = 0;
1123 }
1124
1125 if ((f != NULL) || (export != NULL))
1126 {
1127 for (; i < res->count; i++) printmsg(f, res->msg[i], pfmt, pflags);
1128 }
1129
1130 aslresponse_free((aslresponse)res);
1131 }
1132 }
1133
1134 if (pflags & FORMAT_XML) print_xml_trailer(f);
1135 }
1136
1137 uint32_t
1138 optype(char *o)
1139 {
1140 uint32_t op, i;
1141
1142 op = ASL_QUERY_OP_NULL;
1143
1144 if (o == NULL) return op;
1145
1146 for (i = 0; o[i] != '\0'; i++)
1147 {
1148 if (o[i] == MOD_CASE_FOLD) op |= ASL_QUERY_OP_CASEFOLD;
1149 else if (o[i] == MOD_REGEX) op |= ASL_QUERY_OP_REGEX;
1150 else if (o[i] == MOD_NUMERIC) op |= ASL_QUERY_OP_NUMERIC;
1151 else if (o[i] == MOD_SUBSTRING) op |= ASL_QUERY_OP_SUBSTRING;
1152 else if (o[i] == MOD_PREFIX) op |= ASL_QUERY_OP_PREFIX;
1153 else if (o[i] == MOD_SUFFIX) op |= ASL_QUERY_OP_SUFFIX;
1154
1155 else if (!strncasecmp(o+i, OP_EQ, sizeof(OP_EQ)))
1156 {
1157 op |= ASL_QUERY_OP_EQUAL;
1158 i += (sizeof(OP_EQ) - 2);
1159 }
1160 else if (!strncasecmp(o+i, OP_NE, sizeof(OP_NE)))
1161 {
1162 op |= ASL_QUERY_OP_NOT_EQUAL;
1163 i += (sizeof(OP_NE) - 2);
1164 }
1165 else if (!strncasecmp(o+i, OP_GT, sizeof(OP_GT)))
1166 {
1167 op |= ASL_QUERY_OP_GREATER;
1168 i += (sizeof(OP_GT) - 2);
1169 }
1170 else if (!strncasecmp(o+i, OP_GE, sizeof(OP_GE)))
1171 {
1172 op |= ASL_QUERY_OP_GREATER_EQUAL;
1173 i += (sizeof(OP_GE) - 2);
1174 }
1175 else if (!strncasecmp(o+i, OP_LT, sizeof(OP_LT)))
1176 {
1177 op |= ASL_QUERY_OP_LESS;
1178 i += (sizeof(OP_LT) - 2);
1179 }
1180 else if (!strncasecmp(o+i, OP_LE, sizeof(OP_LE)))
1181 {
1182 op |= ASL_QUERY_OP_LESS_EQUAL;
1183 i += (sizeof(OP_LE) - 2);
1184 }
1185 else
1186 {
1187 fprintf(stderr, "invalid option: %s\n", o);
1188 return 0;
1189 }
1190 }
1191
1192 /* sanity check */
1193 if (op & ASL_QUERY_OP_NUMERIC)
1194 {
1195 if (op & ASL_QUERY_OP_CASEFOLD)
1196 {
1197 fprintf(stderr, "warning: case fold modifier has no effect with numeric comparisons\n");
1198 op &= ~ASL_QUERY_OP_CASEFOLD;
1199 }
1200
1201 if (op & ASL_QUERY_OP_REGEX)
1202 {
1203 fprintf(stderr, "warning: regex modifier has no effect with numeric comparisons\n");
1204 op &= ~ASL_QUERY_OP_REGEX;
1205 }
1206
1207 if (op & ASL_QUERY_OP_SUBSTRING)
1208 {
1209 fprintf(stderr, "warning: substring modifier has no effect with numeric comparisons\n");
1210 op &= ~ASL_QUERY_OP_SUBSTRING;
1211 }
1212
1213 if (op & ASL_QUERY_OP_PREFIX)
1214 {
1215 fprintf(stderr, "warning: prefix modifier has no effect with numeric comparisons\n");
1216 op &= ~ASL_QUERY_OP_PREFIX;
1217 }
1218
1219 if (op & ASL_QUERY_OP_SUFFIX)
1220 {
1221 fprintf(stderr, "warning: suffix modifier has no effect with numeric comparisons\n");
1222 op &= ~ASL_QUERY_OP_SUFFIX;
1223 }
1224 }
1225
1226 if (op & ASL_QUERY_OP_REGEX)
1227 {
1228 if (op & ASL_QUERY_OP_SUBSTRING)
1229 {
1230 fprintf(stderr, "warning: substring modifier has no effect with regular expression comparisons\n");
1231 op &= ~ASL_QUERY_OP_SUBSTRING;
1232 }
1233
1234 if (op & ASL_QUERY_OP_PREFIX)
1235 {
1236 fprintf(stderr, "warning: prefix modifier has no effect with regular expression comparisons\n");
1237 op &= ~ASL_QUERY_OP_PREFIX;
1238 }
1239
1240 if (op & ASL_QUERY_OP_SUFFIX)
1241 {
1242 fprintf(stderr, "warning: suffix modifier has no effect with regular expression comparisons\n");
1243 op &= ~ASL_QUERY_OP_SUFFIX;
1244 }
1245 }
1246
1247 return op;
1248 }
1249
1250 int
1251 add_op(asl_msg_t *q, char *key, char *op, char *val, uint32_t flags)
1252 {
1253 uint32_t o;
1254
1255 if (key == NULL) return -1;
1256 if (q == NULL) return -1;
1257
1258 o = ASL_QUERY_OP_NULL;
1259 if (op != NULL)
1260 {
1261 o = optype(op);
1262 if (o == ASL_QUERY_OP_NULL) return -1;
1263 if (val == NULL)
1264 {
1265 fprintf(stderr, "no value supplied for operator %s %s\n", key, op);
1266 return -1;
1267 }
1268
1269 if ((o & ASL_QUERY_OP_NUMERIC) && (strcmp(key, ASL_KEY_TIME) != 0) && (_isanumber(val) == 0))
1270 {
1271 fprintf(stderr, "non-numeric value supplied for numeric operator %s %s %s\n", key, op, val);
1272 return -1;
1273 }
1274
1275 }
1276
1277 o |= flags;
1278 asl_set_query(q, key, val, o);
1279
1280 return 0;
1281 }
1282
1283 static uint32_t
1284 add_db_file(const char *name)
1285 {
1286 asl_file_t *s;
1287 uint32_t status;
1288
1289 if (dbselect == DB_SELECT_LEGACY)
1290 {
1291 fprintf(stderr, "syslog can only read one legacy format database\n");
1292 fprintf(stderr, "can't combine legacy and non-legacy databases in a single search\n");
1293 exit(1);
1294 }
1295
1296 /* shouldn't happen */
1297 if (name == NULL) return DB_SELECT_STORE;
1298
1299 s = NULL;
1300 status = asl_file_open_read(name, &s);
1301 if (status != ASL_STATUS_OK)
1302 {
1303 fprintf(stderr, "data store file %s open failed: %s \n", name, asl_core_error(status));
1304 exit(1);
1305 }
1306
1307 if (s == NULL)
1308 {
1309 fprintf(stderr, "data store file %s open failed\n", name);
1310 exit(1);
1311 }
1312
1313 if (s->flags & ASL_FILE_FLAG_LEGACY_STORE)
1314 {
1315 if (db_files != NULL)
1316 {
1317 fprintf(stderr, "syslog can only read a single legacy format database\n");
1318 fprintf(stderr, "can't combine legacy and non-legacy databases in a single search\n");
1319 exit(1);
1320 }
1321
1322 legacy = s;
1323 return DB_SELECT_LEGACY;
1324 }
1325
1326 db_files = asl_file_list_add(db_files, s);
1327 return DB_SELECT_FILES;
1328 }
1329
1330 static uint32_t
1331 add_db_dir(const char *name)
1332 {
1333 DIR *dp;
1334 struct dirent *dent;
1335 uint32_t status;
1336 asl_file_t *s;
1337 char *path;
1338
1339 /*
1340 * Open all readable files
1341 */
1342 dp = opendir(name);
1343 if (dp == NULL)
1344 {
1345 fprintf(stderr, "%s: %s\n", name, strerror(errno));
1346 exit(1);
1347 }
1348
1349 while ((dent = readdir(dp)) != NULL)
1350 {
1351 if (dent->d_name[0] == '.') continue;
1352
1353 path = NULL;
1354 asprintf(&path, "%s/%s", name, dent->d_name);
1355
1356 /*
1357 * asl_file_open_read will fail if path is NULL,
1358 * if the file is not an ASL store file,
1359 * or if it isn't readable.
1360 */
1361 s = NULL;
1362 status = asl_file_open_read(path, &s);
1363 if (path != NULL) free(path);
1364 if ((status != ASL_STATUS_OK) || (s == NULL)) continue;
1365
1366 db_files = asl_file_list_add(db_files, s);
1367 }
1368
1369 closedir(dp);
1370
1371 return DB_SELECT_FILES;
1372 }
1373
1374 int
1375 main(int argc, char *argv[])
1376 {
1377 FILE *outfile;
1378 int i, j, n, watch, status, pflags, tflags, iamroot, user_tflag;
1379 int notify_file, notify_token;
1380 asl_search_result_t *qlist;
1381 asl_msg_t *cq;
1382 char *pfmt;
1383 const char *exportname;
1384 uint32_t flags, tail_count, batch, encode;
1385 uint64_t qmin, cmax;
1386
1387 watch = 0;
1388 iamroot = 0;
1389 user_tflag = 0;
1390 pfmt = NULL;
1391 flags = 0;
1392 tail_count = 0;
1393 batch = FETCH_BATCH;
1394 pflags = FORMAT_STD;
1395 tflags = TIME_LCL;
1396 encode = ASL_ENCODE_ASL;
1397 cq = NULL;
1398 exportname = NULL;
1399
1400 if (getuid() == 0) iamroot = 1;
1401
1402 for (i = 1; i < argc; i++)
1403 {
1404 if ((!strcmp(argv[i], "-help")) || (!strcmp(argv[i], "--help")))
1405 {
1406 usage();
1407 exit(0);
1408 }
1409
1410 if (!strcmp(argv[i], "-time"))
1411 {
1412 qmin = time(NULL);
1413 printf("%llu\n", qmin);
1414 exit(0);
1415 }
1416
1417 if (!strcmp(argv[i], "-s"))
1418 {
1419 syslog_send(argc, argv);
1420 exit(0);
1421 }
1422
1423 if (!strcmp(argv[i], "-c"))
1424 {
1425 syslog_remote_control(argc, argv);
1426 exit(0);
1427 }
1428 }
1429
1430 qlist = (asl_search_result_t *)calloc(1, sizeof(asl_search_result_t));
1431 if (qlist == NULL) exit(1);
1432
1433 for (i = 1; i < argc; i++)
1434 {
1435 if (!strcmp(argv[i], "-f"))
1436 {
1437 if ((i + 1) < argc)
1438 {
1439 for (j = i + 1; j < argc; j++)
1440 {
1441 if (!strcmp(argv[j], "-"))
1442 {
1443 dbselect = DB_SELECT_SYSLOGD;
1444 break;
1445 }
1446 else if (argv[j][0] == '-')
1447 {
1448 break;
1449 }
1450 else
1451 {
1452 dbselect = add_db_file(argv[j]);
1453 }
1454 }
1455 }
1456 }
1457 if (!strcmp(argv[i], "-d"))
1458 {
1459 if ((i + 1) < argc)
1460 {
1461 for (j = i + 1; j < argc; j++)
1462 {
1463 if (!strcmp(argv[j], "store"))
1464 {
1465 dbselect = add_db_dir(PATH_ASL_STORE);
1466 }
1467 else if (!strcmp(argv[j], "archive"))
1468 {
1469 dbselect = add_db_dir(PATH_ASL_ARCHIVE);
1470 }
1471 else if (argv[j][0] == '-')
1472 {
1473 break;
1474 }
1475 else
1476 {
1477 dbselect = add_db_dir(argv[j]);
1478 }
1479 }
1480 }
1481 }
1482 else if (!strcmp(argv[i], "-w"))
1483 {
1484 watch = 1;
1485 tail_count = 10;
1486 if (((i + 1) < argc) && (argv[i + 1][0] != '-'))
1487 {
1488 i++;
1489 tail_count = atoi(argv[i]);
1490 }
1491 }
1492 else if (!strcmp(argv[i], "-u"))
1493 {
1494 tflags = TIME_UTC;
1495 user_tflag = 1;
1496 }
1497 else if (!strcmp(argv[i], "-x"))
1498 {
1499 if ((i + 1) >= argc)
1500 {
1501 aslresponse_free(qlist);
1502 usage();
1503 exit(1);
1504 }
1505
1506 exportname = argv[++i];
1507 }
1508 else if (!strcmp(argv[i], "-E"))
1509 {
1510 if ((i + 1) >= argc)
1511 {
1512 aslresponse_free(qlist);
1513 usage();
1514 exit(1);
1515 }
1516
1517 i++;
1518
1519 if (!strcmp(argv[i], "vis")) encode = ASL_ENCODE_ASL;
1520 else if (!strcmp(argv[i], "safe")) encode = ASL_ENCODE_SAFE;
1521 else if (!strcmp(argv[i], "none")) encode = ASL_ENCODE_NONE;
1522 else if ((argv[i][0] >= '0') && (argv[i][0] <= '9') && (argv[i][1] == '\0')) encode = atoi(argv[i]);
1523 }
1524 else if (!strcmp(argv[i], "-F"))
1525 {
1526 if ((i + 1) >= argc)
1527 {
1528 aslresponse_free(qlist);
1529 usage();
1530 exit(1);
1531 }
1532
1533 i++;
1534
1535 if (!strcmp(argv[i], "raw"))
1536 {
1537 pflags = FORMAT_RAW;
1538 if (user_tflag == 0) tflags = TIME_SEC;
1539 }
1540 else if (!strcmp(argv[i], "std"))
1541 {
1542 pflags = FORMAT_STD;
1543 }
1544 else if (!strcmp(argv[i], "bsd"))
1545 {
1546 pflags = FORMAT_LEGACY;
1547 }
1548 else if (!strcmp(argv[i], "xml"))
1549 {
1550 pflags = FORMAT_XML;
1551 }
1552 else
1553 {
1554 pflags = 0;
1555 pfmt = argv[i];
1556 }
1557 }
1558 else if (!strcmp(argv[i], "-T"))
1559 {
1560 if ((i + 1) >= argc)
1561 {
1562 aslresponse_free(qlist);
1563 usage();
1564 exit(1);
1565 }
1566
1567 i++;
1568 user_tflag = 1;
1569
1570 if (!strcmp(argv[i], "sec")) tflags = TIME_SEC;
1571 else if (!strcmp(argv[i], "utc")) tflags = TIME_UTC;
1572 else if (!strcmp(argv[i], "local")) tflags = TIME_LCL;
1573 else if (!strcmp(argv[i], "lcl")) tflags = TIME_LCL;
1574 else tflags = TIME_LCL;
1575 }
1576 else if (!strcmp(argv[i], "-o"))
1577 {
1578 flags = 0;
1579
1580 if (qlist->count == 0)
1581 {
1582 qlist->msg = (asl_msg_t **)calloc(1, sizeof(asl_msg_t *));
1583 }
1584 else
1585 {
1586 qlist->msg = (asl_msg_t **)reallocf(qlist->msg, (qlist->count + 1) * sizeof(asl_msg_t *));
1587 }
1588
1589 if (qlist->msg == NULL) exit(1);
1590
1591 cq = asl_new(ASL_TYPE_QUERY);
1592 qlist->msg[qlist->count] = cq;
1593 qlist->count++;
1594 }
1595 else if (!strcmp(argv[i], "-n"))
1596 {
1597 flags = ASL_QUERY_OP_NOT;
1598 }
1599 else if (!strcmp(argv[i], "-C"))
1600 {
1601 if (qlist->count == 0)
1602 {
1603 qlist->msg = (asl_msg_t **)calloc(1, sizeof(asl_msg_t *));
1604 if (qlist->msg == NULL) exit(1);
1605
1606 cq = asl_new(ASL_TYPE_QUERY);
1607 qlist->msg[qlist->count] = cq;
1608 qlist->count++;
1609 }
1610
1611 status = add_op(cq, ASL_KEY_FACILITY, OP_EQ, FACILITY_CONSOLE, flags);
1612
1613 flags = 0;
1614 if (status != 0)
1615 {
1616 aslresponse_free(qlist);
1617 exit(1);
1618 }
1619 }
1620 else if (!strcmp(argv[i], "-k"))
1621 {
1622 i++;
1623 for (n = i; n < argc; n++)
1624 {
1625 if (!strcmp(argv[n], "-o")) break;
1626 if (!strcmp(argv[n], "-n")) break;
1627 if (!strcmp(argv[n], "-k")) break;
1628 if ((n - i) > 2)
1629 {
1630 fprintf(stderr, "invalid sequence: -k");
1631 for (j = i; j <= n; j++) fprintf(stderr, " %s", argv[j]);
1632 fprintf(stderr, "\n");
1633 usage();
1634 exit(1);
1635 }
1636 }
1637
1638 n -= i;
1639 if (n == 0)
1640 {
1641 i--;
1642 continue;
1643 }
1644
1645 if (qlist->count == 0)
1646 {
1647 qlist->msg = (asl_msg_t **)calloc(1, sizeof(asl_msg_t *));
1648 if (qlist->msg == NULL) exit(1);
1649
1650 cq = asl_new(ASL_TYPE_QUERY);
1651 qlist->msg[qlist->count] = cq;
1652 qlist->count++;
1653 }
1654
1655 status = 0;
1656 if (n == 1) status = add_op(cq, argv[i], NULL, NULL, flags);
1657 else if (n == 2) status = add_op(cq, argv[i], OP_EQ, argv[i+1], flags);
1658 else status = add_op(cq, argv[i], argv[i+1], argv[i+2], flags);
1659
1660 flags = 0;
1661 if (status != 0)
1662 {
1663 aslresponse_free(qlist);
1664 exit(1);
1665 }
1666 }
1667 }
1668
1669 pflags |= tflags;
1670 pflags |= encode;
1671
1672 outfile = stdout;
1673
1674 if (exportname != NULL)
1675 {
1676 if (watch == 1)
1677 {
1678 fprintf(stderr, "Warning: -w flag has no effect with -x export flag\n");
1679 watch = 0;
1680 }
1681
1682 status = asl_file_open_write(exportname, 0644, -1, -1, &export);
1683 if (status != ASL_STATUS_OK)
1684 {
1685 aslresponse_free(qlist);
1686 fprintf(stderr, "export file open failed: %s\n", asl_core_error(status));
1687 exit(1);
1688 }
1689
1690 /*
1691 * allow the string cache to be unlimited to maximize string dup compression
1692 * preserve message IDs
1693 */
1694 export->flags = ASL_FILE_FLAG_UNLIMITED_CACHE | ASL_FILE_FLAG_PRESERVE_MSG_ID;
1695
1696 outfile = NULL;
1697 pflags = EXPORT;
1698 }
1699
1700 qmin = 0;
1701 cmax = 0;
1702 notify_file = -1;
1703 notify_token = -1;
1704
1705 if (watch == 1)
1706 {
1707 if ((dbselect == DB_SELECT_STORE) || (dbselect == DB_SELECT_SYSLOGD))
1708 {
1709 status = notify_register_file_descriptor("com.apple.system.logger.message", &notify_file, 0, &notify_token);
1710 if (status != NOTIFY_STATUS_OK) notify_token = -1;
1711 }
1712 }
1713
1714 if ((qlist->count == 0) && (watch == 1))
1715 {
1716 qmin = -1;
1717 search_once(NULL, NULL, 0, NULL, qmin, &cmax, 1, 1, -1, 0);
1718 qmin = (cmax + 1) - tail_count;
1719 tail_count = 0;
1720 }
1721
1722 /* output should be line buffered */
1723 setlinebuf(outfile);
1724
1725 search_once(outfile, pfmt, pflags, qlist, qmin, &cmax, 0, batch, 1, tail_count);
1726
1727 if (watch == 1)
1728 {
1729 if (notify_token == -1)
1730 {
1731 forever
1732 {
1733 usleep(500000);
1734 if (cmax > qmin) qmin = cmax;
1735 search_once(outfile, pfmt, pflags, qlist, qmin + 1, &cmax, 0, batch, 1, 0);
1736 }
1737 }
1738 else
1739 {
1740 while (read(notify_file, &i, 4) == 4)
1741 {
1742 if (cmax > qmin) qmin = cmax;
1743 search_once(outfile, pfmt, pflags, qlist, qmin + 1, &cmax, 0, batch, 1, 0);
1744 }
1745 }
1746 }
1747
1748 if (db_files != NULL) asl_file_list_close(db_files);
1749 if (store != NULL) asl_store_close(store);
1750 if (export != NULL) asl_file_close(export);
1751
1752 aslresponse_free(qlist);
1753
1754 exit(0);
1755 }
mirror of syslog