2 * Copyright (c) 2004-2008 Apple Inc.
3 * Copyright (c) 2006 Martin Voros
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
30 * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#14 $
34 * Tool used to parse audit records conforming to the BSM structure.
38 * praudit [-lpx] [-r | -s] [-d del] [file ...]
41 #include <bsm/libbsm.h>
48 extern int optind, optopt, opterr,optreset;
50 static char *del = ","; /* Default delimiter. */
51 static int oneline = 0;
53 static int shortfrm = 0;
54 static int partial = 0;
61 fprintf(stderr, "usage: praudit [-lpx] [-r | -s] [-d del] "
67 * Token printing for each token type .
70 print_tokens(FILE *fp)
77 /* Allow tail -f | praudit to work. */
80 /* Record must begin with a header token. */
83 } while(type != AUT_HEADER32);
87 while ((reclen = au_read_rec(fp, &buf)) != -1) {
89 while (bytesread < reclen) {
90 /* Is this an incomplete record? */
91 if (-1 == au_fetch_tok(&tok, buf + bytesread,
95 au_print_tok_xml(stdout, &tok, del, raw,
98 au_print_tok(stdout, &tok, del, raw,
100 bytesread += tok.len;
116 main(int argc, char **argv)
122 while ((ch = getopt(argc, argv, "d:lprsx")) != -1) {
138 usage(); /* Exclusive from shortfrm. */
144 usage(); /* Exclusive from raw. */
159 au_print_xml_header(stdout);
161 /* For each of the files passed as arguments dump the contents. */
162 if (optind == argc) {
166 for (i = optind; i < argc; i++) {
167 fp = fopen(argv[i], "r");
168 if ((fp == NULL) || (print_tokens(fp) == -1))
175 au_print_xml_footer(stdout);