2 * Copyright (c) 2004-2009 Apple Inc.
3 * Copyright (c) 2006 Martin Voros
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
30 * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#16 $
34 * Tool used to parse audit records conforming to the BSM structure.
38 * praudit [-lnpx] [-r | -s] [-d del] [file ...]
41 #include <bsm/libbsm.h>
48 extern int optind, optopt, opterr,optreset;
50 static char *del = ","; /* Default delimiter. */
51 static int oneline = 0;
52 static int partial = 0;
53 static int oflags = AU_OFLAG_NONE;
59 fprintf(stderr, "usage: praudit [-lnpx] [-r | -s] [-d del] "
65 * Token printing for each token type .
68 print_tokens(FILE *fp)
75 /* Allow tail -f | praudit to work. */
78 /* Record must begin with a header token. */
81 } while(type != AUT_HEADER32);
85 while ((reclen = au_read_rec(fp, &buf)) != -1) {
87 while (bytesread < reclen) {
88 /* Is this an incomplete record? */
89 if (-1 == au_fetch_tok(&tok, buf + bytesread,
92 au_print_flags_tok(stdout, &tok, del, oflags);
95 if (!(oflags & AU_OFLAG_XML))
109 main(int argc, char **argv)
115 while ((ch = getopt(argc, argv, "d:lnprsx")) != -1) {
126 oflags |= AU_OFLAG_NORESOLVE;
134 if (oflags & AU_OFLAG_SHORT)
135 usage(); /* Exclusive from shortfrm. */
136 oflags |= AU_OFLAG_RAW;
140 if (oflags & AU_OFLAG_RAW)
141 usage(); /* Exclusive from raw. */
142 oflags |= AU_OFLAG_SHORT;
146 oflags |= AU_OFLAG_XML;
155 if (oflags & AU_OFLAG_XML)
156 au_print_xml_header(stdout);
158 /* For each of the files passed as arguments dump the contents. */
159 if (optind == argc) {
163 for (i = optind; i < argc; i++) {
164 fp = fopen(argv[i], "r");
165 if ((fp == NULL) || (print_tokens(fp) == -1))
171 if (oflags & AU_OFLAG_XML)
172 au_print_xml_footer(stdout);