2 * Copyright (c) 2004-2009 Apple Inc.
3 * Copyright (c) 2006 Martin Voros
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
32 * Tool used to parse audit records conforming to the BSM structure.
36 * praudit [-lnpx] [-r | -s] [-d del] [file ...]
39 #include <bsm/libbsm.h>
46 extern int optind, optopt, opterr,optreset;
48 static char *del = ","; /* Default delimiter. */
49 static int oneline = 0;
50 static int partial = 0;
51 static int oflags = AU_OFLAG_NONE;
57 fprintf(stderr, "usage: praudit [-lnpx] [-r | -s] [-d del] "
63 * Token printing for each token type .
66 print_tokens(FILE *fp)
73 /* Allow tail -f | praudit to work. */
76 /* Record must begin with a header token. */
79 } while(type != AUT_HEADER32);
83 while ((reclen = au_read_rec(fp, &buf)) != -1) {
85 while (bytesread < reclen) {
86 /* Is this an incomplete record? */
87 if (-1 == au_fetch_tok(&tok, buf + bytesread,
90 au_print_flags_tok(stdout, &tok, del, oflags);
93 if (!(oflags & AU_OFLAG_XML))
107 main(int argc, char **argv)
113 while ((ch = getopt(argc, argv, "d:lnprsx")) != -1) {
124 oflags |= AU_OFLAG_NORESOLVE;
132 if (oflags & AU_OFLAG_SHORT)
133 usage(); /* Exclusive from shortfrm. */
134 oflags |= AU_OFLAG_RAW;
138 if (oflags & AU_OFLAG_RAW)
139 usage(); /* Exclusive from raw. */
140 oflags |= AU_OFLAG_SHORT;
144 oflags |= AU_OFLAG_XML;
153 if (oflags & AU_OFLAG_XML)
154 au_print_xml_header(stdout);
156 /* For each of the files passed as arguments dump the contents. */
157 if (optind == argc) {
161 for (i = optind; i < argc; i++) {
162 fp = fopen(argv[i], "r");
163 if ((fp == NULL) || (print_tokens(fp) == -1))
169 if (oflags & AU_OFLAG_XML)
170 au_print_xml_footer(stdout);