path: root/lib/os_mon/c_src/nteventlog/elog_main.c

/*
 * %CopyrightBegin%
 * 
 * Copyright Ericsson AB 1998-2016. All Rights Reserved.
 * 
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * 
 * %CopyrightEnd%
 */
/*
 * Module: elog_main
 * Purpouse: Main program and logic in the nteventlog program
 * which waits for logging events and sends them to erlang.
 * At startup, the registry keys for the identifier given on the
 * command line are read to see what log record was the last 
 * displayed for this identifier. All "new" records are then 
 * displayed. After that the program waits for new events to arrive 
 * and displays them (sends them to erlang). If stdin is a pipe
 * (not a console) an ACK is requested for every entry displayed.
 * when the ACK is received, the registry entries for the identifier
 * is updated, so that next time the program starts, only the new
 * entries are displayed.
 */
#include "elog_global.h"
#include "elog_util.h"
#include "elog_pipe_stdin.h"
#include "elog_format.h"
#include "elog_registry.h"

/*
 * A race condition in the event log notification and the 
 * event log reading results in us having to retry reading the
 * eventlog after some time. One second seems to do it...
 */
#define RETRY_TIMEOUT 1000

/*
 * Constants for the logging formats.
 */
#define LOG_FORMAT "%s [%s] %s, %s: %s\n" 
#define PIPE_LOG_FORMAT "%dH%s%dH%s%dH%s%dH%s%dH%s"
#define PIPE_LOG_ACK "A"
#define PIPE_LOG_EXTRA (5*10) /* 5 int */
#define ACK_MAX 100
#define TIME_FORMAT "%d-%b-%Y %H:%M:%S GMT"
/*                    2  3  4  2  2  2     */
#define TIME_BUFSIZ 25
#define CANT_FORMAT_MESSAGE "[EventLogReader unable to format message text]"

/* the default registry identification */
#define DEFAULT_IDENT "DefaultIdent"

/*#define HARDDEBUG*/

/* Flag set if eventlog is purged and need reopening.*/
static int reopen_event_log = 0;

/*
 * Calculates the needed buffersize for a record in the eventlog.
 * if recordnum == 0, looks at next record, otherwise looks
 * at the record with the given number.
 */
static DWORD needed(HANDLE elog, DWORD recordnum){
  EVENTLOGRECORD dummy;
  DWORD red, need;
  DWORD last_error;
  DWORD flags = 
    EVENTLOG_FORWARDS_READ | 
    ((recordnum) ? EVENTLOG_SEEK_READ : EVENTLOG_SEQUENTIAL_READ);
#ifdef HARDDEBUG
  fprintf(stderr,"Calculating need when recordnum = %lu\n",recordnum);
#endif
  if(!ReadEventLog(elog,
		   flags,
		   recordnum,
		   &dummy,
		   (DWORD) sizeof(EVENTLOGRECORD),
		   &red,
		   &need) &&
     (last_error = GetLastError()) == ERROR_INSUFFICIENT_BUFFER){
    return need;
  } else if(last_error == ERROR_EVENTLOG_FILE_CHANGED){
    reopen_event_log = 1;
    return (DWORD) 0;
  } else {
#ifdef HARDDEBUG
    output_error(last_error,"needed() failed to read eventlog");
#endif
    return (DWORD) 0;
  }
}  


/*
 * Checks (any type of) stdin for end of file.
 * Expects data present on stdin.
 */
BOOL eof_on_stdin(void){
  HANDLE in = GetStdHandle(STD_INPUT_HANDLE);
  char x[1];
  DWORD y;
  INPUT_RECORD input;
  DWORD red;
  static int state = 1; /* Return pressed = 1, ^Z after that = 2 */

  if(!console_stdin()){
    return peek_pipe_stdin_eof();
  }
  /* Console input, may be just about every type of event, look for
     ^Z pressed... */
  if(!ReadConsoleInput(in,&input,1,&red))
    return FALSE;
  if(input.EventType != KEY_EVENT)
    return FALSE;
  if(input.Event.KeyEvent.bKeyDown){
    switch(input.Event.KeyEvent.uChar.AsciiChar){
    case 0:
      break;
    case 13:
      x[0] = '\r';
      WriteFile(GetStdHandle(STD_OUTPUT_HANDLE),"\r\n",2,&y,NULL);
      if(state == 2) 
	return TRUE;
      else
	state = 1;
      break;
    case 26:
      if(state == 1)
	state = 2;
      WriteFile(GetStdHandle(STD_OUTPUT_HANDLE),"^Z",2,&y,NULL);
      break;
    default:
      if(((unsigned char) input.Event.KeyEvent.uChar.AsciiChar) < ' '){
	WriteFile(GetStdHandle(STD_OUTPUT_HANDLE),"^",1,&y,NULL);
	x[0] = input.Event.KeyEvent.uChar.AsciiChar + '@';
      } else 
	x[0] = input.Event.KeyEvent.uChar.AsciiChar;
      WriteFile(GetStdHandle(STD_OUTPUT_HANDLE),x,1,&y,NULL);
      state = 0;
      break;
    }
    return FALSE;
  }
  return FALSE;
}

/*
 * Writes eventlog entries to erlang and requires ACK for
 * each record.
 */
BOOL data_to_pipe(char *string, char *answer, int answer_siz){
  unsigned char len[2];
  unsigned char *ptr;
  int siz = strlen(string);
  HANDLE out = GetStdHandle(STD_OUTPUT_HANDLE);
  HANDLE in = GetStdHandle(STD_INPUT_HANDLE);
  DWORD written, red;
  DWORD left;

  len[0] = (siz >> 8) & 0xFF;
  len[1] = siz & 0xFF;
  if(!WriteFile(out, len, 2, 
	    &written, NULL) || written != 2)
    return FALSE;
  if(!WriteFile(out, string, siz, &written, NULL) ||
     written != (DWORD) siz)
    return FALSE;
  /* Read ACK from erlang */
  left = 2;
  ptr = len;
  for(;;){
    if(!(red = read_pipe_stdin(ptr, left)))
      return FALSE;
    else if(red < left){
      ptr += red;
      left -= red;
    } else {
      break;
    }
  }
  siz = len[0] << 8 | len[1];

  if(siz >= answer_siz - 1)
    return FALSE;

  left = siz;
  ptr = (unsigned char *) answer;
  for(;;){
    if(!(red = read_pipe_stdin(ptr, left))){
      return FALSE;
    } else if(red < left){
      ptr += red;
      left -= red;
    } else {
      break;
    }
  }
  answer[siz] = '\0';
  return TRUE;
}

/*
 * The actual writing of records.
 * Behaves differently if stdout is a pipe (erlang)
 * or a console (test run).
 */
  
BOOL output_record(char *category, EVENTLOGRECORD *event){
  char *strbeg, *fac, *sev;
  char eventfilename[MAX_PATH];
  char paramfilename[MAX_PATH];
  char bigbuff[BIGBUFSIZ];
  MessageFiles mf;
  char tbuff[TIME_BUFSIZ];
  BOOL ret;
  DWORD written;
  char *buff;
  char ackbuff[ACK_MAX];

  mf = get_messagefiles(category,((char *)event)+sizeof(EVENTLOGRECORD),
			eventfilename, MAX_PATH,
			paramfilename, MAX_PATH);
  if(!mf.event){
    strcpy(bigbuff, CANT_FORMAT_MESSAGE);
  } else {
    strbeg = (char *) event;
    strbeg += event->StringOffset;
    if(!format_message(mf, event->EventID,
		       strbeg, event->NumStrings, bigbuff, BIGBUFSIZ)){
      strcpy(bigbuff, CANT_FORMAT_MESSAGE);
    }
  }
  fac = ((char *)event)+sizeof(EVENTLOGRECORD);
  sev = lookup_severity(event->EventType);
  if(console_stdin()){
    *tbuff = '\0';
    strftime(tbuff, (size_t) TIME_BUFSIZ, TIME_FORMAT, 
	     gmtime((time_t *)&(event->TimeGenerated)));
    buff = 
      malloc(strlen(bigbuff) + TIME_BUFSIZ /* date-time */ + 
	     strlen(category) +
	     strlen(fac) /* facility */   +
	     strlen(sev) /*severity */+
	     strlen(LOG_FORMAT) /* More than actually needed */ + 1);
    sprintf(buff, LOG_FORMAT, tbuff, fac, category, sev, bigbuff); 
    ret = WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), buff, strlen(buff), 
		    &written, NULL); /* Overlapped structure for stdout? */
  free(buff);
  } else { /* pipe */
    sprintf(tbuff,"%lu", event->TimeGenerated); 
    buff = malloc(strlen(bigbuff) + 
		  strlen(tbuff) + 
		  strlen(category) +
		  strlen(fac) +
		  strlen(sev) +
		  strlen(PIPE_LOG_FORMAT) +
		  PIPE_LOG_EXTRA);
    sprintf(buff,PIPE_LOG_FORMAT,
	    strlen(tbuff),tbuff,
	    strlen(category), category,
	    strlen(fac), fac,
	    strlen(sev), sev,
	    strlen(bigbuff), bigbuff);
    ret = data_to_pipe(buff,ackbuff, ACK_MAX);
    if(ret && strcmp(ackbuff,PIPE_LOG_ACK))
      ret = FALSE;
    free(buff);
  }
  return ret;
}


/*
 * Read eventlog entries FOLLOWING the given record
 * number and timestamp, and sends them to
 * stdout. If timestamp does
 * not correspond with record number, the
 * log is concidered wrapped around
 * and is reread from the beginning.
 * time is ignored if 0.
 * If record_number is 0, the whole log is read (if there is one).
 * If the function is unsuccessful, the global variable 
 * reopen_event_log may be set to TRUE, which means 
 * that the eventlog has changed and has to be reopened.
 * It's the callers responsibility to set reopen_event_log to
 * 0 before calling.
 */ 
static int read_from(DWORD *record_number, DWORD *time, 
		     HANDLE elog, char *category){
  DWORD dummy;
  static EVENTLOGRECORD *event = NULL;
  static DWORD eventsiz = 0;
  DWORD red, need;
  /* Always begin reading from record 1, record 0 never exists */
  DWORD tmp = (*record_number) ? *record_number : 1; 
  DWORD ttmp = *time;
  int skip = !!(*record_number); /* Dont skip if record_number == 0 */
  int maybe_done = 0;
  int i;

  /* First try seeking to the correct place in the eventlog */
  /* the variable skip tells us that we are rereading the */ 
  /* last read eventlog record and the variable */
  /* maybe_done tells us that we have read the last eventlog */
  /* and an EOF is OK. */
  for(;;){
    if(!(need = needed(elog, tmp))){
      if(maybe_done) /* Has read one correct record
			and are satisfied with that. */
	return 0;
      /* Hmm, could not find the record? Try the oldest... */
      if(!GetOldestEventLogRecord(elog, &tmp) ||
	 !(need = needed(elog, tmp))){
	/* Something's terribly wrong. */
#ifdef HARDDEBUG
	fprintf(stderr,"Could not get oldest eventlog record!\n",
		need);
#endif
	return -1;
      }
      skip = 0;
    }
    /* need == number of bytes for this record, 
       tmp == this recordnumber */
    if(!event)
      event = malloc(eventsiz = need);
    else if(eventsiz < need)
      event = realloc(event, eventsiz = need);
    if(!ReadEventLog(elog,
		     (DWORD) (EVENTLOG_FORWARDS_READ | 
		     EVENTLOG_SEEK_READ),
		     tmp,
		     event,
		     need,
		     &red,
		     &dummy)){
      if(GetLastError() == ERROR_EVENTLOG_FILE_CHANGED){
	reopen_event_log = 1;
      } 
#ifdef HARDDEBUG
      output_error(GetLastError(), 
		   "Failed first eventlog read in read_from\n");
#endif
      return -1;
    }
    if(skip){
      if(ttmp && event->TimeWritten != ttmp){
	/* Wrapped around eventlog */
	tmp = 1;
      } else {
	maybe_done = 1;
	++tmp;
      }
      skip = 0;
    } else
      break;
  }
  /* Got the first record in buffer, display and continue reading */
  /* sequentially from here. */
  for(i=1;;++i){
    if(!output_record(category, event))
      return -1;
    *record_number = event->RecordNumber;
    *time = event->TimeWritten;
    if(!(need = needed(elog,(DWORD) 0)))
      break; /* End of log */
    if(eventsiz < need)
      event = realloc(event, eventsiz = need);
    if(!ReadEventLog(elog,
		     (DWORD) EVENTLOG_FORWARDS_READ | 
		     EVENTLOG_SEQUENTIAL_READ,
		     (DWORD) 0,
		     event,
		     need,
		     &red,
		     &dummy)){
      if(GetLastError() == ERROR_EVENTLOG_FILE_CHANGED){
	reopen_event_log = 1;
      } 
      return -1;
    }
  }
  return i;
}

/*
 * Read unread events and wait for new to arrive.
 */
int main(int argc, char **argv){
  HANDLE elog[NUM_CATEGORIES]; 
  HANDLE events[NUM_CATEGORIES + 1]; /* The stdin handle goes 
				      in here to */
  int eventlen;
  char *ident;
  DWORD record = 0, time = 0; 
  RegKeys rk[NUM_CATEGORIES];
  int rklen = NUM_CATEGORIES;
  int i;
  int ret;
  int x = 0;
  int retry = 0;

  if(argc < 2){
    ident = DEFAULT_IDENT;
  } else {
    ident = argv[1];
  }

  if(!setup_pipe_stdin()){
    fprintf(stderr,"%s: Stdin could not be initialized.\n",argv[0]);
    return 1;
  }
  if(get_regkeys(ident, rk, &rklen) != 0){
    fprintf(stderr, 
	    "%s: Could not get/create registry parameters.\n", argv[0]);
    return 1;
  }
  for(;;){
    for(i=0; i<rklen; ++i){
      elog[i] = OpenEventLog(NULL, rk[i].facility_name);
      
      if(elog[i] == NULL){
	fprintf(stderr, 
		"%s: Could not open \"%s\" eventlog.\n",
		argv[0], rk[i].facility_name);
	return 1;
      }
      if((events[i] = CreateEvent(NULL,FALSE,FALSE,NULL)) 
	 == NULL){
	fprintf(stderr,"%s: Could not create event object.\n", argv[0]);
	return 1;
      }
      if(!NotifyChangeEventLog(elog[i],events[i])){
	fprintf(stderr,"%s: Could not get eventlog notification.\n", argv[0]);
	return 1;
      }
      if(read_from(&(rk[i].latest_record), 
		   &(rk[i].latest_time),
		   elog[i],
		   rk[i].facility_name) > 0)
	set_regkeys(ident, rk + i, 1); 
    }
    eventlen = rklen;
    events[eventlen] = get_stdin_event();
    ++eventlen;
  
    for(;;){  
#ifdef HARDDEBUG
      fprintf(stderr,"Entering Wait...\n");
#endif
      reopen_event_log = 0;
      ret = WaitForMultipleObjects(eventlen,
				   events,
				   FALSE,
				   (retry) ? 
				   RETRY_TIMEOUT : 
				   INFINITE);
#ifdef HARDDEBUG
      fprintf(stderr,"Wait returned!\n");
#endif
      if(ret == WAIT_TIMEOUT){ 
	if(!retry){
	  fprintf(stderr,"%s: Timeout when no such possible!\n", 
		  argv[0]);
	  return 1;
	}
	retry = 0;
      } else {
	if(((int) (ret - WAIT_OBJECT_0)) >= rklen && eof_on_stdin())
	  goto done;
	retry = 1;
      }
      for(i=0;i<rklen;++i){
	if(read_from(&(rk[i].latest_record), 
		     &(rk[i].latest_time),
		     elog[i],
		     rk[i].facility_name) > 0)
	  set_regkeys(ident, rk + i, 1);
      }
      if(reopen_event_log)
	break;
    }
    for(i=0; i < rklen; ++i){
      CloseEventLog(elog[i]);
      CloseHandle(events[i]);
    }
  }
done:
#ifdef DEBUG
  fprintf(stderr,"%s: EOF\n", argv[0]);
#endif
  for(i=0; i < rklen; ++i)
    CloseEventLog(elog[i]);
  return 0;
}