summaryrefslogtreecommitdiffstats
path: root/tools/logctl.c
diff options
context:
space:
mode:
Diffstat (limited to 'tools/logctl.c')
-rw-r--r--tools/logctl.c458
1 files changed, 458 insertions, 0 deletions
diff --git a/tools/logctl.c b/tools/logctl.c
new file mode 100644
index 00000000..df332bc2
--- /dev/null
+++ b/tools/logctl.c
@@ -0,0 +1,458 @@
+/**
+ * logctl - a tool to access lumberjack logs in MongoDB
+ * ... and potentially other sources in the future.
+ *
+ * Copyright 2012 Ulrike Gerhards and Adiscon GmbH.
+ *
+ * long short
+
+ * level l read records with level x
+ * severity s read records with severity x
+ * ret r number of records to return
+ * skip k number of records to skip
+ * sys y read records of system x
+ * msg m read records with message containing x
+ * datef f read records starting on time received x
+ * dateu u read records until time received x
+ *
+ * examples:
+ *
+ * logctl -f 15/05/2012-12:00:00 -u 15/05/2012-12:37:00
+ * logctl -s 50 --ret 10
+ * logctl -m "closed"
+ * logctl -l "INFO"
+ * logctl -s 3
+ * logctl -y "ubuntu"
+ *
+ * This file is part of rsyslog.
+ *
+ * Rsyslog is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Rsyslog is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Rsyslog. If not, see <http://www.gnu.org/licenses/>.
+ *
+ * A copy of the GPL can be found in the file "COPYING" in this distribution.
+ */
+#include "config.h"
+#include <stdio.h>
+#include <mongo.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+#include <getopt.h>
+#include <unistd.h>
+
+#define N 80
+
+static struct option long_options[] =
+{
+ {"level", required_argument, NULL, 'l'},
+ {"severity", required_argument, NULL, 's'},
+ {"ret", required_argument, NULL, 'r'},
+ {"skip", required_argument, NULL, 'k'},
+ {"sys", required_argument, NULL, 'y'},
+ {"msg", required_argument, NULL, 'm'},
+ {"datef", required_argument, NULL, 'f'},
+ {"dateu", required_argument, NULL, 'u'},
+ {NULL, 0, NULL, 0}
+};
+
+struct queryopt
+{
+ gint32 e_sever;
+ gint32 e_ret;
+ gint32 e_skip;
+ char *e_date;
+ char *e_level;
+ char *e_msg;
+ char *e_sys;
+ char *e_dateu;
+ int bsever;
+ int blevel;
+ int bskip;
+ int bret;
+ int bsys;
+ int bmsg;
+ int bdate;
+ int bdatef;
+ int bdateu;
+};
+
+struct ofields
+{
+ const char *msg;
+ const char *syslog_tag;
+ const char *prog;
+ char *date;
+ gint64 date_r;
+};
+
+struct query_doc
+{
+ bson *query;
+};
+
+struct select_doc
+{
+ bson *select;
+};
+
+struct db_connect
+{
+ mongo_sync_connection *conn;
+};
+
+struct output
+{
+ mongo_packet *p;
+};
+
+struct db_cursor
+{
+ mongo_sync_cursor *cursor;
+};
+
+struct results
+{
+ bson *result;
+};
+
+
+
+void formater(struct ofields *fields)
+{
+ time_t rtime;
+ rtime = (time_t) (fields->date_r / 1000);
+ char str[N];
+ strftime(str, N, "%b %d %H:%M:%S", gmtime(&rtime));
+ printf("%s %s %s %s\n", str, fields->prog, fields->syslog_tag, fields->msg);
+
+}
+
+struct ofields* get_data(struct results *res)
+{
+ struct ofields *fields;
+ const char *msg;
+ const char *prog;
+ const char *level;
+ const char *syslog_tag;
+ gint64 date_r;
+ bson_cursor *c;
+
+ fields = malloc(sizeof(struct ofields));
+
+ c = bson_find (res->result, "msg");
+ if (!bson_cursor_get_string (c, &msg))
+ {
+ perror ("bson_cursor_get_string()");
+ exit (1);
+ }
+ bson_cursor_free (c);
+
+ c = bson_find (res->result, "sys");
+ if (!bson_cursor_get_string (c, &prog))
+ {
+ perror ("bson_cursor_get_string()");
+ exit (1);
+ }
+ bson_cursor_free (c);
+
+ c = bson_find (res->result, "syslog_tag");
+ if (!bson_cursor_get_string (c, &syslog_tag))
+ {
+ perror ("bson_cursor_get_string()");
+ exit (1);
+ }
+ bson_cursor_free (c);
+
+ c = bson_find (res->result, "time_rcvd");
+ if (!bson_cursor_get_utc_datetime (c, &date_r))
+ {
+ perror ("bson_cursor_get_utc_datetime()");
+ exit (1);
+ }
+
+ bson_cursor_free (c);
+ fields->msg = msg;
+ fields->prog = prog;
+ fields->syslog_tag = syslog_tag;
+ fields->date_r = date_r;
+
+ return fields;
+
+}
+
+void getoptions(int argc, char *argv[], struct queryopt *opt)
+{
+ int iarg;
+ while ((iarg = getopt_long(argc, argv, "l:s:r:k:y:f:u:m:", long_options, NULL)) != -1)
+ {
+ // check to see if a single character or long option came through
+ switch (iarg)
+ {
+ // short option 's'
+ case 's':
+ opt->bsever = 1;
+ opt->e_sever = atoi(optarg);
+ break;
+ // short option 'r'
+ case 'r':
+ opt->bret = 1;
+ opt->e_ret = atoi(optarg);
+ break;
+ // short option 'f' : date from
+ case 'f':
+ opt->bdate = 1;
+ opt->bdatef = 1;
+ opt->e_date = optarg;
+ break;
+ // short option 'u': date until
+ case 'u':
+ opt->bdate = 1;
+ opt->bdateu = 1;
+ opt->e_dateu = optarg;
+ break;
+ // short option 'k'
+ case 'k':
+ opt->bskip = 1;
+ opt->e_skip = atoi(optarg);
+ break;
+ // short option 'l'
+ case 'l':
+ opt->blevel = 1;
+ opt->e_level = optarg;
+ break;
+ // short option 'm'
+ case 'm':
+ opt->bmsg = 1;
+ opt->e_msg = optarg;
+ break;
+ // short option 'y'
+ case 'y':
+ opt->bsys = 1;
+ opt->e_sys = optarg;
+ break;
+ } // end switch iarg
+ } // end while
+
+} // end void getoptions
+
+struct select_doc* create_select()
+// BSON object indicating the fields to return
+{
+ struct select_doc *s_doc;
+ s_doc = malloc(sizeof(struct select_doc));
+ s_doc->select = bson_new ();
+ bson_append_string (s_doc->select, "syslog_tag", "s", -1);
+ bson_append_string (s_doc->select, "msg", "ERROR", -1);
+ bson_append_string (s_doc->select, "sys", "sys", -1);
+ bson_append_utc_datetime (s_doc->select, "time_rcvd", 1ll);
+ bson_finish (s_doc->select);
+ return s_doc;
+}
+
+struct query_doc* create_query(struct queryopt *opt)
+{
+ struct query_doc *qu_doc;
+ bson *query_what, *order_what, *order_how, *msg_what, *date_what;
+ struct tm tm;
+ time_t t;
+ gint64 ts;
+ qu_doc = malloc(sizeof(struct query_doc));
+ qu_doc->query = bson_new ();
+
+ query_what = bson_new ();
+ if (opt->bsever == 1)
+ {
+ bson_append_int32 (query_what, "syslog_sever", opt->e_sever);
+ }
+ if (opt->blevel == 1)
+ {
+ bson_append_string (query_what, "level", opt->e_level, -1);
+ }
+
+ if (opt->bmsg == 1)
+ {
+ msg_what = bson_new ();
+ bson_append_string (msg_what, "$regex", opt->e_msg, -1);
+ bson_append_string (msg_what, "$options", "i", -1);
+ bson_finish (msg_what);
+ bson_append_document (query_what, "msg", msg_what);
+ }
+
+ if (opt->bdate == 1)
+ {
+ date_what = bson_new ();
+ if (opt->bdatef == 1)
+ {
+ tm.tm_isdst = -1;
+ strptime(opt->e_date, "%d/%m/%Y-%H:%M:%S", &tm);
+ tm.tm_hour = tm.tm_hour + 1;
+ t = mktime(&tm);
+ ts = 1000 * (gint64) t;
+
+ bson_append_utc_datetime (date_what,"$gt", ts) ;
+ }
+
+ if (opt->bdateu == 1)
+ {
+ tm.tm_isdst = -1;
+ strptime(opt->e_dateu, "%d/%m/%Y-%H:%M:%S", &tm);
+ tm.tm_hour = tm.tm_hour +1;
+ t = mktime(&tm);
+ ts = 1000 * (gint64) t;
+ bson_append_utc_datetime (date_what,"$lt", ts);
+
+ }
+ bson_finish (date_what);
+ bson_append_document (query_what, "time_rcvd", date_what);
+ }
+
+ if (opt->bsys == 1)
+ {
+ bson_append_string (query_what, "sys", opt->e_sys, -1);
+ }
+
+ bson_finish (query_what);
+
+ order_what = bson_new ();
+ bson_append_utc_datetime (order_what, "time_rcvd", 1ll);
+ bson_finish (order_what);
+
+ bson_append_document (qu_doc->query, "$query", query_what);
+ bson_append_document (qu_doc->query, "$orderby", order_what);
+ bson_finish (qu_doc->query);
+ bson_free (order_what);
+ return qu_doc;
+}
+
+struct db_connect* create_conn()
+{
+ struct db_connect *db_conn;
+ db_conn = malloc(sizeof(struct db_connect));
+ db_conn->conn = mongo_sync_connect ("localhost", 27017, TRUE);
+
+ if (!db_conn->conn)
+ {
+ perror ("mongo_sync_connect()");
+ exit (1);
+ }
+ return db_conn;
+}
+
+void close_conn(struct db_connect *db_conn)
+{
+ mongo_sync_disconnect (db_conn->conn);
+}
+
+void free_cursor(struct db_cursor *db_c)
+{
+ mongo_sync_cursor_free (db_c->cursor);
+}
+
+struct output* launch_query(struct queryopt *opt, struct select_doc *s_doc,
+ struct query_doc *qu_doc,
+ struct db_connect *db_conn)
+{
+ struct output *out;
+ out = malloc(sizeof(struct output));
+ out->p = mongo_sync_cmd_query (db_conn->conn, "syslog.log", 0,
+ opt->e_skip, opt->e_ret, qu_doc->query, s_doc->select);
+ if (!out->p)
+ {
+ perror ("mongo_sync_cmd_query()");
+ printf("no records found\n");
+ exit (1);
+ }
+ return out;
+}
+
+struct db_cursor* open_cursor(struct db_connect *db_conn, struct output *out)
+{
+ struct db_cursor *db_c;
+ db_c = malloc(sizeof(struct db_cursor));
+
+ db_c->cursor = mongo_sync_cursor_new (db_conn->conn, "syslog.log", out->p);
+ if (!db_c->cursor)
+ {
+ perror ("mongo_sync_cursor_new()");
+ exit (1);
+ }
+ return db_c;
+}
+
+struct results* read_data(struct db_cursor *db_c)
+{
+ struct results *res;
+ res = malloc(sizeof(struct results));
+ res->result = mongo_sync_cursor_get_data (db_c->cursor);
+ if (!res->result)
+ {
+ perror ("mongo_sync_cursor_get_data()");
+ exit (1);
+ }
+ return res;
+}
+
+gboolean cursor_next (struct db_cursor *db_c)
+{
+ if (!mongo_sync_cursor_next (db_c->cursor))
+ return FALSE;
+ else
+ return TRUE;
+
+}
+
+int main (int argc, char *argv[])
+{
+
+ struct queryopt opt;
+ struct ofields *fields;
+ struct bson_doc *doc;
+ struct select_doc *s_doc;
+ struct query_doc *qu_doc;
+ struct db_connect *db_conn;
+ struct output *out;
+ struct db_cursor *db_c;
+ struct results *res;
+
+ opt.e_skip = 0; // standard
+ opt.e_ret = 0; // standard
+ opt.bsever = 0;
+ opt.blevel = 0;
+ opt.bdate = 0;
+ opt.bdateu = 0;
+ opt.bdatef = 0;
+ opt.bmsg = 0;
+ opt.bskip = 0;
+ opt.bsys = 0;
+
+ getoptions(argc, argv, &opt);
+ qu_doc = create_query(&opt); // crate query
+ s_doc = create_select();
+ db_conn = create_conn(); // create connection
+ out = launch_query(&opt, s_doc, qu_doc, db_conn); // launch the query
+ db_c = open_cursor(db_conn, out); // open cursor
+
+ while (cursor_next(db_c))
+ {
+ res = read_data(db_c);
+ fields = get_data(res);
+ formater(fields); // formate output
+ free(fields);
+ }
+
+ free_cursor(db_c);
+ close_conn(db_conn);
+
+ return (0);
+}
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-25 11:55:12 +0000