1EVENTLOGADM(8) System Administration tools EVENTLOGADM(8)
2
3
4
6 eventlogadm - push records into the Samba event log store
7
9 eventlogadm [-s] [-d] [-h] -o addsource EVENTLOG SOURCENAME MSGFILE
10
11 eventlogadm [-s] [-d] [-h] -o write EVENTLOG
12
13 eventlogadm [-s] [-d] [-h] -o dump EVENTLOG RECORD_NUMBER
14
16 This tool is part of the samba(1) suite.
17
18 eventlogadm is a filter that accepts formatted event log records on
19 standard input and writes them to the Samba event log store. Windows
20 client can then manipulate these record using the usual administration
21 tools.
22
24 -s FILENAME
25 The -s option causes eventlogadm to load the configuration file
26 given as FILENAME instead of the default one used by Samba.
27
28 -d
29 The -d option causes eventlogadm to emit debugging information.
30
31 -o addsource EVENTLOG SOURCENAME MSGFILE
32 The -o addsource option creates a new event log source.
33
34 -o write EVENTLOG
35 The -o write reads event log records from standard input and writes
36 them to the Samba event log store named by EVENTLOG.
37
38 -o dump EVENTLOG RECORD_NUMBER
39 The -o dump reads event log records from a EVENTLOG tdb and dumps
40 them to standard output on screen.
41
42 -h
43 Print usage information.
44
46 For the write operation, eventlogadm expects to be able to read
47 structured records from standard input. These records are a sequence of
48 lines, with the record key and data separated by a colon character.
49 Records are separated by at least one or more blank line.
50
51 The event log record field are:
52
53 • LEN - This field should be 0, since eventlogadm will
54 calculate this value.
55
56 • RS1 - This must be the value 1699505740.
57
58 • RCN - This field should be 0.
59
60 • TMG - The time the eventlog record was generated; format is
61 the number of seconds since 00:00:00 January 1, 1970, UTC.
62
63 • TMW - The time the eventlog record was written; format is
64 the number of seconds since 00:00:00 January 1, 1970, UTC.
65
66 • EID - The eventlog ID.
67
68 • ETP - The event type -- one of "INFO", "ERROR", "WARNING",
69 "AUDIT SUCCESS" or "AUDIT FAILURE".
70
71 • ECT - The event category; this depends on the message file.
72 It is primarily used as a means of filtering in the eventlog
73 viewer.
74
75 • RS2 - This field should be 0.
76
77 • CRN - This field should be 0.
78
79 • USL - This field should be 0.
80
81 • SRC - This field contains the source name associated with
82 the event log. If a message file is used with an event log,
83 there will be a registry entry for associating this source
84 name with a message file DLL.
85
86 • SRN - The name of the machine on which the eventlog was
87 generated. This is typically the host name.
88
89 • STR - The text associated with the eventlog. There may be
90 more than one string in a record.
91
92 • DAT - This field should be left unset.
93
95 An example of the record format accepted by eventlogadm:
96
97 LEN: 0
98 RS1: 1699505740
99 RCN: 0
100 TMG: 1128631322
101 TMW: 1128631322
102 EID: 1000
103 ETP: INFO
104 ECT: 0
105 RS2: 0
106 CRN: 0
107 USL: 0
108 SRC: cron
109 SRN: dmlinux
110 STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
111 DAT:
112
113
114 Set up an eventlog source, specifying a message file DLL:
115
116 eventlogadm -o addsource Application MyApplication | \\
117 %SystemRoot%/system32/MyApplication.dll
118
119
120 Filter messages from the system log into an event log:
121
122 tail -f /var/log/messages | \\
123 my_program_to_parse_into_eventlog_records | \\
124 eventlogadm SystemLogEvents
125
126
128 This man page is part of version 4.18.9 of the Samba suite.
129
131 The original Samba software and related utilities were created by
132 Andrew Tridgell. Samba is now developed by the Samba Team as an Open
133 Source project similar to the way the Linux kernel is developed.
134
135
136
137Samba 4.18.9 11/30/2023 EVENTLOGADM(8)