libbsm/main.go

// Copyright 2021, johan@nosd.in
// +build freebsd
//
// godit is a search tool for BSM audit trails used by FreeBSD auditd
//

/*
% time ./godit 20211228134923.20211228151348 > godit.log
11.599u 38.235s 0:48.25 103.2%  1045+553k 1+2262168io 4pf+0w
% time praudit -l /home/yo/Dev/go/godit/20211228134923.20211228151348 > praudit.log
101.728u 7.315s 1:49.09 99.9%   10+167k 0+191152io 0pf+0w
% ./godit -V
Godit v0.03
*/

package main

import (
	"io"
	"os"
	"fmt"
	"github.com/spf13/pflag"
)

const (
	version = "0.03"
)

var (
	randFlag	bool
	showVersion	bool

	// Default delimiter
	delimiter	= ","
)


func main() {
	var flags int
	var oneLine bool
	var noUserResolve bool

	pflag.BoolVarP(&oneLine, "oneline", "l", false, "Prints the entire record on the same line. If this option is not specified, every token is displayed on a different line.")
	pflag.BoolVarP(&noUserResolve, "numeric", "n", false, "Do not convert user and group IDs to their names but leave in their numeric forms.")
	pflag.BoolVarP(&showVersion, "version", "V", false, "Show version then exit")

	pflag.Parse()

	if showVersion {
		fmt.Printf("Godit v%s\n", version)
		return
	}

	if oneLine {
		flags = flags + PRT_ONELINE
	}

	if noUserResolve {
		flags = flags + PRT_NORESOLVE_USER
	}

	args := os.Args

	filename := args[len(args)-1]
	
/*	fmt.Printf("Args: %s\n", args)
	fmt.Printf("Filename: %s\n", filename)
*/
	
	if len(filename) > 0 {
/*		err := print_tokens(filename)
		if err != nil {
		:q
		fmt.Printf("Erreur dans print_tokens: %s\n", err.Error())
			return
		}
	}
*/
		f, err := os.Open(filename)
		if err != nil {
			fmt.Printf("Impossible d'ouvrir le fichier %s\n", filename)
			return
		}
		//for i := 0 ; i < 20 ; i++ {
		for {
			rec, err := readRecordToStruct(f)
			if err != nil {
				if err != io.EOF {
					fmt.Printf("Erreur : %v\n", err)
				}
				return
			}
			rec.Print(os.Stdout, ",", flags)
		}
	}
}