Compare commits

..

No commits in common. "2f1fc7e526cd79e919baa495b9670de0a8d10cc8" and "079361c8cdff712375bfc650c44ad267f624e6fd" have entirely different histories.

2 changed files with 283 additions and 1107 deletions

1358
libbsm.go

File diff suppressed because it is too large Load Diff

32
main.go
View File

@ -1,7 +1,5 @@
// Copyright 2021, johan@nosd.in
//go:build freebsd
// +build freebsd
//
// godit is a search tool for BSM audit trails used by FreeBSD auditd
//
@ -33,27 +31,27 @@ import (
)
const (
version = "5.9.9a"
version = "0.5.1"
)
var (
randFlag bool
showVersion bool
randFlag bool
showVersion bool
// Default delimiter
delimiter = ","
delimiter = ","
)
func main() {
var flags int
var oneLine bool
var noUserResolve bool
var timestamp bool
var json bool
pflag.BoolVarP(&oneLine, "oneline", "l", false, "Prints the entire record on the same line. If this option is not specified, every token is displayed on a different line.")
pflag.BoolVarP(&noUserResolve, "numeric", "n", false, "Do not convert user and group IDs to their names but leave in their numeric forms.")
pflag.BoolVarP(&json, "json", "j", false, "Print compact json")
pflag.BoolVarP(&timestamp, "timestamp", "t", false, "Print unix timestamp instead of formatted date/time.")
pflag.BoolVarP(&showVersion, "version", "V", false, "Show version then exit")
pflag.Parse()
@ -62,22 +60,26 @@ func main() {
fmt.Printf("Godit v%s\n", version)
return
}
if oneLine {
flags = flags + PRT_ONELINE
}
if noUserResolve {
flags = flags + PRT_NORESOLVE_USER
}
if timestamp {
flags = flags + PRT_TIMESTAMP
}
if json {
flags |= PRT_JSON
}
args := os.Args
filename := args[len(args)-1]
/* fmt.Printf("Args: %s\n", args)
fmt.Printf("Filename: %s\n", filename)
*/
var f *os.File
var r *bufio.Reader
var err error
@ -89,7 +91,7 @@ func main() {
f, err = os.Open(filename)
if err != nil {
fmt.Printf("Impossible d'ouvrir le fichier %s\n", filename)
os.Exit(-1)
return
}
r = bufio.NewReader(f)
}
@ -100,7 +102,7 @@ func main() {
if err != nil {
if err != io.EOF {
fmt.Printf("Erreur : %v\n", err)
} else { // v.0.4.2 : Continue on error
} else { // v.0.4.2 : Continue on error
return
}
}
@ -108,3 +110,5 @@ func main() {
}
}
}