3 Commits
v.0.3 ... v.0.5

Author SHA1 Message Date
yo
54f64d9101 Bump version to v.0.5 2022-01-10 17:52:20 +01:00
yo
9e675658b6 Use bufio.NewReader so we can read pipe (/dev/auditpipe or stdin) 2022-01-10 17:51:12 +01:00
yo
417f387f3c add timestamp switch, bump version to 0.4 2022-01-06 17:56:28 +01:00
2 changed files with 331 additions and 398 deletions

677
libbsm.go

File diff suppressed because it is too large Load Diff

52
main.go
View File

@ -5,12 +5,18 @@
// //
/* /*
% time ./godit 20211228134923.20211228151348 > godit.log
11.599u 38.235s 0:48.25 103.2% 1045+553k 1+2262168io 4pf+0w
% time praudit -l /home/yo/Dev/go/godit/20211228134923.20211228151348 > praudit.log % time praudit -l /home/yo/Dev/go/godit/20211228134923.20211228151348 > praudit.log
101.728u 7.315s 1:49.09 99.9% 10+167k 0+191152io 0pf+0w 101.728u 7.315s 1:49.09 99.9% 10+167k 0+191152io 0pf+0w
% time ./godit 20211228134923.20211228151348 > godit.log
11.599u 38.235s 0:48.25 103.2% 1045+553k 1+2262168io 4pf+0w
% ./godit -V % ./godit -V
Godit v0.03 Godit v0.03
% time ./godit 20211228134923.20211228151348 > 20211228134923.20211228151348.godit3
7.183u 19.590s 0:25.98 103.0% 1038+559k 0+2262168io 0pf+0w
% ./godit -V
Godit v0.4.3
*/ */
package main package main
@ -19,11 +25,13 @@ import (
"io" "io"
"os" "os"
"fmt" "fmt"
"bufio"
"strings"
"github.com/spf13/pflag" "github.com/spf13/pflag"
) )
const ( const (
version = "0.03" version = "0.5"
) )
var ( var (
@ -39,9 +47,11 @@ func main() {
var flags int var flags int
var oneLine bool var oneLine bool
var noUserResolve bool var noUserResolve bool
var timestamp bool
pflag.BoolVarP(&oneLine, "oneline", "l", false, "Prints the entire record on the same line. If this option is not specified, every token is displayed on a different line.") pflag.BoolVarP(&oneLine, "oneline", "l", false, "Prints the entire record on the same line. If this option is not specified, every token is displayed on a different line.")
pflag.BoolVarP(&noUserResolve, "numeric", "n", false, "Do not convert user and group IDs to their names but leave in their numeric forms.") pflag.BoolVarP(&noUserResolve, "numeric", "n", false, "Do not convert user and group IDs to their names but leave in their numeric forms.")
pflag.BoolVarP(&timestamp, "timestamp", "t", false, "Print unix timestamp instead of formatted date/time.")
pflag.BoolVarP(&showVersion, "version", "V", false, "Show version then exit") pflag.BoolVarP(&showVersion, "version", "V", false, "Show version then exit")
pflag.Parse() pflag.Parse()
@ -59,36 +69,42 @@ func main() {
flags = flags + PRT_NORESOLVE_USER flags = flags + PRT_NORESOLVE_USER
} }
args := os.Args if timestamp {
flags = flags + PRT_TIMESTAMP
}
args := os.Args
filename := args[len(args)-1] filename := args[len(args)-1]
/* fmt.Printf("Args: %s\n", args) /* fmt.Printf("Args: %s\n", args)
fmt.Printf("Filename: %s\n", filename) fmt.Printf("Filename: %s\n", filename)
*/ */
var f *os.File
var r *bufio.Reader
var err error
if len(filename) > 0 { if len(filename) > 0 {
/* err := print_tokens(filename) // If arg is "-", open stdin to read content
if err != nil { if true == strings.EqualFold(filename, "-") {
:q r = bufio.NewReader(os.Stdin)
fmt.Printf("Erreur dans print_tokens: %s\n", err.Error()) } else {
return f, err = os.Open(filename)
} if err != nil {
} fmt.Printf("Impossible d'ouvrir le fichier %s\n", filename)
*/ return
f, err := os.Open(filename) }
if err != nil { r = bufio.NewReader(f)
fmt.Printf("Impossible d'ouvrir le fichier %s\n", filename)
return
} }
//for i := 0 ; i < 20 ; i++ { //for i := 0 ; i < 20 ; i++ {
for { for {
rec, err := readRecordToStruct(f) rec, err := readRecordToStruct(r)
if err != nil { if err != nil {
if err != io.EOF { if err != io.EOF {
fmt.Printf("Erreur : %v\n", err) fmt.Printf("Erreur : %v\n", err)
} else { // v.0.4.2 : Continue on error
return
} }
return
} }
rec.Print(os.Stdout, ",", flags) rec.Print(os.Stdout, ",", flags)
} }