1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
25 * Copyright (c) 2013, Joyent, Inc. All rights reserved.
26 * Copyright 2024 Oxide Computer Co.
27 */
28
29 #include <alloca.h>
30 #include <unistd.h>
31 #include <limits.h>
32 #include <strings.h>
33 #include <stdlib.h>
34 #include <stdarg.h>
35 #include <stdio.h>
36 #include <errno.h>
37 #include <time.h>
38 #include <ctype.h>
39 #include <regex.h>
40 #include <dirent.h>
41 #include <pthread.h>
42
43 #include <fmdump.h>
44
45 #define FMDUMP_EXIT_SUCCESS 0
46 #define FMDUMP_EXIT_FATAL 1
47 #define FMDUMP_EXIT_USAGE 2
48 #define FMDUMP_EXIT_ERROR 3
49
50 const char *g_pname;
51 ulong_t g_errs;
52 ulong_t g_recs;
53 char *g_root;
54
55 struct topo_hdl *g_thp;
56 fmd_msg_hdl_t *g_msg;
57
58 /*PRINTFLIKE2*/
59 void
fmdump_printf(FILE * fp,const char * format,...)60 fmdump_printf(FILE *fp, const char *format, ...)
61 {
62 va_list ap;
63
64 va_start(ap, format);
65
66 if (vfprintf(fp, format, ap) < 0) {
67 (void) fprintf(stderr, "%s: failed to print record: %s\n",
68 g_pname, strerror(errno));
69 g_errs++;
70 }
71
72 va_end(ap);
73 }
74
75 void
fmdump_vwarn(const char * format,va_list ap)76 fmdump_vwarn(const char *format, va_list ap)
77 {
78 int err = errno;
79
80 (void) fprintf(stderr, "%s: warning: ", g_pname);
81 (void) vfprintf(stderr, format, ap);
82
83 if (strchr(format, '\n') == NULL)
84 (void) fprintf(stderr, ": %s\n", strerror(err));
85
86 g_errs++;
87 }
88
89 /*PRINTFLIKE1*/
90 void
fmdump_warn(const char * format,...)91 fmdump_warn(const char *format, ...)
92 {
93 va_list ap;
94
95 va_start(ap, format);
96 fmdump_vwarn(format, ap);
97 va_end(ap);
98 }
99
100 static void
fmdump_exit(int err,int exitcode,const char * format,va_list ap)101 fmdump_exit(int err, int exitcode, const char *format, va_list ap)
102 {
103 (void) fprintf(stderr, "%s: ", g_pname);
104
105 (void) vfprintf(stderr, format, ap);
106
107 if (strchr(format, '\n') == NULL)
108 (void) fprintf(stderr, ": %s\n", strerror(err));
109
110 exit(exitcode);
111 }
112
113 /*PRINTFLIKE1*/
114 static void
fmdump_fatal(const char * format,...)115 fmdump_fatal(const char *format, ...)
116 {
117 int err = errno;
118
119 va_list ap;
120
121 va_start(ap, format);
122 fmdump_exit(err, FMDUMP_EXIT_FATAL, format, ap);
123 va_end(ap);
124 }
125
126 /*PRINTFLIKE1*/
127 static void
fmdump_usage(const char * format,...)128 fmdump_usage(const char *format, ...)
129 {
130
131 int err = errno;
132
133 va_list ap;
134
135 va_start(ap, format);
136 fmdump_exit(err, FMDUMP_EXIT_USAGE, format, ap);
137 va_end(ap);
138 }
139
140 char *
fmdump_date(char * buf,size_t len,const fmd_log_record_t * rp)141 fmdump_date(char *buf, size_t len, const fmd_log_record_t *rp)
142 {
143 if (rp->rec_sec > LONG_MAX) {
144 fmdump_warn("record time is too large for 32-bit utility\n");
145 (void) snprintf(buf, len, "0x%llx", rp->rec_sec);
146 } else {
147 time_t tod = (time_t)rp->rec_sec;
148 time_t now = time(NULL);
149 if (tod > now+60 ||
150 tod < now - 6L*30L*24L*60L*60L) { /* 6 months ago */
151 (void) strftime(buf, len, "%b %d %Y %T",
152 localtime(&tod));
153 } else {
154 size_t sz;
155 sz = strftime(buf, len, "%b %d %T", localtime(&tod));
156 (void) snprintf(buf + sz, len - sz, ".%4.4llu",
157 rp->rec_nsec / (NANOSEC / 10000));
158 }
159 }
160
161 return (buf);
162 }
163
164 char *
fmdump_year(char * buf,size_t len,const fmd_log_record_t * rp)165 fmdump_year(char *buf, size_t len, const fmd_log_record_t *rp)
166 {
167 #ifdef _ILP32
168 if (rp->rec_sec > LONG_MAX) {
169 fmdump_warn("record time is too large for 32-bit utility\n");
170 (void) snprintf(buf, len, "0x%llx", rp->rec_sec);
171 } else {
172 #endif
173 time_t tod = (time_t)rp->rec_sec;
174 (void) strftime(buf, len, "%b %d %Y %T", localtime(&tod));
175 #ifdef _ILP32
176 }
177 #endif
178 return (buf);
179 }
180
181 /* BEGIN CSTYLED */
182 static const char *synopsis =
183 "Usage: %s [[-e | -i | -I | -u] | -A ] [-f] [-aHmvVp] [-c class] [-R root]\n"
184 "\t [-t time] [-T time] [-u uuid] [-n name[.name]*[=value]]\n"
185 "\t [-N name[.name]*[=value][;name[.name]*[=value]]*] "
186 "[file]...\n "
187 "Log selection: [-e | -i | -I] or one [file]; default is the fault log\n"
188 "\t-e display error log content\n"
189 "\t-i display infolog content\n"
190 "\t-I display the high-value-infolog content\n"
191 "\t-R set root directory for pathname expansions\n "
192 "Command behaviour:\n"
193 "\t-A Aggregate specified [file]s or, if no [file], all known logs\n"
194 "\t-H display the log's header attributes instead of contents\n"
195 "\t-f follow growth of log file by waiting for additional data\n "
196 "Output options:\n"
197 "\t-j Used with -V: emit JSON-formatted output\n"
198 "\t-m display human-readable messages (only for fault logs)\n"
199 "\t-p Used with -V: apply some output prettification\n"
200 "\t-v set verbose mode: display additional event detail\n"
201 "\t-V set very verbose mode: display complete event contents\n "
202 "Selection filters:\n"
203 "\t-a select all events, including normally silent events\n"
204 "\t-c select events that match the specified class\n"
205 "\t-n select events containing named nvpair (with matching value)\n"
206 "\t-N select events matching multiple property names (or nvpairs)\n"
207 "\t-t select events that occurred after the specified time\n"
208 "\t-T select events that occurred before the specified time\n"
209 "\t-u select events that match the specified diagnosis uuid\n";
210 /* END CSTYLED */
211
212 static int
usage(FILE * fp)213 usage(FILE *fp)
214 {
215 (void) fprintf(fp, synopsis, g_pname);
216 return (FMDUMP_EXIT_USAGE);
217 }
218
219 /*ARGSUSED*/
220 static int
error(fmd_log_t * lp,void * private)221 error(fmd_log_t *lp, void *private)
222 {
223 fmdump_warn("skipping record: %s\n",
224 fmd_log_errmsg(lp, fmd_log_errno(lp)));
225 return (0);
226 }
227
228 /*
229 * Yet another disgusting argument parsing function (TM). We attempt to parse
230 * a time argument in a variety of strptime(3C) formats, in which case it is
231 * interpreted as a local time and is converted to a timeval using mktime(3C).
232 * If those formats fail, we look to see if the time is a decimal integer
233 * followed by one of our magic suffixes, in which case the time is interpreted
234 * as a time delta *before* the current time-of-day (i.e. "1h" = "1 hour ago").
235 */
236 static struct timeval *
gettimeopt(const char * arg)237 gettimeopt(const char *arg)
238 {
239 const struct {
240 const char *name;
241 hrtime_t mul;
242 } suffix[] = {
243 { "ns", NANOSEC / NANOSEC },
244 { "nsec", NANOSEC / NANOSEC },
245 { "us", NANOSEC / MICROSEC },
246 { "usec", NANOSEC / MICROSEC },
247 { "ms", NANOSEC / MILLISEC },
248 { "msec", NANOSEC / MILLISEC },
249 { "s", NANOSEC / SEC },
250 { "sec", NANOSEC / SEC },
251 { "m", NANOSEC * (hrtime_t)60 },
252 { "min", NANOSEC * (hrtime_t)60 },
253 { "h", NANOSEC * (hrtime_t)(60 * 60) },
254 { "hour", NANOSEC * (hrtime_t)(60 * 60) },
255 { "d", NANOSEC * (hrtime_t)(24 * 60 * 60) },
256 { "day", NANOSEC * (hrtime_t)(24 * 60 * 60) },
257 { NULL }
258 };
259
260 struct timeval *tvp = malloc(sizeof (struct timeval));
261 struct timeval tod;
262 struct tm tm;
263 char *p;
264
265 if (tvp == NULL)
266 fmdump_fatal("failed to allocate memory");
267
268 if (gettimeofday(&tod, NULL) != 0)
269 fmdump_fatal("failed to get tod");
270
271 /*
272 * First try a variety of strptime() calls. If these all fail, we'll
273 * try parsing an integer followed by one of our suffix[] strings.
274 */
275 if ((p = strptime(arg, "%m/%d/%Y %H:%M:%S", &tm)) == NULL &&
276 (p = strptime(arg, "%m/%d/%y %H:%M:%S", &tm)) == NULL &&
277 (p = strptime(arg, "%m/%d/%Y %H:%M", &tm)) == NULL &&
278 (p = strptime(arg, "%m/%d/%y %H:%M", &tm)) == NULL &&
279 (p = strptime(arg, "%m/%d/%Y", &tm)) == NULL &&
280 (p = strptime(arg, "%m/%d/%y", &tm)) == NULL &&
281 (p = strptime(arg, "%Y-%m-%dT%H:%M:%S", &tm)) == NULL &&
282 (p = strptime(arg, "%y-%m-%dT%H:%M:%S", &tm)) == NULL &&
283 (p = strptime(arg, "%Y-%m-%dT%H:%M", &tm)) == NULL &&
284 (p = strptime(arg, "%y-%m-%dT%H:%M", &tm)) == NULL &&
285 (p = strptime(arg, "%Y-%m-%d", &tm)) == NULL &&
286 (p = strptime(arg, "%y-%m-%d", &tm)) == NULL &&
287 (p = strptime(arg, "%d%b%Y %H:%M:%S", &tm)) == NULL &&
288 (p = strptime(arg, "%d%b%y %H:%M:%S", &tm)) == NULL &&
289 (p = strptime(arg, "%d%b%Y %H:%M", &tm)) == NULL &&
290 (p = strptime(arg, "%d%b%y %H:%M", &tm)) == NULL &&
291 (p = strptime(arg, "%d%b%Y", &tm)) == NULL &&
292 (p = strptime(arg, "%d%b%y", &tm)) == NULL &&
293 (p = strptime(arg, "%b %d %H:%M:%S", &tm)) == NULL &&
294 (p = strptime(arg, "%b %d %H:%M:%S", &tm)) == NULL &&
295 (p = strptime(arg, "%H:%M:%S", &tm)) == NULL &&
296 (p = strptime(arg, "%H:%M", &tm)) == NULL) {
297
298 hrtime_t nsec;
299 int i;
300
301 errno = 0;
302 nsec = strtol(arg, (char **)&p, 10);
303
304 if (errno != 0 || nsec == 0 || p == arg || *p == '\0')
305 fmdump_usage("illegal time format -- %s\n", arg);
306
307 for (i = 0; suffix[i].name != NULL; i++) {
308 if (strcasecmp(suffix[i].name, p) == 0) {
309 nsec *= suffix[i].mul;
310 break;
311 }
312 }
313
314 if (suffix[i].name == NULL)
315 fmdump_usage("illegal time format -- %s\n", arg);
316
317 tvp->tv_sec = nsec / NANOSEC;
318 tvp->tv_usec = (nsec % NANOSEC) / (NANOSEC / MICROSEC);
319
320 if (tvp->tv_sec > tod.tv_sec)
321 fmdump_usage("time delta precedes UTC time origin "
322 "-- %s\n", arg);
323
324 tvp->tv_sec = tod.tv_sec - tvp->tv_sec;
325
326 } else if (*p == '\0' || *p == '.') {
327 /*
328 * If tm_year is zero, we matched [%b %d] %H:%M[:%S]; use
329 * the result of localtime(&tod.tv_sec) to fill in the rest.
330 */
331 if (tm.tm_year == 0) {
332 int h = tm.tm_hour;
333 int m = tm.tm_min;
334 int s = tm.tm_sec;
335 int b = tm.tm_mon;
336 int d = tm.tm_mday;
337
338 bcopy(localtime(&tod.tv_sec), &tm, sizeof (tm));
339 tm.tm_isdst = 0; /* see strptime(3C) and below */
340
341 if (d > 0) {
342 tm.tm_mon = b;
343 tm.tm_mday = d;
344 }
345
346 tm.tm_hour = h;
347 tm.tm_min = m;
348 tm.tm_sec = s;
349 }
350
351 errno = 0;
352 tvp->tv_sec = mktime(&tm);
353 tvp->tv_usec = 0;
354
355 if (tvp->tv_sec == -1L && errno != 0)
356 fmdump_fatal("failed to compose time %s", arg);
357
358 /*
359 * If our mktime() set tm_isdst, adjust the result for DST by
360 * subtracting the offset between the main and alternate zones.
361 */
362 if (tm.tm_isdst)
363 tvp->tv_sec -= timezone - altzone;
364
365 if (p[0] == '.') {
366 arg = p;
367 errno = 0;
368 tvp->tv_usec =
369 (suseconds_t)(strtod(arg, &p) * (double)MICROSEC);
370
371 if (errno != 0 || p == arg || *p != '\0')
372 fmdump_usage("illegal time suffix -- .%s\n",
373 arg);
374 }
375
376 } else {
377 fmdump_usage("unexpected suffix after time %s -- %s\n", arg, p);
378 }
379
380 return (tvp);
381 }
382
383 /*
384 * If the -u option is specified in combination with the -e option, we iterate
385 * over each record in the fault log with a matching UUID finding xrefs to the
386 * error log, and then use this function to iterate over every xref'd record.
387 */
388 int
xref_iter(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)389 xref_iter(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
390 {
391 const fmd_log_record_t *xrp = rp->rec_xrefs;
392 fmdump_arg_t *dap = arg;
393 int i, rv = 0;
394
395 for (i = 0; rv == 0 && i < rp->rec_nrefs; i++, xrp++) {
396 if (fmd_log_filter(lp, dap->da_fc, dap->da_fv, xrp))
397 rv = dap->da_fmt->do_func(lp, xrp, dap->da_fp);
398 }
399
400 return (rv);
401 }
402
403 int
xoff_iter(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)404 xoff_iter(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
405 {
406 fmdump_lyr_t *dyp = arg;
407
408 fmdump_printf(dyp->dy_fp, "%16llx ", (u_longlong_t)rp->rec_off);
409 return (dyp->dy_func(lp, rp, dyp->dy_arg));
410 }
411
412 /*
413 * Initialize fmd_log_filter_nvarg_t from -n name=value argument string.
414 */
415 static fmd_log_filter_nvarg_t *
setupnamevalue(char * namevalue)416 setupnamevalue(char *namevalue)
417 {
418 fmd_log_filter_nvarg_t *argt;
419 char *value;
420 regex_t *value_regex = NULL;
421 char errstr[128];
422 int rv;
423
424 if ((value = strchr(namevalue, '=')) == NULL) {
425 value_regex = NULL;
426 } else {
427 *value++ = '\0'; /* separate name and value string */
428
429 /*
430 * Skip white space before value to facilitate direct
431 * cut/paste from previous fmdump output.
432 */
433 while (isspace(*value))
434 value++;
435
436 if ((value_regex = malloc(sizeof (regex_t))) == NULL)
437 fmdump_fatal("failed to allocate memory");
438
439 /* compile regular expression for possible string match */
440 if ((rv = regcomp(value_regex, value,
441 REG_NOSUB|REG_NEWLINE)) != 0) {
442 (void) regerror(rv, value_regex, errstr,
443 sizeof (errstr));
444 free(value_regex);
445 fmdump_usage("unexpected regular expression in "
446 "%s: %s\n", value, errstr);
447 }
448 }
449
450 if ((argt = calloc(1, sizeof (fmd_log_filter_nvarg_t))) == NULL)
451 fmdump_fatal("failed to allocate memory");
452
453 argt->nvarg_name = namevalue; /* now just name */
454 argt->nvarg_value = value;
455 argt->nvarg_value_regex = value_regex;
456 return (argt);
457 }
458
459 /*
460 * As for setupnamevalue() above, create our chain of filter arguments for -N
461 * [name[=value][;name[=value]]*. This would be simple except for the problems
462 * of escaping something in a string. To accommodate the use of the ; within
463 * the chain, we allow it to be escaped. One might imagine that the backslash
464 * character should be used to escape it, but that opens Pandora's box because
465 * the value portion of each entry (if present) is allowed to be a regex. The
466 * treatment of backslashes within regexes is not something we want to replicate
467 * here, which would be necessary if we wanted to allow escaping the ; with a
468 * backslash. Specifically, consider how we treat the sequence of characters
469 * '\\;x' (two backslash characters followed by a semicolon and then some other
470 * character x). In the name portion of the entry, this would be a backslash
471 * followed by an escaped semicolon, so that we would treat this as '\;' and
472 * include x and subsequent characters in this entry. In the value portion (if
473 * present), we would have to treat it as a pair of backslashes followed by the
474 * terminating ; and the next entry would begin with 'x'... except that we
475 * might be inside [] where the backslash is not special, and so on.
476 *
477 * Let's not do that. Instead, we allow the user to 'escape' the ; by repeating
478 * it, and we interpret that before any regex interpretation is done. Therefore
479 * *every* pair of consecutive semicolons, regardless of where it appears, is
480 * replaced by a literal semicolon. This allows the semicolon to appear any
481 * number of times in either the name or, if present, the value, including as
482 * part of a regex (see regexp(7)), simply by doubling it. A non-doubled
483 * semicolon always terminates the entry. This now creates one more problem:
484 * whether to treat ';;;' as a literal semicolon followed by the entry
485 * terminator, or the entry terminator followed by a literal semicolon to start
486 * the next entry. Here we have to cheat a little: it's clear from the FMD PRM
487 * (especially chapter 10 as well as the schema for module properties, buffers,
488 * statistics, and other entities) that the event member namespace is intended
489 * to exclude both the semicolon and whitespace. A value, or a regex intended
490 * to match values, might well include anything. Therefore, a semicolon at the
491 * beginning of an entry is unlikely to be useful, while one at the end of an
492 * entry may well be intentional. We'll allow either or both when unambiguous,
493 * but a sequence containing an odd number of consecutive ';' characters will be
494 * interpreted as half that number of literal semicolons (rounded down) followed
495 * by the terminator. If the user wishes to begin an event property name with a
496 * semicolon, it needs to be the first property in the chain. Chains with
497 * multiple properties whose names begin with a literal semicolon are not
498 * supported. Again, this almost certainly can never matter as no event should
499 * ever have a property whose name contains a semicolon.
500 *
501 * We choose the semicolon because the comma is very likely to be present in
502 * some property values on which the user may want to filter, especially the
503 * name of device paths. The semicolon may itself appear in values, especially
504 * if the property is a URI, though it is likely much less common. We have to
505 * pick something. If this proves unwieldy or insufficiently expressive, it
506 * will need to be replaced by a full-on logical expression parser with
507 * first-class support for internal quoting, escaping, and regexes. One might
508 * be better off dumping JSON and importing it into a SQL database if that level
509 * of complexity is required.
510 */
511
512 static fmd_log_filter_nvarg_t *
setupnamevalue_multi(char * chainstr)513 setupnamevalue_multi(char *chainstr)
514 {
515 fmd_log_filter_nvarg_t *argchain = NULL;
516 size_t rem = strlen(chainstr) + 1;
517 fmd_log_filter_nvarg_t *argt;
518
519 /*
520 * Here, rem holds the number of characters remaining that we are
521 * permitted to examine, including the terminating NUL. If the first
522 * entry begins with a single semicolon, it is considered empty and
523 * ignored. Similarly, a trailing semicolon is optional and ignored if
524 * present. We won't create empty filter entries for any input.
525 */
526 for (char *nv = chainstr; rem > 0; ++chainstr, --rem) {
527 switch (*chainstr) {
528 case ';':
529 ASSERT(rem > 1);
530
531 /*
532 * Check for double-semicolon. If found,
533 * de-duplicate it and advance past, then continue the
534 * loop: we can't be done yet.
535 */
536 if (chainstr[1] == ';') {
537 ASSERT(rem > 2);
538 --rem;
539 (void) memmove(chainstr, chainstr + 1, rem);
540 break;
541 }
542
543 *chainstr = '\0';
544
545 /*FALLTHROUGH*/
546 case '\0':
547 if (chainstr != nv) {
548 argt = setupnamevalue(nv);
549 argt->nvarg_next = argchain;
550 argchain = argt;
551 }
552 nv = chainstr + 1;
553
554 /*FALLTHROUGH*/
555 default:
556 ASSERT(rem > 0);
557 }
558 }
559
560 return (argchain);
561 }
562
563 /*
564 * If the -a option is not present, filter out fault records that correspond
565 * to events that the producer requested not be messaged for administrators.
566 */
567 /*ARGSUSED*/
568 int
log_filter_silent(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)569 log_filter_silent(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
570 {
571 int opt_A = (arg != NULL);
572 boolean_t msg;
573 char *class;
574
575 /*
576 * If -A was used then apply this filter only to events of list class
577 */
578 if (opt_A) {
579 if (nvlist_lookup_string(rp->rec_nvl, FM_CLASS, &class) != 0 ||
580 strncmp(class, FM_LIST_EVENT ".",
581 sizeof (FM_LIST_EVENT)) != 0)
582 return (1);
583 }
584
585 return (nvlist_lookup_boolean_value(rp->rec_nvl,
586 FM_SUSPECT_MESSAGE, &msg) != 0 || msg != 0);
587 }
588
589 struct loglink {
590 char *path;
591 long suffix;
592 struct loglink *next;
593 };
594
595 static void
addlink(struct loglink ** llp,char * dirname,char * logname,long suffix)596 addlink(struct loglink **llp, char *dirname, char *logname, long suffix)
597 {
598 struct loglink *newp;
599 size_t len;
600 char *str;
601
602 newp = malloc(sizeof (struct loglink));
603 len = strlen(dirname) + strlen(logname) + 2;
604 str = malloc(len);
605 if (newp == NULL || str == NULL)
606 fmdump_fatal("failed to allocate memory");
607
608 (void) snprintf(str, len, "%s/%s", dirname, logname);
609 newp->path = str;
610 newp->suffix = suffix;
611
612 while (*llp != NULL && suffix < (*llp)->suffix)
613 llp = &(*llp)->next;
614
615 newp->next = *llp;
616 *llp = newp;
617 }
618
619 /*
620 * Find and return all the rotated logs.
621 */
622 static struct loglink *
get_rotated_logs(char * logpath)623 get_rotated_logs(char *logpath)
624 {
625 char dirname[PATH_MAX], *logname, *endptr;
626 DIR *dirp;
627 struct dirent *dp;
628 long len, suffix;
629 struct loglink *head = NULL;
630
631 (void) strlcpy(dirname, logpath, sizeof (dirname));
632 logname = strrchr(dirname, '/');
633 *logname++ = '\0';
634 len = strlen(logname);
635
636 if ((dirp = opendir(dirname)) == NULL) {
637 fmdump_warn("failed to opendir `%s'", dirname);
638 g_errs++;
639 return (NULL);
640 }
641
642 while ((dp = readdir(dirp)) != NULL) {
643 /*
644 * Search the log directory for logs named "<logname>.0",
645 * "<logname>.1", etc and add to the link in the
646 * reverse numeric order.
647 */
648 if (strlen(dp->d_name) < len + 2 ||
649 strncmp(dp->d_name, logname, len) != 0 ||
650 dp->d_name[len] != '.')
651 continue;
652
653 /*
654 * "*.0-" file normally should not be seen. It may
655 * exist when user manually run 'fmadm rotate'.
656 * In such case, we put it at the end of the list so
657 * it'll be dumped after all the rotated logs, before
658 * the current one.
659 */
660 if (strcmp(dp->d_name + len + 1, "0-") == 0)
661 addlink(&head, dirname, dp->d_name, -1);
662 else if ((suffix = strtol(dp->d_name + len + 1,
663 &endptr, 10)) >= 0 && *endptr == '\0')
664 addlink(&head, dirname, dp->d_name, suffix);
665 }
666
667 (void) closedir(dirp);
668
669 return (head);
670 }
671
672 /*
673 * Aggregate log files. If ifiles is not NULL then one or more files
674 * were listed on the command line, and we will merge just those files.
675 * Otherwise we will merge all known log file types, and include the
676 * rotated logs for each type (you can suppress the inclusion of
677 * some logtypes through use of FMDUMP_AGGREGATE_IGNORE in the process
678 * environment, setting it to a comma-separated list of log labels and/or
679 * log filenames to ignore).
680 *
681 * We will not attempt to perform a chronological sort across all log records
682 * of all files. Indeed, we won't even sort individual log files -
683 * we will not re-order events differently to how they appeared in their
684 * original log file. This is because log files are already inherently
685 * ordered by the order in which fmd receives and processes events.
686 * So we determine the output order by comparing the "next" record
687 * off the top of each log file.
688 *
689 * We will construct a number of log record source "pipelines". As above,
690 * the next record to render in the overall output is that from the
691 * pipeline with the oldest event.
692 *
693 * For the case that input logfiles were listed on the command line, each
694 * pipeline will process exactly one of those logfiles. Distinct pipelines
695 * may process logfiles of the same "type" - eg if two "error" logs and
696 * one "fault" logs are specified then there'll be two pipelines producing
697 * events from "error" logs.
698 *
699 * If we are merging all known log types then we will construct exactly
700 * one pipeline for each known log type - one for error, one for fault, etc.
701 * Each pipeline will process first the rotated logs of that type and then
702 * move on to the current log of that type.
703 *
704 * The output from all pipelines flows into a serializer which selects
705 * the next record once all pipelines have asserted their output state.
706 * The output state of a pipeline is one of:
707 *
708 * - record available: the next record from this pipeline is available
709 * for comparison and consumption
710 *
711 * - done: this pipeline will produce no more records
712 *
713 * - polling: this pipeline is polling for new records and will
714 * make them available as output if/when any are observed
715 *
716 * - processing: output state will be updated shortly
717 *
718 * A pipeline iterates over each file queued to it using fmd_log_xiter.
719 * We do this in a separate thread for each pipeline. The callback on
720 * each iteration must update the serializer to let it know that
721 * a new record is available. In the serializer thread we decide whether
722 * we have all records expected have arrived and it is time to choose
723 * the next output record.
724 */
725
726 /*
727 * A pipeline descriptor. The pl_cv condition variable is used together
728 * with pl_lock for initial synchronisation, and thereafter with the
729 * lock for the serializer for pausing and continuing this pipeline.
730 */
731 struct fmdump_pipeline {
732 pthread_mutex_t pl_lock; /* used only in pipeline startup */
733 int pl_started; /* sync with main thread on startup */
734 pthread_t pl_thr; /* our processing thread */
735 pthread_cond_t pl_cv; /* see above */
736 struct loglink *pl_rotated; /* rotated logs to process first */
737 char *pl_logpath; /* target path to process */
738 char *pl_processing; /* path currently being processed */
739 struct fmdump_srlzer *pl_srlzer; /* link to serializer */
740 int pl_srlzeridx; /* serializer index for this pipeline */
741 const fmdump_ops_t *pl_ops; /* ops for the log type we're given */
742 int pl_fmt; /* FMDUMP_{SHORT,VERB1,VERB2,PRETTY} */
743 boolean_t pl_follow; /* go into poll mode at log end */
744 fmdump_arg_t pl_arg; /* arguments */
745 };
746
747 enum fmdump_pipestate {
748 FMDUMP_PIPE_PROCESSING = 0x1000,
749 FMDUMP_PIPE_RECORDAVAIL,
750 FMDUMP_PIPE_POLLING,
751 FMDUMP_PIPE_DONE
752 };
753
754 /*
755 * Each pipeline has an associated output slot in the serializer. This
756 * must be updated with the serializer locked. After update evaluate
757 * whether there are enough slots decided that we should select a
758 * record to output.
759 */
760 struct fmdump_srlzer_slot {
761 enum fmdump_pipestate ss_state;
762 uint64_t ss_sec;
763 uint64_t ss_nsec;
764 };
765
766 /*
767 * All pipelines are linked to a single serializer. The serializer
768 * structure must be updated under the ds_lock; this mutex is also
769 * paired with the pl_cv of individual pipelines (one mutex, many condvars)
770 * in pausing and continuing individual pipelines.
771 */
772 struct fmdump_srlzer {
773 struct fmdump_pipeline *ds_pipearr; /* pipeline array */
774 pthread_mutex_t ds_lock; /* see above */
775 uint32_t ds_pipecnt; /* number of pipelines */
776 uint32_t ds_pollcnt; /* pipelines in poll mode */
777 uint32_t ds_nrecordavail; /* pipelines with a record */
778 uint32_t ds_ndone; /* completed pipelines */
779 struct fmdump_srlzer_slot *ds_slot; /* slot array */
780 };
781
782 /*
783 * All known log types. When aggregation is requested an no file list
784 * is provided we will process the logs identified here (if lt_enabled
785 * is true and not over-ridden by environment settings). We also
786 * use this in determining the appropriate ops structure for each distinct
787 * label.
788 */
789 static struct fmdump_logtype {
790 const char *lt_label; /* label from log header */
791 boolean_t lt_enabled; /* include in merge? */
792 const char *lt_logname; /* var/fm/fmd/%s */
793 const fmdump_ops_t *lt_ops;
794 } logtypes[] = {
795 {
796 "error",
797 B_TRUE,
798 "errlog",
799 &fmdump_err_ops
800 },
801 {
802 "fault",
803 B_TRUE,
804 "fltlog",
805 &fmdump_flt_ops
806 },
807 {
808 "info",
809 B_TRUE,
810 "infolog",
811 &fmdump_info_ops
812 },
813 {
814 "info",
815 B_TRUE,
816 "infolog_hival",
817 &fmdump_info_ops
818 },
819 {
820 "asru",
821 B_FALSE, /* not included unless in file list */
822 NULL,
823 &fmdump_asru_ops /* but we need ops when it is */
824 }
825 };
826
827 /*
828 * Disable logtypes per environment setting. Does not apply when a list
829 * of logs is provided on the command line.
830 */
831 static void
do_disables(void)832 do_disables(void)
833 {
834 char *env = getenv("FMDUMP_AGGREGATE_IGNORE");
835 char *dup, *start, *tofree;
836 int i;
837
838 if (env == NULL)
839 return;
840
841 tofree = dup = strdup(env);
842
843 while (dup != NULL) {
844 start = strsep(&dup, ",");
845 for (i = 0; i < sizeof (logtypes) / sizeof (logtypes[0]); i++) {
846 if (logtypes[i].lt_logname == NULL)
847 continue;
848
849 if (strcmp(start, logtypes[i].lt_label) == 0 ||
850 strcmp(start, logtypes[i].lt_logname) == 0) {
851 logtypes[i].lt_enabled = B_FALSE;
852 }
853 }
854 }
855
856 free(tofree);
857 }
858
859 static void
srlzer_enter(struct fmdump_pipeline * pl)860 srlzer_enter(struct fmdump_pipeline *pl)
861 {
862 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
863
864 (void) pthread_mutex_lock(&srlzer->ds_lock);
865 }
866
867 static void
srlzer_exit(struct fmdump_pipeline * pl)868 srlzer_exit(struct fmdump_pipeline *pl)
869 {
870 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
871
872 ASSERT(MUTEX_HELD(&srlzer->ds_lock));
873 (void) pthread_mutex_unlock(&srlzer->ds_lock);
874 }
875
876 static struct fmdump_pipeline *
srlzer_choose(struct fmdump_srlzer * srlzer)877 srlzer_choose(struct fmdump_srlzer *srlzer)
878 {
879 struct fmdump_srlzer_slot *slot, *oldest;
880 int oldestidx = -1;
881 int first = 1;
882 int i;
883
884 ASSERT(MUTEX_HELD(&srlzer->ds_lock));
885
886 for (i = 0, slot = &srlzer->ds_slot[0]; i < srlzer->ds_pipecnt;
887 i++, slot++) {
888 if (slot->ss_state != FMDUMP_PIPE_RECORDAVAIL)
889 continue;
890
891 if (first) {
892 oldest = slot;
893 oldestidx = i;
894 first = 0;
895 continue;
896 }
897
898 if (slot->ss_sec < oldest->ss_sec ||
899 slot->ss_sec == oldest->ss_sec &&
900 slot->ss_nsec < oldest->ss_nsec) {
901 oldest = slot;
902 oldestidx = i;
903 }
904 }
905
906 return (oldestidx >= 0 ? &srlzer->ds_pipearr[oldestidx] : NULL);
907 }
908
909 static void
pipeline_stall(struct fmdump_pipeline * pl)910 pipeline_stall(struct fmdump_pipeline *pl)
911 {
912 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
913
914 ASSERT(MUTEX_HELD(&srlzer->ds_lock));
915 (void) pthread_cond_wait(&pl->pl_cv, &srlzer->ds_lock);
916 }
917
918 static void
pipeline_continue(struct fmdump_pipeline * pl)919 pipeline_continue(struct fmdump_pipeline *pl)
920 {
921 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
922
923 ASSERT(MUTEX_HELD(&srlzer->ds_lock));
924 (void) pthread_cond_signal(&srlzer->ds_pipearr[pl->pl_srlzeridx].pl_cv);
925 }
926
927 /*
928 * Called on each pipeline record iteration to make a new record
929 * available for input to the serializer. Returns 0 to indicate that
930 * the caller must stall the pipeline, or 1 to indicate that the
931 * caller should go ahead and render their record. If this record
932 * addition fills the serializer then choose a pipeline that must
933 * render output.
934 */
935 static int
pipeline_output(struct fmdump_pipeline * pl,const fmd_log_record_t * rp)936 pipeline_output(struct fmdump_pipeline *pl, const fmd_log_record_t *rp)
937 {
938 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
939 struct fmdump_srlzer_slot *slot;
940 struct fmdump_pipeline *wpl;
941 int thisidx = pl->pl_srlzeridx;
942
943 ASSERT(MUTEX_HELD(&srlzer->ds_lock));
944
945 slot = &srlzer->ds_slot[thisidx];
946 slot->ss_state = FMDUMP_PIPE_RECORDAVAIL;
947 slot->ss_sec = rp->rec_sec;
948 slot->ss_nsec = rp->rec_nsec;
949 srlzer->ds_nrecordavail++;
950
951 /*
952 * Once all pipelines are polling we just render in arrival order.
953 */
954 if (srlzer->ds_pollcnt == srlzer->ds_pipecnt)
955 return (1);
956
957 /*
958 * If not all pipelines have asserted an output yet then the
959 * caller must block.
960 */
961 if (srlzer->ds_nrecordavail + srlzer->ds_ndone +
962 srlzer->ds_pollcnt < srlzer->ds_pipecnt)
963 return (0);
964
965 /*
966 * Right so it's time to turn the crank by choosing which of the
967 * filled line of slots should produce output. If it is the slot
968 * for our caller then return their index to them, otherwise return
969 * -1 to the caller to make them block and cv_signal the winner.
970 */
971 wpl = srlzer_choose(srlzer);
972 ASSERT(wpl != NULL);
973
974 if (wpl == pl)
975 return (1);
976
977 /* Wake the oldest, and return 0 to put the caller to sleep */
978 pipeline_continue(wpl);
979
980 return (0);
981 }
982
983 static void
pipeline_mark_consumed(struct fmdump_pipeline * pl)984 pipeline_mark_consumed(struct fmdump_pipeline *pl)
985 {
986 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
987
988 ASSERT(MUTEX_HELD(&srlzer->ds_lock));
989 srlzer->ds_slot[pl->pl_srlzeridx].ss_state = FMDUMP_PIPE_PROCESSING;
990 srlzer->ds_nrecordavail--;
991 }
992
993 static void
pipeline_done(struct fmdump_pipeline * pl)994 pipeline_done(struct fmdump_pipeline *pl)
995 {
996 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
997 struct fmdump_pipeline *wpl;
998
999 srlzer_enter(pl);
1000
1001 srlzer->ds_slot[pl->pl_srlzeridx].ss_state = FMDUMP_PIPE_DONE;
1002 srlzer->ds_ndone++;
1003 wpl = srlzer_choose(srlzer);
1004 if (wpl != NULL)
1005 pipeline_continue(wpl);
1006
1007 srlzer_exit(pl);
1008 }
1009
1010 static void
pipeline_pollmode(struct fmdump_pipeline * pl)1011 pipeline_pollmode(struct fmdump_pipeline *pl)
1012 {
1013 struct fmdump_srlzer *srlzer = pl->pl_srlzer;
1014 struct fmdump_pipeline *wpl;
1015
1016 if (srlzer->ds_slot[pl->pl_srlzeridx].ss_state == FMDUMP_PIPE_POLLING)
1017 return;
1018
1019 srlzer_enter(pl);
1020
1021 srlzer->ds_slot[pl->pl_srlzeridx].ss_state = FMDUMP_PIPE_POLLING;
1022 if (++srlzer->ds_pollcnt + srlzer->ds_nrecordavail ==
1023 srlzer->ds_pipecnt && (wpl = srlzer_choose(srlzer)) != NULL)
1024 pipeline_continue(wpl);
1025
1026 srlzer_exit(pl);
1027 }
1028
1029 static int
pipeline_err(fmd_log_t * lp,void * arg)1030 pipeline_err(fmd_log_t *lp, void *arg)
1031 {
1032 struct fmdump_pipeline *pl = (struct fmdump_pipeline *)arg;
1033
1034 fmdump_warn("skipping record in %s: %s\n", pl->pl_processing,
1035 fmd_log_errmsg(lp, fmd_log_errno(lp)));
1036 g_errs++;
1037
1038 return (0);
1039 }
1040
1041 static int
pipeline_cb(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)1042 pipeline_cb(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
1043 {
1044 struct fmdump_pipeline *pl = (struct fmdump_pipeline *)arg;
1045 int rc;
1046
1047 fmd_log_rec_f *func = pl->pl_arg.da_fmt->do_func;
1048
1049 srlzer_enter(pl);
1050
1051 if (!pipeline_output(pl, rp))
1052 pipeline_stall(pl);
1053
1054 rc = func(lp, rp, pl->pl_arg.da_fp);
1055 pipeline_mark_consumed(pl);
1056
1057 srlzer_exit(pl);
1058
1059 return (rc);
1060 }
1061
1062 static void
pipeline_process(struct fmdump_pipeline * pl,char * logpath,boolean_t follow)1063 pipeline_process(struct fmdump_pipeline *pl, char *logpath, boolean_t follow)
1064 {
1065 fmd_log_header_t log;
1066 fmd_log_t *lp;
1067 int err;
1068 int i;
1069
1070 pl->pl_processing = logpath;
1071
1072 if ((lp = fmd_log_open(FMD_LOG_VERSION, logpath, &err)) == NULL) {
1073 fmdump_warn("failed to open %s: %s\n",
1074 logpath, fmd_log_errmsg(NULL, err));
1075 g_errs++;
1076 return;
1077 }
1078
1079 fmd_log_header(lp, &log);
1080 for (i = 0; i < sizeof (logtypes) / sizeof (logtypes[0]); i++) {
1081 if (strcmp(log.log_label, logtypes[i].lt_label) == 0) {
1082 pl->pl_ops = logtypes[i].lt_ops;
1083 pl->pl_arg.da_fmt =
1084 &pl->pl_ops->do_formats[pl->pl_fmt];
1085 break;
1086 }
1087 }
1088
1089 if (pl->pl_ops == NULL) {
1090 fmdump_warn("unknown log type %s for %s\n",
1091 log.log_label, logpath);
1092 g_errs++;
1093 return;
1094 }
1095
1096 do {
1097 if (fmd_log_xiter(lp, FMD_LOG_XITER_REFS, pl->pl_arg.da_fc,
1098 pl->pl_arg.da_fv, pipeline_cb, pipeline_err, (void *)pl,
1099 NULL) != 0) {
1100 fmdump_warn("failed to dump %s: %s\n",
1101 logpath, fmd_log_errmsg(lp, fmd_log_errno(lp)));
1102 g_errs++;
1103 fmd_log_close(lp);
1104 return;
1105 }
1106
1107 if (follow) {
1108 pipeline_pollmode(pl);
1109 (void) sleep(1);
1110 }
1111
1112 } while (follow);
1113
1114 fmd_log_close(lp);
1115 }
1116
1117 static void *
pipeline_thr(void * arg)1118 pipeline_thr(void *arg)
1119 {
1120 struct fmdump_pipeline *pl = (struct fmdump_pipeline *)arg;
1121 struct loglink *ll;
1122
1123 (void) pthread_mutex_lock(&pl->pl_lock);
1124 pl->pl_started = 1;
1125 (void) pthread_mutex_unlock(&pl->pl_lock);
1126 (void) pthread_cond_signal(&pl->pl_cv);
1127
1128 for (ll = pl->pl_rotated; ll != NULL; ll = ll->next)
1129 pipeline_process(pl, ll->path, B_FALSE);
1130
1131 pipeline_process(pl, pl->pl_logpath, pl->pl_follow);
1132 pipeline_done(pl);
1133
1134 return (NULL);
1135 }
1136
1137
1138 static int
aggregate(char ** ifiles,int n_ifiles,int opt_f,fmd_log_filter_t * fv,uint_t fc,int opt_v,int opt_V,int opt_p,int opt_j)1139 aggregate(char **ifiles, int n_ifiles, int opt_f,
1140 fmd_log_filter_t *fv, uint_t fc,
1141 int opt_v, int opt_V, int opt_p, int opt_j)
1142 {
1143 struct fmdump_pipeline *pipeline, *pl;
1144 struct fmdump_srlzer srlzer;
1145 uint32_t npipe;
1146 int fmt;
1147 int i;
1148
1149 if (ifiles != NULL) {
1150 npipe = n_ifiles;
1151 pipeline = calloc(npipe, sizeof (struct fmdump_pipeline));
1152 if (!pipeline)
1153 fmdump_fatal("failed to allocate memory");
1154
1155 for (i = 0; i < n_ifiles; i++)
1156 pipeline[i].pl_logpath = ifiles[i];
1157 } else {
1158 pipeline = calloc(sizeof (logtypes) / sizeof (logtypes[0]),
1159 sizeof (struct fmdump_pipeline));
1160 if (!pipeline)
1161 fmdump_fatal("failed to allocate memory");
1162
1163 do_disables();
1164
1165 npipe = 0;
1166 for (i = 0; i < sizeof (logtypes) / sizeof (logtypes[0]); i++) {
1167 struct fmdump_logtype *ltp = &logtypes[i];
1168 char *logpath;
1169
1170 if (ltp->lt_enabled == B_FALSE)
1171 continue;
1172
1173 if ((logpath = malloc(PATH_MAX)) == NULL)
1174 fmdump_fatal("failed to allocate memory");
1175
1176 (void) snprintf(logpath, PATH_MAX,
1177 "%s/var/fm/fmd/%s",
1178 g_root ? g_root : "", ltp->lt_logname);
1179
1180 pipeline[npipe].pl_rotated =
1181 get_rotated_logs(logpath);
1182
1183 pipeline[npipe++].pl_logpath = logpath;
1184 }
1185 }
1186
1187 if (opt_V)
1188 fmt = opt_p ? FMDUMP_PRETTY : opt_j ? FMDUMP_JSON :
1189 FMDUMP_VERB2;
1190 else if (opt_v)
1191 fmt = FMDUMP_VERB1;
1192 else
1193 fmt = FMDUMP_SHORT;
1194
1195 bzero(&srlzer, sizeof (srlzer));
1196 srlzer.ds_pipearr = pipeline;
1197 srlzer.ds_pipecnt = npipe;
1198 srlzer.ds_slot = calloc(npipe, sizeof (struct fmdump_srlzer_slot));
1199 if (!srlzer.ds_slot)
1200 fmdump_fatal("failed to allocate memory");
1201 (void) pthread_mutex_init(&srlzer.ds_lock, NULL);
1202
1203 for (i = 0, pl = &pipeline[0]; i < npipe; i++, pl++) {
1204 (void) pthread_mutex_init(&pl->pl_lock, NULL);
1205 (void) pthread_cond_init(&pl->pl_cv, NULL);
1206 srlzer.ds_slot[i].ss_state = FMDUMP_PIPE_PROCESSING;
1207 pl->pl_srlzer = &srlzer;
1208 pl->pl_srlzeridx = i;
1209 pl->pl_follow = opt_f ? B_TRUE : B_FALSE;
1210 pl->pl_fmt = fmt;
1211 pl->pl_arg.da_fv = fv;
1212 pl->pl_arg.da_fc = fc;
1213 pl->pl_arg.da_fp = stdout;
1214
1215 (void) pthread_mutex_lock(&pl->pl_lock);
1216
1217 if (pthread_create(&pl->pl_thr, NULL,
1218 pipeline_thr, (void *)pl) != 0)
1219 fmdump_fatal("pthread_create for pipeline %d failed",
1220 i);
1221 }
1222
1223 for (i = 0, pl = &pipeline[0]; i < npipe; i++, pl++) {
1224 while (!pl->pl_started)
1225 (void) pthread_cond_wait(&pl->pl_cv, &pl->pl_lock);
1226
1227 (void) pthread_mutex_unlock(&pl->pl_lock);
1228 }
1229
1230 for (i = 0, pl = &pipeline[0]; i < npipe; i++, pl++)
1231 (void) pthread_join(pl->pl_thr, NULL);
1232
1233 if (ifiles == NULL) {
1234 for (i = 0; i < npipe; i++)
1235 free(pipeline[i].pl_logpath);
1236 }
1237
1238 free(srlzer.ds_slot);
1239
1240 free(pipeline);
1241
1242 return (FMDUMP_EXIT_SUCCESS);
1243 }
1244
1245 static void
cleanup(char ** ifiles,int n_ifiles)1246 cleanup(char **ifiles, int n_ifiles)
1247 {
1248 int i;
1249
1250 if (ifiles == NULL)
1251 return;
1252
1253 for (i = 0; i < n_ifiles; i++) {
1254 if (ifiles[i] != NULL) {
1255 free(ifiles[i]);
1256 ifiles[i] = NULL;
1257 }
1258 }
1259
1260 free(ifiles);
1261 }
1262
1263 int
main(int argc,char * argv[])1264 main(int argc, char *argv[])
1265 {
1266 int opt_a = 0, opt_e = 0, opt_f = 0, opt_H = 0, opt_m = 0, opt_p = 0;
1267 int opt_u = 0, opt_v = 0, opt_V = 0, opt_j = 0;
1268 int opt_i = 0, opt_I = 0;
1269 int opt_A = 0;
1270 char **ifiles = NULL;
1271 char *ifile = NULL;
1272 int n_ifiles;
1273 int ifileidx = 0;
1274 int iflags = 0;
1275
1276 fmdump_arg_t arg;
1277 fmdump_lyr_t lyr;
1278 const fmdump_ops_t *ops;
1279 fmd_log_filter_t *filtv;
1280 uint_t filtc;
1281
1282 fmd_log_filter_t *errfv, *fltfv, *allfv;
1283 uint_t errfc = 0, fltfc = 0, allfc = 0;
1284
1285 fmd_log_header_t log;
1286 fmd_log_rec_f *func;
1287 void *farg;
1288 fmd_log_t *lp;
1289 int c, err;
1290 off64_t off = 0;
1291 ulong_t recs;
1292 struct loglink *rotated_logs = NULL, *llp;
1293
1294 g_pname = argv[0];
1295
1296 errfv = alloca(sizeof (fmd_log_filter_t) * argc);
1297 fltfv = alloca(sizeof (fmd_log_filter_t) * argc);
1298 allfv = alloca(sizeof (fmd_log_filter_t) * argc);
1299
1300 while (optind < argc) {
1301 while ((c = getopt(argc, argv,
1302 "Aac:efHiIjmN:n:O:pR:t:T:u:vV")) != EOF) {
1303 switch (c) {
1304 case 'A':
1305 opt_A++;
1306 break;
1307 case 'a':
1308 opt_a++;
1309 break;
1310 case 'c':
1311 errfv[errfc].filt_func = fmd_log_filter_class;
1312 errfv[errfc].filt_arg = optarg;
1313 allfv[allfc++] = errfv[errfc++];
1314 break;
1315 case 'e':
1316 if (opt_i)
1317 return (usage(stderr));
1318 opt_e++;
1319 break;
1320 case 'f':
1321 opt_f++;
1322 break;
1323 case 'H':
1324 opt_H++;
1325 break;
1326 case 'i':
1327 if (opt_e || opt_I)
1328 return (usage(stderr));
1329 opt_i++;
1330 break;
1331 case 'I':
1332 if (opt_e || opt_i)
1333 return (usage(stderr));
1334 opt_I++;
1335 break;
1336 case 'j':
1337 if (opt_p)
1338 return (usage(stderr));
1339 opt_j++;
1340 break;
1341 case 'm':
1342 opt_m++;
1343 break;
1344 case 'N':
1345 fltfv[fltfc].filt_func =
1346 fmd_log_filter_nv_multi;
1347 fltfv[fltfc].filt_arg =
1348 setupnamevalue_multi(optarg);
1349 allfv[allfc++] = fltfv[fltfc++];
1350 break;
1351 case 'n':
1352 fltfv[fltfc].filt_func = fmd_log_filter_nv;
1353 fltfv[fltfc].filt_arg = setupnamevalue(optarg);
1354 allfv[allfc++] = fltfv[fltfc++];
1355 break;
1356 case 'O': {
1357 char *p;
1358
1359 errno = 0;
1360 off = strtoull(optarg, &p, 16);
1361
1362 if (errno != 0 || p == optarg || *p != '\0') {
1363 fmdump_usage(
1364 "illegal offset format -- %s\n",
1365 optarg);
1366 }
1367 iflags |= FMD_LOG_XITER_OFFS;
1368 break;
1369 }
1370 case 'p':
1371 if (opt_j)
1372 return (usage(stderr));
1373 opt_p++;
1374 break;
1375 case 'R':
1376 g_root = optarg;
1377 break;
1378 case 't':
1379 errfv[errfc].filt_func = fmd_log_filter_after;
1380 errfv[errfc].filt_arg = gettimeopt(optarg);
1381 allfv[allfc++] = errfv[errfc++];
1382 break;
1383 case 'T':
1384 errfv[errfc].filt_func = fmd_log_filter_before;
1385 errfv[errfc].filt_arg = gettimeopt(optarg);
1386 allfv[allfc++] = errfv[errfc++];
1387 break;
1388 case 'u':
1389 fltfv[fltfc].filt_func = fmd_log_filter_uuid;
1390 fltfv[fltfc].filt_arg = optarg;
1391 allfv[allfc++] = fltfv[fltfc++];
1392 opt_u++;
1393 opt_a++; /* -u implies -a */
1394 break;
1395 case 'v':
1396 opt_v++;
1397 break;
1398 case 'V':
1399 opt_V++;
1400 break;
1401 default:
1402 return (usage(stderr));
1403 }
1404 }
1405
1406 if (opt_A && (opt_e || opt_i || opt_I || opt_m || opt_u))
1407 fmdump_usage("-A excludes all of "
1408 "-e, -i, -I, -m and -u\n");
1409
1410 if (optind < argc) {
1411 char *dest;
1412
1413 if (ifiles == NULL) {
1414 n_ifiles = argc - optind;
1415 ifiles = calloc(n_ifiles, sizeof (char *));
1416 if (ifiles == NULL) {
1417 fmdump_fatal(
1418 "failed to allocate memory for "
1419 "%d input file%s", n_ifiles,
1420 n_ifiles > 1 ? "s" : "");
1421 }
1422 }
1423
1424 if (ifileidx > 0 && !opt_A)
1425 fmdump_usage("illegal argument -- %s\n",
1426 argv[optind]);
1427
1428 ASSERT(ifileidx < n_ifiles);
1429
1430 if ((dest = malloc(PATH_MAX)) == NULL)
1431 fmdump_fatal("failed to allocate memory");
1432
1433 (void) strlcpy(dest, argv[optind++], PATH_MAX);
1434 ifiles[ifileidx++] = dest;
1435 }
1436 }
1437
1438 /*
1439 * It's possible that file arguments were interleaved with options and
1440 * option arguments, in which case we allocated space for more file
1441 * arguments that we actually got. Adjust as required so that we don't
1442 * reference invalid entries.
1443 */
1444 n_ifiles = ifileidx;
1445
1446 if (opt_A) {
1447 int rc;
1448
1449 if (!opt_a) {
1450 fltfv[fltfc].filt_func = log_filter_silent;
1451 fltfv[fltfc].filt_arg = (void *)1;
1452 allfv[allfc++] = fltfv[fltfc++];
1453 }
1454
1455 rc = aggregate(ifiles, n_ifiles, opt_f,
1456 allfv, allfc,
1457 opt_v, opt_V, opt_p, opt_j);
1458
1459 cleanup(ifiles, n_ifiles);
1460 return (rc);
1461 } else {
1462 if (ifiles == NULL) {
1463 if ((ifile = calloc(1, PATH_MAX)) == NULL)
1464 fmdump_fatal("failed to allocate memory");
1465 } else {
1466 ifile = ifiles[0];
1467 }
1468 }
1469
1470
1471 if (*ifile == '\0') {
1472 const char *pfx, *sfx;
1473
1474 if (opt_u || (!opt_e && !opt_i && !opt_I)) {
1475 pfx = "flt";
1476 sfx = "";
1477 } else {
1478 if (opt_e) {
1479 pfx = "err";
1480 sfx = "";
1481 } else {
1482 pfx = "info";
1483 sfx = opt_I ? "_hival" : "";
1484 }
1485 }
1486
1487 (void) snprintf(ifile, PATH_MAX, "%s/var/fm/fmd/%slog%s",
1488 g_root ? g_root : "", pfx, sfx);
1489 /*
1490 * logadm may rotate the logs. When no input file is specified,
1491 * we try to dump all the rotated logs as well in the right
1492 * order.
1493 */
1494 if (!opt_H && off == 0)
1495 rotated_logs = get_rotated_logs(ifile);
1496 } else if (g_root != NULL) {
1497 fmdump_usage("-R option is not appropriate "
1498 "when file operand is present\n");
1499 }
1500
1501 if ((g_msg = fmd_msg_init(g_root, FMD_MSG_VERSION)) == NULL)
1502 fmdump_fatal("failed to initialize libfmd_msg");
1503
1504 if ((lp = fmd_log_open(FMD_LOG_VERSION, ifile, &err)) == NULL) {
1505 fmdump_fatal("failed to open %s: %s\n", ifile,
1506 fmd_log_errmsg(NULL, err));
1507 }
1508
1509 if (opt_H) {
1510 fmd_log_header(lp, &log);
1511
1512 (void) printf("EXD_CREATOR = %s\n", log.log_creator);
1513 (void) printf("EXD_HOSTNAME = %s\n", log.log_hostname);
1514 (void) printf("EXD_FMA_LABEL = %s\n", log.log_label);
1515 (void) printf("EXD_FMA_VERSION = %s\n", log.log_version);
1516 (void) printf("EXD_FMA_OSREL = %s\n", log.log_osrelease);
1517 (void) printf("EXD_FMA_OSVER = %s\n", log.log_osversion);
1518 (void) printf("EXD_FMA_PLAT = %s\n", log.log_platform);
1519 (void) printf("EXD_FMA_UUID = %s\n", log.log_uuid);
1520
1521 return (FMDUMP_EXIT_SUCCESS);
1522 }
1523
1524 if (off != 0 && fmd_log_seek(lp, off) != 0) {
1525 fmdump_fatal("failed to seek %s: %s\n", ifile,
1526 fmd_log_errmsg(lp, fmd_log_errno(lp)));
1527 }
1528
1529 if (opt_e && opt_u)
1530 ops = &fmdump_err_ops;
1531 else if (strcmp(fmd_log_label(lp), fmdump_flt_ops.do_label) == 0)
1532 ops = &fmdump_flt_ops;
1533 else if (strcmp(fmd_log_label(lp), fmdump_asru_ops.do_label) == 0)
1534 ops = &fmdump_asru_ops;
1535 else if (strcmp(fmd_log_label(lp), fmdump_info_ops.do_label) == 0)
1536 ops = &fmdump_info_ops;
1537 else
1538 ops = &fmdump_err_ops;
1539
1540 if (!opt_a && ops == &fmdump_flt_ops) {
1541 fltfv[fltfc].filt_func = log_filter_silent;
1542 fltfv[fltfc].filt_arg = NULL;
1543 allfv[allfc++] = fltfv[fltfc++];
1544 }
1545
1546 if (opt_V) {
1547 arg.da_fmt =
1548 &ops->do_formats[opt_p ? FMDUMP_PRETTY :
1549 opt_j ? FMDUMP_JSON : FMDUMP_VERB2];
1550 iflags |= FMD_LOG_XITER_REFS;
1551 } else if (opt_v) {
1552 arg.da_fmt = &ops->do_formats[FMDUMP_VERB1];
1553 } else if (opt_m) {
1554 arg.da_fmt = &ops->do_formats[FMDUMP_MSG];
1555 } else
1556 arg.da_fmt = &ops->do_formats[FMDUMP_SHORT];
1557
1558 if (opt_m && arg.da_fmt->do_func == NULL) {
1559 fmdump_usage("-m mode is not supported for "
1560 "log of type %s: %s\n", fmd_log_label(lp), ifile);
1561 }
1562
1563 arg.da_fv = errfv;
1564 arg.da_fc = errfc;
1565 arg.da_fp = stdout;
1566
1567 if (iflags & FMD_LOG_XITER_OFFS)
1568 fmdump_printf(arg.da_fp, "%16s ", "OFFSET");
1569
1570 if (arg.da_fmt->do_hdr && !(opt_V && ops == &fmdump_flt_ops))
1571 fmdump_printf(arg.da_fp, "%s\n", arg.da_fmt->do_hdr);
1572
1573 if (opt_e && opt_u) {
1574 iflags |= FMD_LOG_XITER_REFS;
1575 func = xref_iter;
1576 farg = &arg;
1577 filtc = fltfc;
1578 filtv = fltfv;
1579 } else {
1580 func = arg.da_fmt->do_func;
1581 farg = arg.da_fp;
1582 filtc = allfc;
1583 filtv = allfv;
1584 }
1585
1586 if (iflags & FMD_LOG_XITER_OFFS) {
1587 lyr.dy_func = func;
1588 lyr.dy_arg = farg;
1589 lyr.dy_fp = arg.da_fp;
1590 func = xoff_iter;
1591 farg = &lyr;
1592 }
1593
1594 for (llp = rotated_logs; llp != NULL; llp = llp->next) {
1595 fmd_log_t *rlp;
1596
1597 if ((rlp = fmd_log_open(FMD_LOG_VERSION, llp->path, &err))
1598 == NULL) {
1599 fmdump_warn("failed to open %s: %s\n",
1600 llp->path, fmd_log_errmsg(NULL, err));
1601 g_errs++;
1602 continue;
1603 }
1604
1605 recs = 0;
1606 if (fmd_log_xiter(rlp, iflags, filtc, filtv,
1607 func, error, farg, &recs) != 0) {
1608 fmdump_warn("failed to dump %s: %s\n", llp->path,
1609 fmd_log_errmsg(rlp, fmd_log_errno(rlp)));
1610 g_errs++;
1611 }
1612 g_recs += recs;
1613
1614 fmd_log_close(rlp);
1615 }
1616
1617 do {
1618 recs = 0;
1619 if (fmd_log_xiter(lp, iflags, filtc, filtv,
1620 func, error, farg, &recs) != 0) {
1621 fmdump_warn("failed to dump %s: %s\n", ifile,
1622 fmd_log_errmsg(lp, fmd_log_errno(lp)));
1623 g_errs++;
1624 }
1625 g_recs += recs;
1626
1627 if (opt_f)
1628 (void) sleep(1);
1629
1630 } while (opt_f);
1631
1632 if (!opt_f && g_recs == 0 && isatty(STDOUT_FILENO))
1633 fmdump_warn("%s is empty\n", ifile);
1634
1635 if (g_thp != NULL)
1636 topo_close(g_thp);
1637
1638 fmd_log_close(lp);
1639 fmd_msg_fini(g_msg);
1640
1641 if (ifiles == NULL)
1642 free(ifile);
1643 else
1644 cleanup(ifiles, n_ifiles);
1645
1646 return (g_errs ? FMDUMP_EXIT_ERROR : FMDUMP_EXIT_SUCCESS);
1647 }
1648