nfs/nfslog/nfslog_trans.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1999 by Sun Microsystems, Inc.
 * All rights reserved.
 */

#include <stdio.h>
#include <errno.h>
#include <malloc.h>
#include <strings.h>
#include <stddef.h>
#include <search.h>
#include <syslog.h>
#include <libintl.h>
#include <unistd.h>
#include <rpc/rpc.h>
#include <netconfig.h>
#include <netdir.h>
#include <nfs/nfs_sec.h>
#include <nfs/export.h>
#include <rpc/auth.h>
#include <rpc/svc.h>
#include <rpc/xdr.h>
#include <rpc/clnt.h>
#include <nfs/nfs.h>
#include <nfs/nfs_log.h>
#include <assert.h>
#include "fhtab.h"
#include "nfslogd.h"

/*
 * How long should an entry stay in the list before being forced
 * out and a trans log entry printed
 */
#define	TRANS_ENTRY_TIMEOUT	60

extern char *addrtoname(void *);

struct transentry {
	struct transentry *next;
	struct transentry *prev;
	timestruc32_t	starttime;	/* when did transaction start? */
	timestruc32_t	lastupdate;	/* last operation for this entry */
#define	TRANS_OPER_READ		1
#define	TRANS_OPER_WRITE	2
#define	TRANS_OPER_SETATTR	3
#define	TRANS_OPER_REMOVE	4
#define	TRANS_OPER_MKDIR	5
#define	TRANS_OPER_CREATE	6
#define	TRANS_OPER_RMDIR	7
#define	TRANS_OPER_RENAME	8
#define	TRANS_OPER_MKNOD	9
#define	TRANS_OPER_LINK		10
#define	TRANS_OPER_SYMLINK	11
	uchar_t		optype;		/* read, write, ...? */
#define	TRANS_DATATYPE_NA		/* not applicable data type */
#define	TRANS_DATATYPE_ASCII	0	/* transfer done as ascii */
#define	TRANS_DATATYPE_BINARY	1	/* transfer done as binary */
	uchar_t		datatype;
/*
 * Action taken by server before transfer was made -- noaction,
 * compressed, tar or uncompressed.
 */
#define	TRANS_OPTION_NOACTION	0
	uchar_t		transoption;
	char		*pathname;
	struct netbuf	*pnb;
	uid_t		uid;
	int		nfsvers;
	char		*netid;
	char		*principal_name;
	uint64_t	totalbytes;	/* total operated upon in history */
	union {
		fhandle_t fh;
		nfs_fh3 fh3;
	} fh_u;
};

struct nfslog_trans_file {
	struct nfslog_trans_file	*next;	/* next file in list */
	struct nfslog_trans_file	*prev;	/* next file in list */
	int	refcnt;		/* number of references to this struct */
	char	*path;		/* pathname of file */
	FILE	*fp;		/* file pointer */
	/* timestamp of the last transaction processed for this file */
	timestruc32_t	lasttrans_timestamp;
	/* 'current' time that last trans was processed */
	time_t		last_trans_read;
	uint32_t trans_to_log;	/* transactions that are to be logged */
	uint32_t trans_output_type;
	struct transentry *te_list_v3_read;
	struct transentry *te_list_v3_write;
	struct transentry *te_list_v2_read;
	struct transentry *te_list_v2_write;
};

static struct nfslog_trans_file *trans_file_head = NULL;

static void nfslog_print_trans_logentry(struct transentry *,
	struct nfslog_trans_file *);


static struct netbuf *
netbufdup(struct netbuf *pnb)
{
	struct netbuf *pnewnb;
	uint32_t	size;

	size = offsetof(struct netbuf, buf);
	size += pnb->len;

	if ((pnewnb = (struct netbuf *)malloc(sizeof (*pnewnb))) == NULL)
		return (NULL);
	if ((pnewnb->buf = malloc(pnb->len)) == NULL) {
		free(pnewnb);
		return (NULL);
	}

	pnewnb->maxlen = pnb->maxlen;
	pnewnb->len = pnb->len;
	bcopy(pnb->buf, pnewnb->buf, pnb->len);
	return (pnewnb);
}

static void
freenetbuf(struct netbuf *pnb)
{
	free(pnb->buf);
	free(pnb);
}

static struct transentry *
create_te()
{
	struct transentry *pte;

	if ((pte = (struct transentry *)calloc(1, sizeof (*pte))) == NULL) {
		/* failure message or action */
		return (NULL);
	}

	pte->next = pte->prev = NULL;

	return (pte);
}

static struct transentry *
insert_te(
	struct transentry *te_list,
	struct transentry *entry)
{
	struct transentry *pte;

	/*
	 * First check for any non-filehandle comparisons that may be needed.
	 */
	switch (entry->optype) {
	case TRANS_OPER_REMOVE:
	case TRANS_OPER_RENAME:
		for (pte = te_list->next; pte != te_list; pte = pte->next) {
			/* if path names match, then return */
			if (strcmp(pte->pathname, entry->pathname) == 0) {
				return (pte);
			}
		}
		return (NULL);
	default:
		break;
	}

	for (pte = te_list->next; pte != te_list; pte = pte->next) {
		/* If the file handles match, then we have a hit */
		if (entry->nfsvers == NFS_VERSION) {
			if (bcmp(&(pte->fh_u.fh), &(entry->fh_u.fh),
				sizeof (fhandle_t)) == 0) {
				switch (entry->optype) {
				case TRANS_OPER_READ:
				case TRANS_OPER_WRITE:
					if (pte->uid ==	entry->uid) {
						return (pte);
					}
					break;
				default:
					return (pte);
				}
			}
		} else {
			if (pte->fh_u.fh3.fh3_length ==
				entry->fh_u.fh3.fh3_length &&
				bcmp(pte->fh_u.fh3.fh3_u.data,
					entry->fh_u.fh3.fh3_u.data,
					pte->fh_u.fh3.fh3_length) == 0)
				switch (entry->optype) {
				case TRANS_OPER_READ:
				case TRANS_OPER_WRITE:
					if (pte->uid ==	entry->uid) {
						return (pte);
					}
					break;
				default:
					return (pte);
				}
		}
	}
	/*
	 * XXX - should compare more of the information to make sure
	 * it is a match.
	 */

	/*
	 * other operation types do not generate an entry for
	 * further analysis
	 */
	switch (entry->optype) {
	case TRANS_OPER_READ:
	case TRANS_OPER_WRITE:
		break;
	default:
		return (NULL);
	}

	insque(entry, te_list);

	return (NULL); /* NULL signifies insertion and no record found */
}

static void
remove_te(struct transentry *pte)
{
	if (pte->next)
		remque(pte);

	if (pte->principal_name) free(pte->principal_name);
	if (pte->pathname) free(pte->pathname);
	if (pte->pnb) freenetbuf(pte->pnb);
	if (pte->netid) free(pte->netid);

	free(pte);
}

/*
 * nfslog_trans_file_free - frees a record
 */
static void
nfslog_trans_file_free(struct nfslog_trans_file *transrec)
{
	if (transrec == NULL)
		return;
	if (transrec->path != NULL) {
		if (debug)
			(void) printf("freeing transpath '%s'\n",
				transrec->path);
		free(transrec->path);
	}
	free(transrec);
}

/*
 * On success returns a pointer to the trans_file that matches
 * 'path', 'output_type' and 'transtolog'.  The reference count for this
 * object is incremented as well.
 * Returns NULL if it is not in the list.
 */
static struct nfslog_trans_file *
nfslog_trans_file_find(
	char *path,
	uint32_t output_type,
	uint32_t transtolog)
{
	struct nfslog_trans_file *tfp;

	for (tfp = trans_file_head; tfp != NULL; tfp = tfp->next) {
		if ((strcmp(path, tfp->path) == 0) &&
		    (output_type == tfp->trans_output_type) &&
		    (transtolog == tfp->trans_to_log)) {
			if (debug)
				(void) printf("Found transfile '%s'\n", path);
			(tfp->refcnt)++;
			return (tfp);
		}
	}
	return (NULL);
}


/*
 * nfslog_close_trans_file - decrements the reference count on
 * this object. On last reference it closes transfile and
 * frees resources
 */
static void
nfslog_close_trans_file(struct nfslog_trans_file *tf)
{
	assert(tf != NULL);
	assert(tf->refcnt > 0);
	if (tf->refcnt > 1) {
		(tf->refcnt)--;
		return;
	}

	if (tf->fp != NULL) {
		(void) fsync(fileno(tf->fp));
		(void) fclose(tf->fp);
	}

	/*
	 * Disconnect from list
	 */
	tf->prev->next = tf->next;
	if (tf->next != NULL)
		tf->next->prev = tf->prev;

	/*
	 * Adjust the head of the list if appropriate
	 */
	if (tf == trans_file_head)
		trans_file_head = tf->next;

	nfslog_trans_file_free(tf);
}

/*
 * nfslog_open_trans_file - open the output trans file and mallocs.
 * The object is then inserted at the beginning of the global
 * transfile list.
 *	Returns 0 for success, error else.
 *
 * *error contains the last error encountered on this object. It can
 * be used to avoid reporting the same error endlessly, by comparing
 * the current error to the last error. It is reset to the current error
 * code on return.
 */
void *
nfslog_open_trans_file(
	char *transpath,
	uint32_t output_type,
	uint32_t transtolog,
	int *error)
{
	int			preverror = *error;
	struct nfslog_trans_file	*transrec;

	transrec = nfslog_trans_file_find(transpath, output_type, transtolog);
	if (transrec != NULL)
		return (transrec);

	if ((transrec = malloc(sizeof (*transrec))) == NULL) {
		*error = errno;
		if (*error != preverror) {
			syslog(LOG_ERR, gettext("nfslog_open_trans_file: %s"),
				strerror(*error));
		}
		return (NULL);
	}
	bzero(transrec, sizeof (*transrec));

	if ((transrec->path = strdup(transpath)) == NULL) {
		*error = errno;
		if (*error != preverror) {
			syslog(LOG_ERR, gettext("nfslog_open_trans_file: %s"),
				strerror(*error));
		}
		nfslog_trans_file_free(transrec);
		return (NULL);
	}

	if ((transrec->fp = fopen(transpath, "a")) == NULL) {
		*error = errno;
		if (*error != preverror) {
			syslog(LOG_ERR, gettext("Cannot open '%s': %s"),
				transpath, strerror(*error));
		}
		nfslog_trans_file_free(transrec);
		return (NULL);
	}

	transrec->te_list_v3_read =
		(struct transentry *)malloc(sizeof (struct transentry));
	transrec->te_list_v3_write =
		(struct transentry *)malloc(sizeof (struct transentry));
	transrec->te_list_v2_read =
		(struct transentry *)malloc(sizeof (struct transentry));
	transrec->te_list_v2_write =
		(struct transentry *)malloc(sizeof (struct transentry));

	if (transrec->te_list_v3_read == NULL ||
		transrec->te_list_v3_write == NULL ||
		transrec->te_list_v2_read == NULL ||
		transrec->te_list_v2_write == NULL) {
		if (transrec->te_list_v3_read)
			free(transrec->te_list_v3_read);
		if (transrec->te_list_v3_write)
			free(transrec->te_list_v3_write);
		if (transrec->te_list_v2_read)
			free(transrec->te_list_v2_read);
		if (transrec->te_list_v2_write)
			free(transrec->te_list_v2_write);
		nfslog_close_trans_file(transrec);
		return (NULL);
	}

	transrec->te_list_v3_read->next =
		transrec->te_list_v3_read->prev = transrec->te_list_v3_read;
	transrec->te_list_v3_write->next =
		transrec->te_list_v3_write->prev = transrec->te_list_v3_write;
	transrec->te_list_v2_read->next =
		transrec->te_list_v2_read->prev = transrec->te_list_v2_read;
	transrec->te_list_v2_write->next =
		transrec->te_list_v2_write->prev = transrec->te_list_v2_write;

	/*
	 * Indicate what transaction types to log
	 */
	transrec->trans_to_log = transtolog;

	/*
	 * Indicate whether to print 'full' or 'basic' version
	 * of the transactions
	 */
	transrec->trans_output_type = output_type;

	/*
	 * Insert at the beginning of the list.
	 */
	transrec->next = trans_file_head;
	if (trans_file_head != NULL)
		trans_file_head->prev = transrec;
	trans_file_head = transrec->prev = transrec;

	transrec->refcnt = 1;

	transrec->lasttrans_timestamp.tv_sec = 0;
	transrec->lasttrans_timestamp.tv_nsec = 0;
	transrec->last_trans_read = time(0);

	if (debug)
		(void) printf("New transfile '%s'\n", transrec->path);

	return (transrec);
}

void
nfslog_process_trans_timeout(
	struct nfslog_trans_file *tf,
	uint32_t force_flush)
{
	struct transentry *pte;
	time_t cur_time = time(0);

	/*
	 * If we have not seen a transaction on this file for
	 * a long time, then we need to flush everything out since
	 * we may not be getting anything else in for awhile.
	 */
	if (difftime(cur_time, tf->last_trans_read) >
		(2 * MAX(TRANS_ENTRY_TIMEOUT, idle_time)))
		force_flush = TRUE;

restart1:
	for (pte = tf->te_list_v3_read->next;
		pte != tf->te_list_v3_read;
		pte = pte->next) {
		if (force_flush == TRUE ||
			(difftime(tf->lasttrans_timestamp.tv_sec,
				pte->lastupdate.tv_sec) >
			MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
			goto restart1;
		}
	}
restart2:
	for (pte = tf->te_list_v3_write->next;
		pte != tf->te_list_v3_write;
		pte = pte->next) {
		if (force_flush == TRUE ||
			(difftime(tf->lasttrans_timestamp.tv_sec,
				pte->lastupdate.tv_sec) >
			MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
			goto restart2;
		}
	}
restart3:
	for (pte = tf->te_list_v2_read->next;
		pte != tf->te_list_v2_read;
		pte = pte->next) {
		if (force_flush == TRUE ||
			(difftime(tf->lasttrans_timestamp.tv_sec,
				pte->lastupdate.tv_sec) >
			MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
			goto restart3;
		}
	}
restart4:
	for (pte = tf->te_list_v2_write->next;
		pte != tf->te_list_v2_write;
		pte = pte->next) {
		if (force_flush == TRUE ||
			(difftime(tf->lasttrans_timestamp.tv_sec,
				pte->lastupdate.tv_sec) >
			MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
			goto restart4;
		}
	}

	(void) fflush(tf->fp);
}

/*
 * Flushes outstanding transactions to disk, and closes
 * the transaction log.
 */
void
nfslog_close_transactions(void **transcookie)
{
	assert(*transcookie != NULL);
	nfslog_process_trans_timeout(
		(struct nfslog_trans_file *)(*transcookie), TRUE);
	nfslog_close_trans_file((struct nfslog_trans_file *)(*transcookie));
	*transcookie = NULL;
}

static struct transentry *
trans_read(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_nfsreadargs *args = (nfslog_nfsreadargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_rdresult *res = (nfslog_rdresult *)logrec->re_rpc_res;

	if (res->r_status != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname = nfslog_get_path(&args->ra_fhandle,
			NULL, fhpath, "trans_read");
	} else {
		newte->pathname = strdup(path1);
	}

	/* prep the struct for insertion */
	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_READ;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = res->nfslog_rdresult_u.r_ok.rrok_count;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->ra_fhandle));

	if (res->nfslog_rdresult_u.r_ok.rrok_count <
		res->nfslog_rdresult_u.r_ok.filesize) {
		if (pte = insert_te(tf->te_list_v2_read, newte)) {
			/* free this since entry was found (not inserted) */
			remove_te(newte);

			pte->totalbytes +=
				res->nfslog_rdresult_u.r_ok.rrok_count;

			if (pte->lastupdate.tv_sec <=
				logrec->re_header.rh_timestamp.tv_sec)
				pte->lastupdate =
					logrec->re_header.rh_timestamp;

			if (pte->totalbytes <
				res->nfslog_rdresult_u.r_ok.filesize) {
				pte = NULL; /* prevent printing of log entry */
			}
		}
	} else {
		pte = newte; /* print a log record - complete file read */
	}

	return (pte);
}

static struct transentry *
trans_write(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_writeargs *args = (nfslog_writeargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_writeresult *res = (nfslog_writeresult *)logrec->re_rpc_res;

	if (res->wr_status != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname = nfslog_get_path(&args->waargs_fhandle,
			NULL, fhpath, "trans_write");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_WRITE;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = args->waargs_totcount;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->waargs_fhandle));

	if (pte = insert_te(tf->te_list_v2_write, newte)) {
		/*
		 * if the write would have increased the total byte count
		 * over the filesize, then generate a log entry and remove
		 * the write record and insert the new one.
		 */
		if (pte->totalbytes + args->waargs_totcount >
			res->nfslog_writeresult_u.wr_size) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
			(void) insert_te(tf->te_list_v2_write, newte);
			pte = NULL;
		} else {
			/* free this since entry was found (not inserted) */
			remove_te(newte);

			pte->totalbytes += args->waargs_totcount;

			if (pte->lastupdate.tv_sec <=
				logrec->re_header.rh_timestamp.tv_sec) {
				pte->lastupdate =
					logrec->re_header.rh_timestamp;
			}
			pte = NULL; /* prevent printing of log entry */
		}
	}
	return (pte);
}

static struct transentry *
trans_setattr(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_setattrargs *args = (nfslog_setattrargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat *res = (nfsstat *)logrec->re_rpc_res;

	if (*res != NFS_OK)
		return (NULL);

	if (args->saa_sa.sa_size == (uint32_t)-1)
		return (NULL);
	/*
	 * should check the size of the file to see if it
	 * is being truncated below current eof.  if so
	 * a record should be generated.... XXX
	 */
	if (args->saa_sa.sa_size != 0)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname  = nfslog_get_path(&args->saa_fh, NULL,
			fhpath,	"trans_setattr2");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_SETATTR;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->saa_fh));

	if (pte = insert_te(tf->te_list_v2_write, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v2_read, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}

	return (newte);
}

static struct transentry *
trans_create(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_createargs *args = (nfslog_createargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_diropres *res = (nfslog_diropres *)logrec->re_rpc_res;

	if (res->dr_status != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname =
			nfslog_get_path(&args->ca_da.da_fhandle,
				args->ca_da.da_name,
				fhpath, "trans_create2");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_CREATE;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;

	if (args->ca_sa.sa_size == (uint32_t)-1)
		newte->totalbytes = 0;
	else
		newte->totalbytes = args->ca_sa.sa_size;

	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(
		&res->nfslog_diropres_u.dr_ok.drok_fhandle));

	/*
	 * if the file is being truncated on create, we need to flush
	 * any outstanding read/write transactions
	 */
	if (args->ca_sa.sa_size != (uint32_t)-1) {
		if (pte = insert_te(tf->te_list_v2_write, newte)) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
		}
		if (pte = insert_te(tf->te_list_v2_read, newte)) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
		}
	}

	return (newte);
}

static struct transentry *
trans_remove(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_diropargs *args = (nfslog_diropargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat *res = (nfsstat *)logrec->re_rpc_res;

	if (*res != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		char *name = args->da_name;
		fhandle_t *dfh = &args->da_fhandle;
		newte->pathname = nfslog_get_path(dfh, name,
			fhpath, "trans_remove2");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_REMOVE;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->da_fhandle));

	if (pte = insert_te(tf->te_list_v2_write, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v2_read, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v3_write, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v3_read, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}

	return (newte);
}

static struct transentry *
trans_mkdir(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_createargs *args = (nfslog_createargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_diropres *res = (nfslog_diropres *)logrec->re_rpc_res;

	if (res->dr_status != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		nfslog_diropargs *dargs = &args->ca_da;
		char *name = dargs->da_name;
		fhandle_t *dfh = &dargs->da_fhandle;
		newte->pathname = nfslog_get_path(dfh, name,
			fhpath, "trans_mkdir2");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_MKDIR;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->ca_da.da_fhandle));

	return (newte);
}

static struct transentry *
trans_rmdir(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_diropargs *args = (nfslog_diropargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat *res = (nfsstat *)logrec->re_rpc_res;

	if (*res != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		char *name = args->da_name;
		fhandle_t *dfh = &args->da_fhandle;
		newte->pathname = nfslog_get_path(dfh, name,
			fhpath, "trans_rmdir2");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_RMDIR;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->da_fhandle));

	return (newte);
}

static struct transentry *
trans_rename(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1,
	char *path2)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_rnmargs *args = (nfslog_rnmargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat *res = (nfsstat *)logrec->re_rpc_res;
	char *tpath1 = NULL;
	char *tpath2 = NULL;

	if (*res != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		char *from_name, *to_name;
		fhandle_t *from_dfh, *to_dfh;

		from_name = args->rna_from.da_name;
		from_dfh = &args->rna_from.da_fhandle;
		to_name = args->rna_to.da_name;
		to_dfh = &args->rna_to.da_fhandle;

		path1 = tpath1 = nfslog_get_path(from_dfh, from_name,
			fhpath,	"trans_rename from");
		path2 = tpath2 = nfslog_get_path(to_dfh, to_name,
			fhpath, "trans_rename to");
	}

	newte->pathname = path1; /* no need to strdup here */
	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_RENAME;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->rna_from.da_fhandle));

	/* switch path names for the file for renames */
	if (pte = insert_te(tf->te_list_v2_write, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}
	if (pte = insert_te(tf->te_list_v2_read, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}
	if (pte = insert_te(tf->te_list_v3_write, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}
	if (pte = insert_te(tf->te_list_v3_read, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}

	newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
	/* check for NULL malloc */
	(void) sprintf(newte->pathname, "%s->%s", path1, path2);

	if (tpath1) {
		free(tpath1);
		free(tpath2);
	}

	return (newte);
}

static struct transentry *
trans_link(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1,
	char *path2)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_linkargs *args = (nfslog_linkargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat *res = (nfsstat *)logrec->re_rpc_res;
	char *tpath1 = NULL;
	char *tpath2 = NULL;

	if (*res != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		fhandle_t *fh = &args->la_from;
		char *name = args->la_to.da_name;
		fhandle_t *dfh = &args->la_to.da_fhandle;

		path1 = tpath1 = nfslog_get_path(fh, NULL,
			fhpath, "trans_link from");
		path2 = tpath2 = nfslog_get_path(dfh, name,
			fhpath, "trans_link to");
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_LINK;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->la_from));

	newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
	/* check for NULL malloc */
	(void) sprintf(newte->pathname, "%s->%s", path1, path2);

	if (tpath1) {
		free(tpath1);
		free(tpath2);
	}

	return (newte);
}

static struct transentry *
trans_symlink(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_symlinkargs *args = (nfslog_symlinkargs *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat *res = (nfsstat *)logrec->re_rpc_res;
	char *tpath1 = NULL;

	if (*res != NFS_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		char *name = args->sla_from.da_name;
		fhandle_t *dfh = &args->sla_from.da_fhandle;

		path1 = tpath1 = nfslog_get_path(dfh, name,
			fhpath, "trans_symlink");
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_SYMLINK;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_VERSION;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->sla_from.da_fhandle));

	newte->pathname = (char *)malloc(strlen(path1) +
		strlen(args->sla_tnm) + 3);
	(void) sprintf(newte->pathname, "%s->%s", path1, args->sla_tnm);

	if (tpath1)
		free(tpath1);

	return (newte);
}

static struct transentry *
trans_read3(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_READ3args *args = (nfslog_READ3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_READ3res *res = (nfslog_READ3res *)logrec->re_rpc_res;

	if (res->status != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		fhandle_t *fh = NFSLOG_GET_FHANDLE3(&args->file);
		newte->pathname = nfslog_get_path(fh, NULL,
			fhpath, "trans_read3");
	} else {
		newte->pathname = strdup(path1);
	}

	/* prep the struct for insertion */
	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_READ;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = res->nfslog_READ3res_u.ok.count;
	newte->fh_u.fh3 = args->file;

	if (res->nfslog_READ3res_u.ok.count <
		res->nfslog_READ3res_u.ok.filesize) {
		if (pte = insert_te(tf->te_list_v3_read, newte)) {
			/* free this since entry was found (not inserted) */
			remove_te(newte);

			pte->totalbytes += res->nfslog_READ3res_u.ok.count;

			if (pte->lastupdate.tv_sec <=
				logrec->re_header.rh_timestamp.tv_sec)
				pte->lastupdate =
					logrec->re_header.rh_timestamp;

			if (pte->totalbytes <
				res->nfslog_READ3res_u.ok.filesize) {
				pte = NULL; /* prevent printing of log entry */
			}
		}
	} else {
		pte = newte; /* print a log record - complete file read */
	}

	return (pte);
}

static struct transentry *
trans_write3(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_WRITE3args *args = (nfslog_WRITE3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_WRITE3res *res = (nfslog_WRITE3res *)logrec->re_rpc_res;

	if (res->status != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		fhandle_t *fh = NFSLOG_GET_FHANDLE3(&args->file);
		newte->pathname = nfslog_get_path(fh, NULL,
			fhpath, "trans_write3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_WRITE;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = res->nfslog_WRITE3res_u.ok.count;
	newte->fh_u.fh3 = args->file;

	if (pte = insert_te(tf->te_list_v3_write, newte)) {
		/*
		 * if the write would have increased the total byte count
		 * over the filesize, then generate a log entry and remove
		 * the write record and insert the new one.
		 */
		if (pte->totalbytes + res->nfslog_WRITE3res_u.ok.count >
			res->nfslog_WRITE3res_u.ok.filesize) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
			(void) insert_te(tf->te_list_v3_write, newte);
			pte = NULL;
		} else {
			/* free this since entry was found (not inserted) */
			remove_te(newte);

			pte->totalbytes += res->nfslog_WRITE3res_u.ok.count;

			if (pte->lastupdate.tv_sec <=
				logrec->re_header.rh_timestamp.tv_sec) {
				pte->lastupdate =
					logrec->re_header.rh_timestamp;
			}
			pte = NULL; /* prevent printing of log entry */
		}
	}
	return (pte);
}

static struct transentry *
trans_setattr3(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_SETATTR3args *args = (nfslog_SETATTR3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

	if (*res != NFS3_OK)
		return (NULL);

	if (!args->size.set_it)
		return (NULL);
	/*
	 * should check the size of the file to see if it
	 * is being truncated below current eof.  if so
	 * a record should be generated.... XXX
	 */
	if (args->size.size != 0)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		fhandle_t *fh = NFSLOG_GET_FHANDLE3(&args->object);
		newte->pathname = nfslog_get_path(fh, NULL,
			fhpath, "trans_setattr3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_SETATTR;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->object;

	if (pte = insert_te(tf->te_list_v3_write, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v3_read, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}

	return (newte);
}

static struct transentry *
trans_create3(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_CREATE3args *args = (nfslog_CREATE3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_CREATE3res *res = (nfslog_CREATE3res *)logrec->re_rpc_res;

	if (res->status != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
				args->where.name,
				fhpath, "trans_create3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_CREATE;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;

	if (!args->how.nfslog_createhow3_u.size.set_it)
		newte->totalbytes = 0;
	else
		newte->totalbytes =
			args->how.nfslog_createhow3_u.size.size;

	newte->fh_u.fh3 = args->where.dir;

	if (args->how.nfslog_createhow3_u.size.set_it) {
		if (pte = insert_te(tf->te_list_v3_write, newte)) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
		}
		if (pte = insert_te(tf->te_list_v3_read, newte)) {
			nfslog_print_trans_logentry(pte, tf);
			remove_te(pte);
		}
	}

	return (newte);
}

static struct transentry *
trans_remove3(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_REMOVE3args *args = (nfslog_REMOVE3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

	if (*res != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->object.dir),
				args->object.name,
				fhpath, "trans_remove3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_REMOVE;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->object.dir;

	if (pte = insert_te(tf->te_list_v3_write, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v3_read, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v2_write, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}
	if (pte = insert_te(tf->te_list_v2_read, newte)) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}

	return (newte);
}

static struct transentry *
trans_mkdir3(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_MKDIR3args *args = (nfslog_MKDIR3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_MKDIR3res *res = (nfslog_MKDIR3res *)logrec->re_rpc_res;

	if (res->status != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
				args->where.name,
				fhpath, "trans_mkdir3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_MKDIR;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->where.dir;

	return (newte);
}

static struct transentry *
trans_rmdir3(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_RMDIR3args *args = (nfslog_RMDIR3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

	if (*res != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->object.dir),
				args->object.name,
				fhpath, "trans_rmdir3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_RMDIR;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->object.dir;

	return (newte);
}

static struct transentry *
trans_rename3(
	nfslog_request_record *logrec,
	struct nfslog_trans_file *tf,
	char *fhpath,
	char *path1,
	char *path2)
{
	struct transentry *newte;
	struct transentry *pte = NULL;
	/* LINTED */
	nfslog_RENAME3args *args = (nfslog_RENAME3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;
	char *tpath1 = NULL;
	char *tpath2 = NULL;

	if (*res != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		path1 = tpath1 =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->from.dir),
				args->from.name, fhpath, "trans_rename3 from");
		path2 = tpath2 =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->to.dir),
				args->to.name, fhpath, "trans_rename3 to");
	}

	newte->pathname = path1; /* no need to strdup here */
	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_RENAME;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->from.dir;

	/* switch path names for the file for renames */
	if (pte = insert_te(tf->te_list_v3_write, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}
	if (pte = insert_te(tf->te_list_v3_read, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}
	if (pte = insert_te(tf->te_list_v2_write, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}
	if (pte = insert_te(tf->te_list_v2_read, newte)) {
		free(pte->pathname);
		pte->pathname = strdup(path2);
	}

	newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
	/* check for NULL malloc */
	(void) sprintf(newte->pathname, "%s->%s", path1, path2);

	if (tpath1) {
		free(tpath1);
		free(tpath2);
	}

	return (newte);
}

static struct transentry *
trans_mknod3(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_MKNOD3args *args = (nfslog_MKNOD3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_MKNOD3res *res = (nfslog_MKNOD3res *)logrec->re_rpc_res;

	if (res->status != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		newte->pathname =
			nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
				args->where.name,
				fhpath, "trans_mknod3");
	} else {
		newte->pathname = strdup(path1);
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_MKNOD;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;

	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->where.dir;

	return (newte);
}

static struct transentry *
trans_link3(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1,
	char *path2)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_LINK3args *args = (nfslog_LINK3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

	char *tpath1 = NULL;
	char *tpath2 = NULL;

	if (*res != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (!path1) {
		tpath1 = nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->file),
			NULL, fhpath, "trans_link3 from");
		tpath2 = nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->link.dir),
			args->link.name, fhpath, "trans_link3 to");
		path1 = tpath1;
		path2 = tpath2;
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_LINK;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->file;

	newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
	/* check for NULL malloc */
	(void) sprintf(newte->pathname, "%s->%s", path1, path2);

	if (tpath1) {
		free(tpath1);
		free(tpath2);
	}

	return (newte);
}

static struct transentry *
trans_symlink3(
	nfslog_request_record *logrec,
	char *fhpath,
	char *path1)
{
	struct transentry *newte;
	/* LINTED */
	nfslog_SYMLINK3args *args = (nfslog_SYMLINK3args *)logrec->re_rpc_arg;
	/* LINTED */
	nfslog_SYMLINK3res *res = (nfslog_SYMLINK3res *)logrec->re_rpc_res;
	char *name;

	if (res->status != NFS3_OK)
		return (NULL);

	if ((newte = create_te()) == NULL)
		return (NULL);

	if (path1) {
		name = strdup(path1);
	} else {
		name = nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
			args->where.name, fhpath, "trans_symlink3");
	}

	newte->starttime = logrec->re_header.rh_timestamp;
	newte->lastupdate = logrec->re_header.rh_timestamp;
	newte->optype = TRANS_OPER_SYMLINK;
	newte->datatype = TRANS_DATATYPE_BINARY;
	newte->transoption = TRANS_OPTION_NOACTION;
	newte->pnb = netbufdup(&(logrec->re_ipaddr));
	newte->uid = logrec->re_header.rh_uid;
	newte->nfsvers = NFS_V3;
	newte->netid = strdup(logrec->re_netid);
	if (logrec->re_principal_name)
		newte->principal_name = strdup(logrec->re_principal_name);
	else
		newte->principal_name = NULL;
	newte->totalbytes = 0;
	newte->fh_u.fh3 = args->where.dir;

	newte->pathname = (char *)malloc(strlen(name) +
		strlen(args->symlink_data) + 3);
	/* check for NULL malloc */
	(void) sprintf(newte->pathname, "%s->%s", name, args->symlink_data);

	free(name);

	return (newte);
}

/*
 * nfslog_process_trans_rec - processes the record in the buffer and outputs
 *	to the trans log.
 * Return 0 for success, errno else.
 */
int
nfslog_process_trans_rec(void *transcookie, nfslog_request_record *logrec,
	char *fhpath, char *path1, char *path2)
{
	struct transentry	*pte = NULL;
	struct nfslog_trans_file *tf = (struct nfslog_trans_file *)transcookie;

	/* ignore programs other than nfs */
	if (logrec->re_header.rh_prognum != NFS_PROGRAM)
		return (0);

	/* update the timestamp for use later in the timeout sequences */
	if (tf->lasttrans_timestamp.tv_sec <
		logrec->re_header.rh_timestamp.tv_sec)
		tf->lasttrans_timestamp =
			logrec->re_header.rh_timestamp;

	/* current time of this processing */
	tf->last_trans_read = time(0);

	/* ignore anything that is not a read or write */
	switch (logrec->re_header.rh_version) {
	case NFS_VERSION:
		switch (logrec->re_header.rh_procnum) {
		case RFS_READ:
			if (tf->trans_to_log & TRANSTOLOG_OPER_READ)
				pte = trans_read(logrec, tf, fhpath, path1);
			break;
		case RFS_WRITE:
			if (tf->trans_to_log & TRANSTOLOG_OPER_WRITE)
				pte = trans_write(logrec, tf, fhpath, path1);
			break;
		case RFS_SETATTR:
			if (tf->trans_to_log & TRANSTOLOG_OPER_SETATTR)
				pte = trans_setattr(logrec, tf,
					fhpath, path1);
			break;
		case RFS_REMOVE:
			if (tf->trans_to_log & TRANSTOLOG_OPER_REMOVE)
				pte = trans_remove(logrec, tf,	fhpath, path1);
			break;
		case RFS_MKDIR:
			if (tf->trans_to_log & TRANSTOLOG_OPER_MKDIR)
				pte = trans_mkdir(logrec, fhpath, path1);
			break;
		case RFS_RMDIR:
			if (tf->trans_to_log & TRANSTOLOG_OPER_RMDIR)
				pte = trans_rmdir(logrec, fhpath, path1);
			break;
		case RFS_CREATE:
			if (tf->trans_to_log & TRANSTOLOG_OPER_CREATE)
				pte = trans_create(logrec, tf, fhpath, path1);
			break;
		case RFS_RENAME:
			if (tf->trans_to_log & TRANSTOLOG_OPER_RENAME)
				pte = trans_rename(logrec, tf,
					fhpath, path1, path2);
			break;
		case RFS_LINK:
			if (tf->trans_to_log & TRANSTOLOG_OPER_LINK)
				pte = trans_link(logrec, fhpath, path1, path2);
			break;
		case RFS_SYMLINK:
			if (tf->trans_to_log & TRANSTOLOG_OPER_SYMLINK)
				pte = trans_symlink(logrec, fhpath, path1);
			break;
		default:
			break;
		}
		break;
	case NFS_V3:
		switch (logrec->re_header.rh_procnum) {
		case NFSPROC3_READ:
			if (tf->trans_to_log & TRANSTOLOG_OPER_READ)
				pte = trans_read3(logrec, tf, fhpath, path1);
			break;
		case NFSPROC3_WRITE:
			if (tf->trans_to_log & TRANSTOLOG_OPER_WRITE)
				pte = trans_write3(logrec, tf, fhpath, path1);
			break;
		case NFSPROC3_SETATTR:
			if (tf->trans_to_log & TRANSTOLOG_OPER_SETATTR)
				pte = trans_setattr3(logrec, tf,
					fhpath, path1);
			break;
		case NFSPROC3_REMOVE:
			if (tf->trans_to_log & TRANSTOLOG_OPER_REMOVE)
				pte = trans_remove3(logrec, tf,
					fhpath, path1);
			break;
		case NFSPROC3_MKDIR:
			if (tf->trans_to_log & TRANSTOLOG_OPER_MKDIR)
				pte = trans_mkdir3(logrec, fhpath, path1);
			break;
		case NFSPROC3_RMDIR:
			if (tf->trans_to_log & TRANSTOLOG_OPER_RMDIR)
				pte = trans_rmdir3(logrec, fhpath, path1);
			break;
		case NFSPROC3_CREATE:
			if (tf->trans_to_log & TRANSTOLOG_OPER_CREATE)
				pte = trans_create3(logrec, tf,
					fhpath, path1);
			break;
		case NFSPROC3_RENAME:
			if (tf->trans_to_log & TRANSTOLOG_OPER_RENAME)
				pte = trans_rename3(logrec, tf,
					fhpath, path1, path2);
			break;
		case NFSPROC3_MKNOD:
			if (tf->trans_to_log & TRANSTOLOG_OPER_MKNOD)
				pte = trans_mknod3(logrec, fhpath, path1);
			break;
		case NFSPROC3_LINK:
			if (tf->trans_to_log & TRANSTOLOG_OPER_LINK)
				pte = trans_link3(logrec,
					fhpath, path1, path2);
			break;
		case NFSPROC3_SYMLINK:
			if (tf->trans_to_log & TRANSTOLOG_OPER_SYMLINK)
				pte = trans_symlink3(logrec, fhpath, path1);
			break;
		default:
			break;
		}
		break;
	default:
		break;
	}

	if (pte != NULL) {
		nfslog_print_trans_logentry(pte, tf);
		remove_te(pte);
	}

	return (0);
}

static void
nfslog_print_trans_logentry(struct transentry *pte,
	struct nfslog_trans_file *tf)
{
	char *remotehost;
	char datatype;
	char transoption;
	char *optype;
	char *prin;
	int prinid;
	char nfs_ident[32];

	remotehost = addrtoname(pte->pnb->buf);

	datatype = (pte->datatype == TRANS_DATATYPE_BINARY ? 'b' : 'a');
	transoption = (pte->transoption == TRANS_OPTION_NOACTION ? '_' : '?');

	if (tf->trans_output_type == TRANSLOG_BASIC) {
		(void) strcpy(nfs_ident, "nfs");
	} else {
		(void) strcpy(nfs_ident,
			(pte->nfsvers == NFS_V3 ? "nfs3-" : "nfs-"));
		(void) strcat(nfs_ident, pte->netid);
	}

	switch (pte->optype) {
	case TRANS_OPER_READ:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"read" : "o");
		break;
	case TRANS_OPER_WRITE:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"write" : "i");
		break;
	case TRANS_OPER_REMOVE:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"remove" : "?");
		break;
	case TRANS_OPER_MKDIR:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"mkdir" : "?");
		break;
	case TRANS_OPER_CREATE:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"create" : "?");
		break;
	case TRANS_OPER_RMDIR:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"rmdir" : "?");
		break;
	case TRANS_OPER_SETATTR:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"setattr" : "?");
		break;
	case TRANS_OPER_RENAME:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"rename" : "?");
		break;
	case TRANS_OPER_MKNOD:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"mknod" : "?");
		break;
	case TRANS_OPER_LINK:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"link" : "?");
		break;
	case TRANS_OPER_SYMLINK:
		optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
			"symlink" : "?");
		break;
	default:
		optype = "?";
		break;
	}
	if (strcmp(pte->principal_name, "") == 0) {
		prinid = 0;
		prin = "*";
	} else {
		prinid = 1;
		prin = pte->principal_name;
	}
	(void) fprintf(tf->fp,
		"%.24s %d %s %d %s %c %c %s %c %ld %s %d %s\n",
		ctime((time_t *)&pte->starttime.tv_sec),
		pte->lastupdate.tv_sec - pte->starttime.tv_sec,
		remotehost,
		(uint32_t)pte->totalbytes,
		pte->pathname,
		datatype,
		transoption,
		optype,
		'r', /* anonymous == 'a', guest == 'g', real == 'r'), */
		pte->uid,
		nfs_ident,
		/* authenticated - fill in kerb/security? */
		prinid,
		/* authenticated ? authuser : "*" */
		prin);
}