xref: /titanic_53/usr/src/cmd/auditstat/auditstat.c (revision d75d0dc9a76c4d28c5b421415de169350a8e844d)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5*d75d0dc9Stz204579  * Common Development and Distribution License (the "License").
6*d75d0dc9Stz204579  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22*d75d0dc9Stz204579  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
237c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate #include <sys/types.h>
297c478bd9Sstevel@tonic-gate #include <stdlib.h>
307c478bd9Sstevel@tonic-gate #include <ctype.h>
317c478bd9Sstevel@tonic-gate #include <stdio.h>
327c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
337c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
347c478bd9Sstevel@tonic-gate #include <unistd.h>
357c478bd9Sstevel@tonic-gate 
367c478bd9Sstevel@tonic-gate /*
377c478bd9Sstevel@tonic-gate  * Display header every HEADER_MOD lines printed
387c478bd9Sstevel@tonic-gate  */
397c478bd9Sstevel@tonic-gate #define		DFLT_HEADER_MOD (20)
407c478bd9Sstevel@tonic-gate #define		ONEK (1024)
417c478bd9Sstevel@tonic-gate 
427c478bd9Sstevel@tonic-gate #define		CFLG (0x01)
437c478bd9Sstevel@tonic-gate #define		HFLG (0x02)
447c478bd9Sstevel@tonic-gate #define		IFLG (0x04)
457c478bd9Sstevel@tonic-gate #define		NFLG (0x08)
467c478bd9Sstevel@tonic-gate #define		VFLG (0x10)
477c478bd9Sstevel@tonic-gate 
487c478bd9Sstevel@tonic-gate extern char	*optarg;
497c478bd9Sstevel@tonic-gate 
507c478bd9Sstevel@tonic-gate static int	count;
517c478bd9Sstevel@tonic-gate static int	flags;
527c478bd9Sstevel@tonic-gate static int	header_mod = DFLT_HEADER_MOD;
537c478bd9Sstevel@tonic-gate static int	interval;
547c478bd9Sstevel@tonic-gate 
557c478bd9Sstevel@tonic-gate static void	display_stats();
567c478bd9Sstevel@tonic-gate static void	eauditon();
577c478bd9Sstevel@tonic-gate static void	parse_args();
587c478bd9Sstevel@tonic-gate static void	usage_exit();
597c478bd9Sstevel@tonic-gate static int	strisdigit();
607c478bd9Sstevel@tonic-gate 
617c478bd9Sstevel@tonic-gate int
627c478bd9Sstevel@tonic-gate main(argc, argv)
637c478bd9Sstevel@tonic-gate int	argc;
647c478bd9Sstevel@tonic-gate char	**argv;
657c478bd9Sstevel@tonic-gate {
667c478bd9Sstevel@tonic-gate 	register int	i;
677c478bd9Sstevel@tonic-gate 	au_stat_t s;
687c478bd9Sstevel@tonic-gate 
697c478bd9Sstevel@tonic-gate 	(void) setbuf(stdout, (char *)0);
707c478bd9Sstevel@tonic-gate 	(void) setbuf(stderr, (char *)0);
717c478bd9Sstevel@tonic-gate 
727c478bd9Sstevel@tonic-gate 	parse_args(argc, argv);
737c478bd9Sstevel@tonic-gate 
747c478bd9Sstevel@tonic-gate 	if (!flags) {
757c478bd9Sstevel@tonic-gate 		eauditon(A_GETSTAT, (caddr_t)&s, NULL);
767c478bd9Sstevel@tonic-gate 		display_stats(&s, 0);
777c478bd9Sstevel@tonic-gate 		exit(0);
787c478bd9Sstevel@tonic-gate 	}
797c478bd9Sstevel@tonic-gate 
807c478bd9Sstevel@tonic-gate 	if (flags & VFLG || flags & NFLG)
817c478bd9Sstevel@tonic-gate 		eauditon(A_GETSTAT, (caddr_t)&s, NULL);
827c478bd9Sstevel@tonic-gate 
837c478bd9Sstevel@tonic-gate 	if (flags & VFLG)
847c478bd9Sstevel@tonic-gate 		(void) printf("version = %d\n", s.as_version);
857c478bd9Sstevel@tonic-gate 
867c478bd9Sstevel@tonic-gate 	if (flags & NFLG)
877c478bd9Sstevel@tonic-gate 		(void) printf("number of kernel events = %d\n", s.as_numevent);
887c478bd9Sstevel@tonic-gate 
897c478bd9Sstevel@tonic-gate 	if (!(flags & IFLG))
907c478bd9Sstevel@tonic-gate 		exit(0);
917c478bd9Sstevel@tonic-gate 
927c478bd9Sstevel@tonic-gate 	/* CSTYLED */
937c478bd9Sstevel@tonic-gate 	for (i = 0;; i++) {
947c478bd9Sstevel@tonic-gate 		eauditon(A_GETSTAT, (caddr_t)&s, NULL);
957c478bd9Sstevel@tonic-gate 		display_stats(&s, i);
967c478bd9Sstevel@tonic-gate 		if ((flags & CFLG) && count)
977c478bd9Sstevel@tonic-gate 			if (i == count - 1)
987c478bd9Sstevel@tonic-gate 				break;
997c478bd9Sstevel@tonic-gate 		(void) sleep(interval);
1007c478bd9Sstevel@tonic-gate 	}
1017c478bd9Sstevel@tonic-gate 
1027c478bd9Sstevel@tonic-gate 	return (0);
1037c478bd9Sstevel@tonic-gate }
1047c478bd9Sstevel@tonic-gate 
1057c478bd9Sstevel@tonic-gate 
1067c478bd9Sstevel@tonic-gate static void
1077c478bd9Sstevel@tonic-gate display_stats(s, cnt)
1087c478bd9Sstevel@tonic-gate au_stat_t *s;
1097c478bd9Sstevel@tonic-gate {
1107c478bd9Sstevel@tonic-gate 	int	offset[12];   /* used to line the header up correctly */
1117c478bd9Sstevel@tonic-gate 	char	buf[512];
1127c478bd9Sstevel@tonic-gate 
1137c478bd9Sstevel@tonic-gate 	(void) sprintf(buf,
1147c478bd9Sstevel@tonic-gate "%4u %n%4u %n%4u %n%4u %n%4u %n%4u %n%4u %n%4u %n%4u %n%4u %n%4u %n%4u%n",
1157c478bd9Sstevel@tonic-gate 		s->as_generated, 	&(offset[0]),
1167c478bd9Sstevel@tonic-gate 		s->as_nonattrib, 	&(offset[1]),
1177c478bd9Sstevel@tonic-gate 		s->as_kernel, 		&(offset[2]),
1187c478bd9Sstevel@tonic-gate 		s->as_audit, 		&(offset[3]),
1197c478bd9Sstevel@tonic-gate 		s->as_auditctl, 	&(offset[4]),
1207c478bd9Sstevel@tonic-gate 		s->as_enqueue, 		&(offset[5]),
1217c478bd9Sstevel@tonic-gate 		s->as_written, 		&(offset[6]),
1227c478bd9Sstevel@tonic-gate 		s->as_wblocked, 	&(offset[7]),
1237c478bd9Sstevel@tonic-gate 		s->as_rblocked, 	&(offset[8]),
1247c478bd9Sstevel@tonic-gate 		s->as_dropped, 		&(offset[9]),
1257c478bd9Sstevel@tonic-gate 		s->as_totalsize / ONEK,	&(offset[10]),
1267c478bd9Sstevel@tonic-gate 		s->as_memused / ONEK, 	&(offset[11]));
1277c478bd9Sstevel@tonic-gate 
1287c478bd9Sstevel@tonic-gate 	/* print a properly aligned header every HEADER_MOD lines */
1297c478bd9Sstevel@tonic-gate 	if (header_mod && (!cnt || !(cnt % header_mod))) {
1307c478bd9Sstevel@tonic-gate 		(void) printf(
1317c478bd9Sstevel@tonic-gate 			"%*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s\n",
1327c478bd9Sstevel@tonic-gate 			offset[0] - 1,			"gen",
1337c478bd9Sstevel@tonic-gate 			offset[1] - offset[0] - 1,	"nona",
1347c478bd9Sstevel@tonic-gate 			offset[2] - offset[1] - 1,	"kern",
1357c478bd9Sstevel@tonic-gate 			offset[3] - offset[2] - 1,	"aud",
1367c478bd9Sstevel@tonic-gate 			offset[4] - offset[3] - 1,	"ctl",
1377c478bd9Sstevel@tonic-gate 			offset[5] - offset[4] - 1,	"enq",
1387c478bd9Sstevel@tonic-gate 			offset[6] - offset[5] - 1,	"wrtn",
1397c478bd9Sstevel@tonic-gate 			offset[7] - offset[6] - 1,	"wblk",
1407c478bd9Sstevel@tonic-gate 			offset[8] - offset[7] - 1,	"rblk",
1417c478bd9Sstevel@tonic-gate 			offset[9] - offset[8] - 1,	"drop",
1427c478bd9Sstevel@tonic-gate 			offset[10] - offset[9] - 1,	"tot",
1437c478bd9Sstevel@tonic-gate 			offset[11] - offset[10],	"mem");
1447c478bd9Sstevel@tonic-gate 	}
1457c478bd9Sstevel@tonic-gate 
1467c478bd9Sstevel@tonic-gate 	(void) puts(buf);
1477c478bd9Sstevel@tonic-gate }
1487c478bd9Sstevel@tonic-gate 
1497c478bd9Sstevel@tonic-gate 
1507c478bd9Sstevel@tonic-gate static void
1517c478bd9Sstevel@tonic-gate eauditon(cmd, data, length)
1527c478bd9Sstevel@tonic-gate int	cmd;
1537c478bd9Sstevel@tonic-gate caddr_t data;
1547c478bd9Sstevel@tonic-gate int	length;
1557c478bd9Sstevel@tonic-gate {
1567c478bd9Sstevel@tonic-gate 	if (auditon(cmd, data, length) == -1) {
1577c478bd9Sstevel@tonic-gate 		perror("auditstat: auditon");
1587c478bd9Sstevel@tonic-gate 		exit(1);
1597c478bd9Sstevel@tonic-gate 	}
1607c478bd9Sstevel@tonic-gate }
1617c478bd9Sstevel@tonic-gate 
1627c478bd9Sstevel@tonic-gate 
1637c478bd9Sstevel@tonic-gate static void
1647c478bd9Sstevel@tonic-gate parse_args(argc, argv)
1657c478bd9Sstevel@tonic-gate int	argc;
1667c478bd9Sstevel@tonic-gate char	**argv;
1677c478bd9Sstevel@tonic-gate {
1687c478bd9Sstevel@tonic-gate 	int	c;
1697c478bd9Sstevel@tonic-gate 
1707c478bd9Sstevel@tonic-gate 	while ((c = getopt(argc, argv, "c:h:i:vn")) != -1) {
1717c478bd9Sstevel@tonic-gate 		switch (c) {
1727c478bd9Sstevel@tonic-gate 		case 'c':
1737c478bd9Sstevel@tonic-gate 			if (flags & CFLG)
1747c478bd9Sstevel@tonic-gate 				usage_exit();
1757c478bd9Sstevel@tonic-gate 			flags |= CFLG;
1767c478bd9Sstevel@tonic-gate 			if (strisdigit(optarg)) {
1777c478bd9Sstevel@tonic-gate 				(void) fprintf(stderr,
1787c478bd9Sstevel@tonic-gate 				"auditstat: invalid count specified.\n");
1797c478bd9Sstevel@tonic-gate 				exit(1);
1807c478bd9Sstevel@tonic-gate 			}
1817c478bd9Sstevel@tonic-gate 			count = atoi(optarg);
1827c478bd9Sstevel@tonic-gate 			break;
1837c478bd9Sstevel@tonic-gate 		case 'h':
1847c478bd9Sstevel@tonic-gate 			if (flags & HFLG)
1857c478bd9Sstevel@tonic-gate 				usage_exit();
1867c478bd9Sstevel@tonic-gate 			flags |= HFLG;
1877c478bd9Sstevel@tonic-gate 			if (strisdigit(optarg)) {
1887c478bd9Sstevel@tonic-gate 				(void) fprintf(stderr,
1897c478bd9Sstevel@tonic-gate 				"auditstat: invalid header arg specified.\n");
1907c478bd9Sstevel@tonic-gate 				exit(1);
1917c478bd9Sstevel@tonic-gate 			}
1927c478bd9Sstevel@tonic-gate 			header_mod = atoi(optarg);
1937c478bd9Sstevel@tonic-gate 			break;
1947c478bd9Sstevel@tonic-gate 		case 'i':
1957c478bd9Sstevel@tonic-gate 			if (flags & IFLG)
1967c478bd9Sstevel@tonic-gate 				usage_exit();
1977c478bd9Sstevel@tonic-gate 			flags |= IFLG;
1987c478bd9Sstevel@tonic-gate 			if (strisdigit(optarg)) {
1997c478bd9Sstevel@tonic-gate 				(void) fprintf(stderr,
2007c478bd9Sstevel@tonic-gate 				"auditstat: invalid interval specified.\n");
2017c478bd9Sstevel@tonic-gate 				exit(1);
2027c478bd9Sstevel@tonic-gate 			}
2037c478bd9Sstevel@tonic-gate 			interval = atoi(optarg);
2047c478bd9Sstevel@tonic-gate 			break;
2057c478bd9Sstevel@tonic-gate 		case 'n':
2067c478bd9Sstevel@tonic-gate 			if (flags & NFLG)
2077c478bd9Sstevel@tonic-gate 				usage_exit();
2087c478bd9Sstevel@tonic-gate 			flags |= NFLG;
2097c478bd9Sstevel@tonic-gate 			break;
2107c478bd9Sstevel@tonic-gate 		case 'v':
2117c478bd9Sstevel@tonic-gate 			if (flags & VFLG)
2127c478bd9Sstevel@tonic-gate 				usage_exit();
2137c478bd9Sstevel@tonic-gate 			flags |= VFLG;
2147c478bd9Sstevel@tonic-gate 			break;
2157c478bd9Sstevel@tonic-gate 		case '?':
2167c478bd9Sstevel@tonic-gate 		default:
2177c478bd9Sstevel@tonic-gate 			usage_exit();
2187c478bd9Sstevel@tonic-gate 			break;
2197c478bd9Sstevel@tonic-gate 		}
2207c478bd9Sstevel@tonic-gate 	}
2217c478bd9Sstevel@tonic-gate }
2227c478bd9Sstevel@tonic-gate 
2237c478bd9Sstevel@tonic-gate 
2247c478bd9Sstevel@tonic-gate static void
2257c478bd9Sstevel@tonic-gate usage_exit()
2267c478bd9Sstevel@tonic-gate {
2277c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
228*d75d0dc9Stz204579 	    "auditstat: usage: auditstat [-c count] [-h lines] "
229*d75d0dc9Stz204579 	    "[-i interval] [-n] [-v]\n");
2307c478bd9Sstevel@tonic-gate 	exit(1);
2317c478bd9Sstevel@tonic-gate }
2327c478bd9Sstevel@tonic-gate 
2337c478bd9Sstevel@tonic-gate 
2347c478bd9Sstevel@tonic-gate static int
2357c478bd9Sstevel@tonic-gate strisdigit(s)
2367c478bd9Sstevel@tonic-gate char	*s;
2377c478bd9Sstevel@tonic-gate {
2387c478bd9Sstevel@tonic-gate 	for (; *s; s++)
2397c478bd9Sstevel@tonic-gate 		if (!isdigit(*s))
2407c478bd9Sstevel@tonic-gate 			return (1);
2417c478bd9Sstevel@tonic-gate 
2427c478bd9Sstevel@tonic-gate 	return (0);
2437c478bd9Sstevel@tonic-gate }
244