/usr/bin/grokevt-addlog is in grokevt 0.4.1-7.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 | #!/bin/sh
# This script takes a raw Windows event log and adds it to a
# previously built database generated by grokevt-builddb.
# See the man page for more details.
#
# Copyright (C) 2006 Timothy D. Morgan
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation version 2 of the
# License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# $Id: grokevt-addlog 79 2006-05-08 22:55:52Z tim $
usage()
{
echo "USAGE:" 1>&2
echo " $0 <DATABASE_DIR> <EVT_FILE> <NEW_TYPE> <BASE_TYPE>" 1>&2
echo 1>&2
echo "This script takes a raw Windows event log and adds it to a" 1>&2
echo "previously built database generated by grokevt-builddb." 1>&2
echo "See the man page for more details." 1>&2
}
if [ $# -ne 4 ]; then
usage
exit 1
fi
DATABASE_DIR="$1"
EVT_FILE="$2"
NEW_TYPE="$3"
BASE_TYPE="$4"
if [ ! -d "$DATABASE_DIR" ]; then
echo "ERROR: '$DATABASE_DIR' is not a directory." 1>&2
exit 2
fi
if [ ! -r "$EVT_FILE" ]; then
echo "ERROR: '$EVT_FILE' could not be read." 1>&2
exit 2
fi
if [ -e "${DATABASE_DIR}/logs/${NEW_TYPE}.evt" ]; then
echo "ERROR: A '$NEW_TYPE' log already exists." 1>&2
exit 2
fi
if [ ! -d "${DATABASE_DIR}/services/${BASE_TYPE}" ]; then
echo "ERROR: A '$BASE_TYPE' log does not exist." 1>&2
exit 2
fi
cp "$EVT_FILE" "${DATABASE_DIR}/logs/${NEW_TYPE}.evt"\
|| ( echo "ERROR: Could not copy log file." 1>&2; exit 3 )
ln -s "$BASE_TYPE" "${DATABASE_DIR}/services/${NEW_TYPE}"\
|| ( echo "ERROR: Could not create symlink to BASE_TYPE." 1>&2; exit 3 )
|