Blame SOURCES/aide-0.15-syslog-format.patch

77c2a8
diff -up ./doc/aide.conf.5.in.syslog-format ./doc/aide.conf.5.in
77c2a8
--- ./doc/aide.conf.5.in.syslog-format	2010-08-08 13:39:31.000000000 -0400
77c2a8
+++ ./doc/aide.conf.5.in	2017-03-07 11:12:49.964000000 -0500
77c2a8
@@ -44,6 +44,25 @@ inclusive. This parameter can only be gi
77c2a8
 occurence is used. If \-\-verbose or \-V is used then the value from that
77c2a8
 is used. The default is 5. If verbosity is 20 then additional report
77c2a8
 output is written when doing \-\-check, \-\-update or \-\-compare.
77c2a8
+.IP "syslog_format"
77c2a8
+Valid values are yes,true,no and false. This option enables new syslog format
77c2a8
+which is suitable for logging. Every change is logged as one simple line. This option
77c2a8
+changes verbose level to 0 and prints everything that was changed. It is suggested 
77c2a8
+to use this option with "report_url=syslog:...". Default value is "false/no".
77c2a8
+Maximum size of message is 1KB which is limitation of syslog call. If message is 
77c2a8
+greater than limit, message will be truncated.
77c2a8
+Option summarize_changes has no impact for this format.
77c2a8
+.nf
77c2a8
+.eo
77c2a8
+
77c2a8
+Output always starts with:
77c2a8
+"AIDE found differences between database and filesystem!!"
77c2a8
+And it is followed by summary:
77c2a8
+summary;total_number_of_files=1000;added_files=0;removed_files=0;changed_files=1
77c2a8
+And finally there are logs about changes:
77c2a8
+dir=/usr/sbin;Mtime_old=0000-00-00 00:00:00;Mtime_new=0000-00-00 00:00:00;...
77c2a8
+.ec
77c2a8
+.fi
77c2a8
 .IP "report_url"
77c2a8
 The url that the output is written to. There can be multiple instances
77c2a8
 of this parameter. Output is written to all of them. The default is
77c2a8
diff -up ./include/db_config.h.syslog-format ./include/db_config.h
77c2a8
--- ./include/db_config.h.syslog-format	2010-08-08 13:39:31.000000000 -0400
77c2a8
+++ ./include/db_config.h	2017-03-07 11:12:49.964000000 -0500
77c2a8
@@ -264,6 +264,7 @@ typedef struct db_config {
77c2a8
   FILE* db_out;
77c2a8
   
77c2a8
   int config_check;
77c2a8
+  int syslog_format;
77c2a8
 
77c2a8
 #ifdef WITH_ZLIB
77c2a8
   gzFile db_gzin;
77c2a8
diff -up ./src/aide.c.syslog-format ./src/aide.c
77c2a8
--- ./src/aide.c.syslog-format	2017-03-07 11:12:49.960000000 -0500
77c2a8
+++ ./src/aide.c	2017-03-07 11:12:49.964000000 -0500
77c2a8
@@ -264,6 +264,7 @@ void setdefaults_before_config()
77c2a8
   }
77c2a8
   
77c2a8
   /* Setting some defaults */
77c2a8
+  conf->syslog_format=0;
77c2a8
   conf->report_db=0;  
77c2a8
   conf->tree=NULL;
77c2a8
   conf->config_check=0;
77c2a8
@@ -468,6 +469,9 @@ void setdefaults_after_config()
77c2a8
   if(conf->verbose_level==-1){
77c2a8
     conf->verbose_level=5;
77c2a8
   }
77c2a8
+  if(conf->syslog_format==1){
77c2a8
+    conf->verbose_level=0;
77c2a8
+  }
77c2a8
 }
77c2a8
 
77c2a8
 
77c2a8
@@ -664,6 +668,7 @@ int main(int argc,char**argv)
77c2a8
   gcry_control(GCRYCTL_TERM_SECMEM, 0);
77c2a8
 #endif /* WITH_GCRYPT */
77c2a8
   return RETOK;
77c2a8
+
77c2a8
 }
77c2a8
 const char* aide_key_3=CONFHMACKEY_03;
77c2a8
 const char* db_key_3=DBHMACKEY_03;
77c2a8
diff -up ./src/compare_db.c.syslog-format ./src/compare_db.c
77c2a8
--- ./src/compare_db.c.syslog-format	2010-08-08 13:39:31.000000000 -0400
77c2a8
+++ ./src/compare_db.c	2017-03-07 11:30:52.630000000 -0500
77c2a8
@@ -50,6 +50,7 @@
77c2a8
 #include "md.h"
77c2a8
 
77c2a8
 /*************/
77c2a8
+#define MESSAGE_SIZE 1024
77c2a8
 /* contruction area for report lines */
77c2a8
 const int old_col  = 12;   
77c2a8
 const int new_col  = 40;   
77c2a8
@@ -60,6 +61,9 @@ char      oline[129];
77c2a8
 char      nline[129];
77c2a8
 const char* entry_format=        " %-9s: %-33s, %s\n";
77c2a8
 const char* entry_format_justnew=" %-9s: %-33c  %s\n";
77c2a8
+const char* entry_syslog=        "%s_old=%s;%s_new=%s";
77c2a8
+const char* entry_syslog_justnew="%s_new=%s";
77c2a8
+
77c2a8
 #ifdef WITH_E2FSATTRS
77c2a8
     /* flag->character mappings defined in lib/e2p/pf.c (part of e2fsprogs-1.41.12 sources) */
77c2a8
     unsigned long flag_bits[] = { EXT2_SECRM_FL, EXT2_UNRM_FL, EXT2_SYNC_FL, EXT2_DIRSYNC_FL, EXT2_IMMUTABLE_FL,
77c2a8
@@ -415,7 +419,7 @@ DB_ATTR_TYPE compare_dbline(db_line* l1,
77c2a8
   return ret;
77c2a8
 }
77c2a8
 
77c2a8
-void print_str_changes(char*old,char*new,const char *name, DB_ATTR_TYPE force)
77c2a8
+void print_str_changes(char*old,char*new,const char *name, DB_ATTR_TYPE force, char* part_message)
77c2a8
 {
77c2a8
   int mode = 0;
77c2a8
   if(old==NULL){
77c2a8
@@ -438,50 +442,80 @@ void print_str_changes(char*old,char*new
77c2a8
   }
77c2a8
    if(mode == 1) {
77c2a8
      error(2,(char*)entry_format,name,oline,nline);
77c2a8
+     if(part_message!=NULL && conf->syslog_format){
77c2a8
+       snprintf(part_message, MESSAGE_SIZE, entry_syslog, name, oline, name, nline);
77c2a8
+     }
77c2a8
    } else if (mode == 2) {
77c2a8
     error(2,(char*)entry_format_justnew,name,' ',nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog_justnew, name, nline);
77c2a8
+    }
77c2a8
+   } else {
77c2a8
+      part_message="\0";
77c2a8
    }
77c2a8
    return;
77c2a8
 }
77c2a8
 
77c2a8
 #ifdef WITH_ACL
77c2a8
-void print_single_acl(acl_type* acl)
77c2a8
+void print_single_acl(acl_type* acl, char* line)
77c2a8
 {
77c2a8
   if (acl==NULL) {
77c2a8
     error(2,"<null>\n");
77c2a8
+    if (conf->syslog_format)snprintf(line, long_part_len, "<null>");
77c2a8
   } else {
77c2a8
 #ifdef WITH_POSIX_ACL
77c2a8
-    if (!acl->acl_a)
77c2a8
+    if (!acl->acl_a) {
77c2a8
       error(2,"A: <none>\n                  ");
77c2a8
-    else
77c2a8
+      if (conf->syslog_format)snprintf(line, long_part_len, "A:<none>");
77c2a8
+    }
77c2a8
+    else {
77c2a8
       error(2,"A:\n----\n%s----\n                  ",acl->acl_a);
77c2a8
-    if (!acl->acl_d)
77c2a8
+      if (conf->syslog_format)snprintf(line, long_part_len, "A:%s", acl->acl_a);
77c2a8
+    }
77c2a8
+    size_t len=strlen(line);
77c2a8
+    if (!acl->acl_d) {
77c2a8
       error(2,"D: <none>\n");
77c2a8
-    else
77c2a8
+      if (conf->syslog_format&&len<(size_t)long_part_len)snprintf(line+len-1, long_part_len, "|D:<none>");
77c2a8
+    }
77c2a8
+    else {
77c2a8
       error(2,"D:\n----\n%s----\n",acl->acl_d);
77c2a8
+      if (conf->syslog_format&&len<(size_t)long_part_len)snprintf(line+len-1, long_part_len, "|D:%s", acl->acl_d);
77c2a8
+    }
77c2a8
 #endif
77c2a8
 #ifdef WITH_SUN_ACL
77c2a8
     aclt=acltotext(acl->acl,acl->entries);
77c2a8
     if (aclt==NULL) {
77c2a8
       error(2,"ERROR\n");
77c2a8
+      if (conf->syslog_format)snprintf(line, long_part_len, "<error>");
77c2a8
     } else {
77c2a8
       error(2,"%s ,\n",aclt);
77c2a8
+      if (conf->syslog_format)snprintf(line, long_part_len, "%s", aclt);
77c2a8
       free(aclt);
77c2a8
     }
77c2a8
 #endif
77c2a8
   }
77c2a8
 }
77c2a8
 
77c2a8
-void print_acl_changes(acl_type* old,acl_type* new, DB_ATTR_TYPE force) {
77c2a8
+void print_acl_changes(acl_type* old,acl_type* new, DB_ATTR_TYPE force, char* part_message) {
77c2a8
   
77c2a8
   if (compare_acl(old,new)==RETFAIL) {
77c2a8
     error(2," ACL      : old = ");
77c2a8
-    print_single_acl(old);
77c2a8
+    print_single_acl(old, oline);
77c2a8
     error(2,"            new = ");
77c2a8
-    print_single_acl(new);
77c2a8
+    print_single_acl(new, nline);
77c2a8
+    if (conf->syslog_format) {
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, "ACL_old=|%s|;ACL_new=|%s|", oline, nline);
77c2a8
+      unsigned int i;
77c2a8
+      for (i = 0; i < strlen(part_message); i++) if (part_message[i] == '\n') part_message[i] = ' ';
77c2a8
+    }
77c2a8
   } else if (old!=NULL && new!=NULL && force) {
77c2a8
       error(2," ACL      :       ");
77c2a8
-      print_single_acl(new);
77c2a8
+      print_single_acl(new, nline);
77c2a8
+      if (conf->syslog_format) {
77c2a8
+        snprintf(part_message, MESSAGE_SIZE, "ACL_new=|%s|", nline);
77c2a8
+        unsigned int i;
77c2a8
+        for (i = 0; i < strlen(part_message); i++) if (part_message[i] == '\n') part_message[i] = ' ';
77c2a8
+      }
77c2a8
   }
77c2a8
 }
77c2a8
 #endif
77c2a8
@@ -502,15 +536,18 @@ static size_t xstrnspn(const char *s1, s
77c2a8
     "ABCDEFGHIJKLMNOPQRSTUVWXYZ"                \
77c2a8
     ".-_:;,[]{}<>()!@#$%^&*|\\/?~"
77c2a8
 
77c2a8
-void print_single_xattrs(xattrs_type* xattrs)
77c2a8
+void print_single_xattrs(xattrs_type* xattrs, char* line)
77c2a8
 {
77c2a8
   if (xattrs==NULL) {
77c2a8
     error(2,"num=0\n");
77c2a8
+    if (conf->syslog_format)snprintf(line, MESSAGE_SIZE, "num=0");
77c2a8
   } else {
77c2a8
     size_t num = 0;
77c2a8
     int width = 0;
77c2a8
-    
77c2a8
+    char tmp[MESSAGE_SIZE]={0};    
77c2a8
+
77c2a8
     error(2,"num=%lu\n", (unsigned long)xattrs->num);
77c2a8
+    if (conf->syslog_format)snprintf(line, MESSAGE_SIZE, "num=%lu", (unsigned long)xattrs->num);
77c2a8
 
77c2a8
     width = log10(xattrs->num); /* make them the same width */
77c2a8
     
77c2a8
@@ -524,33 +561,44 @@ void print_single_xattrs(xattrs_type* xa
77c2a8
       len = xstrnspn(val, xattrs->ents[num - 1].vsz, PRINTABLE_XATTR_VALS);
77c2a8
       
77c2a8
       if ((len ==  xattrs->ents[num - 1].vsz) ||
77c2a8
-          ((len == (xattrs->ents[num - 1].vsz - 1)) && !val[len]))
77c2a8
+          ((len == (xattrs->ents[num - 1].vsz - 1)) && !val[len])) {
77c2a8
         error(2,"             [%.*zd] %s = %s\n", width, num,
77c2a8
               xattrs->ents[num - 1].key, val);
77c2a8
-      else        
77c2a8
-      {
77c2a8
+        if (conf->syslog_format)snprintf(tmp, MESSAGE_SIZE, "[%.*zd]%s=%s", width, num,
77c2a8
+              xattrs->ents[num - 1].key, val);
77c2a8
+      }
77c2a8
+      else {
77c2a8
         val = encode_base64(xattrs->ents[num - 1].val,
77c2a8
                             xattrs->ents[num - 1].vsz);
77c2a8
         error(2,"             [%.*zd] %s <=> %s\n", width, num,
77c2a8
               xattrs->ents[num - 1].key, val);
77c2a8
+        if (conf->syslog_format)snprintf(tmp, MESSAGE_SIZE, "[%.*zd]%s<=>%s", width, num,
77c2a8
+              xattrs->ents[num - 1].key, val);
77c2a8
         free(val);
77c2a8
       }
77c2a8
-      
77c2a8
+
77c2a8
+      if (conf->syslog_format&&len
77c2a8
+        len=strlen(line);
77c2a8
+        snprintf(line+len, MESSAGE_SIZE-len, "|%s", tmp);
77c2a8
+      }
77c2a8
     }
77c2a8
   }
77c2a8
 }
77c2a8
 
77c2a8
 void print_xattrs_changes(xattrs_type* old,xattrs_type* new,
77c2a8
-        DB_ATTR_TYPE force) {
77c2a8
-  
77c2a8
+        DB_ATTR_TYPE force, char* part_message) {
77c2a8
+  char old_attrs[MESSAGE_SIZE]={0};
77c2a8
+  char new_attrs[MESSAGE_SIZE]={0};
77c2a8
   if (compare_xattrs(old,new)==RETFAIL) {
77c2a8
     error(2," XAttrs   : old = ");
77c2a8
-    print_single_xattrs(old);
77c2a8
+    print_single_xattrs(old, (char*)old_attrs);
77c2a8
     error(2,"            new = ");
77c2a8
-    print_single_xattrs(new);
77c2a8
+    print_single_xattrs(new, (char*)new_attrs);
77c2a8
+    if (conf->syslog_format)snprintf(part_message, MESSAGE_SIZE, "XAttrs_old=|%s|;XAttrs_new=|%s|", (char*)old_attrs, (char*)new_attrs);
77c2a8
   } else if (force) {
77c2a8
       error(2," XAttrs   : ");
77c2a8
-      print_single_xattrs(new);
77c2a8
+      print_single_xattrs(new, (char*)new_attrs);
77c2a8
+      if (conf->syslog_format)snprintf(part_message, MESSAGE_SIZE, "XAttrs_new=|%s|", (char*)new_attrs);
77c2a8
   }
77c2a8
   
77c2a8
 }
77c2a8
@@ -571,7 +619,7 @@ char* e2fsattrs2char(unsigned long flags
77c2a8
 }
77c2a8
 #endif
77c2a8
 
77c2a8
-void print_md_changes(byte*old,byte*new,int len,char* name, DB_ATTR_TYPE force)
77c2a8
+void print_md_changes(byte*old,byte*new,int len,char* name, DB_ATTR_TYPE force, char* part_message)
77c2a8
 {
77c2a8
     int mode = 0;
77c2a8
     if (old!=NULL && new!=NULL) {
77c2a8
@@ -594,8 +642,14 @@ void print_md_changes(byte*old,byte*new,
77c2a8
     }
77c2a8
     if (mode == 1) {
77c2a8
         error(2,(char*)entry_format,name,oline,nline);
77c2a8
+        if(part_message!=NULL && conf->syslog_format){
77c2a8
+          snprintf(part_message, MESSAGE_SIZE, entry_syslog, name, oline, name, nline);
77c2a8
+        }
77c2a8
     } else if (mode == 2) {
77c2a8
         error(2,(char*)entry_format_justnew,name,' ',nline);
77c2a8
+        if(part_message!=NULL && conf->syslog_format){
77c2a8
+          snprintf(part_message, MESSAGE_SIZE, entry_syslog_justnew, name, nline);
77c2a8
+        }
77c2a8
     }
77c2a8
     return;
77c2a8
 }
77c2a8
@@ -607,7 +661,7 @@ int is_time_null(struct tm *ot)
77c2a8
             && ot->tm_hour == 1 &&  ot->tm_min == 0 && ot->tm_sec == 0);
77c2a8
 }
77c2a8
 
77c2a8
-void print_time_changes(const char* name, time_t old_time, time_t new_time,int justnew)
77c2a8
+void print_time_changes(const char* name, time_t old_time, time_t new_time,int justnew, char* part_message)
77c2a8
 {
77c2a8
   struct tm otm;
77c2a8
   struct tm *ot = &otm;
77c2a8
@@ -640,12 +694,18 @@ void print_time_changes(const char* name
77c2a8
   }
77c2a8
   if (justnew) {
77c2a8
     error(2,(char*)entry_format_justnew,name,' ',nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog_justnew, name, nline);
77c2a8
+    }
77c2a8
   } else {
77c2a8
-    error(2,(char*)entry_format,name,oline,nline); 
77c2a8
+    error(2,(char*)entry_format,name,oline,nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog, name, oline, name, nline);
77c2a8
+    }
77c2a8
   }
77c2a8
 }
77c2a8
 
77c2a8
-void print_int_changes(const char* name, int old, int new, int justnew)
77c2a8
+void print_int_changes(const char* name, int old, int new, int justnew, char* part_message)
77c2a8
 {
77c2a8
   if (!justnew) {
77c2a8
     snprintf(oline,part_len,"%i",old);
77c2a8
@@ -653,11 +713,17 @@ void print_int_changes(const char* name,
77c2a8
   snprintf(nline,part_len,"%i",new);
77c2a8
   if (justnew) {
77c2a8
     error(2,(char*)entry_format_justnew,name,' ',nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog_justnew, name, nline);
77c2a8
+    }
77c2a8
   } else {
77c2a8
     error(2,(char*)entry_format,name,oline,nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog, name, oline, name, nline);
77c2a8
+    }
77c2a8
   }
77c2a8
 }
77c2a8
-void print_long_changes(const char* name, AIDE_OFF_TYPE old, AIDE_OFF_TYPE new, int justnew)
77c2a8
+void print_long_changes(const char* name, AIDE_OFF_TYPE old, AIDE_OFF_TYPE new, int justnew, char* part_message)
77c2a8
 {
77c2a8
 #if SIZEOF_OFF64_T == SIZEOF_LONG_LONG
77c2a8
   if (!justnew) {
77c2a8
@@ -672,12 +738,18 @@ void print_long_changes(const char* name
77c2a8
 #endif
77c2a8
   if (justnew) {
77c2a8
     error(2,(char*)entry_format_justnew,name,' ',nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog_justnew, name, nline);
77c2a8
+    }
77c2a8
   } else {
77c2a8
     error(2,(char*)entry_format,name,oline,nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog, name, oline, name, nline);
77c2a8
+    }
77c2a8
   }
77c2a8
 }
77c2a8
 
77c2a8
-void print_string_changes(const char* name, const char* old, const char* new, int justnew)
77c2a8
+void print_string_changes(const char* name, const char* old, const char* new, int justnew, char* part_message)
77c2a8
 {
77c2a8
   if (!justnew) {
77c2a8
     snprintf(oline,part_len,"%s",old);
77c2a8
@@ -685,8 +757,14 @@ void print_string_changes(const char* na
77c2a8
   snprintf(nline,part_len,"%s",new);
77c2a8
   if (justnew) {
77c2a8
     error(2,(char*)entry_format_justnew,name,' ',nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog_justnew, name, nline);
77c2a8
+    }
77c2a8
   } else {
77c2a8
-    error(2,(char*)entry_format,name,oline,nline); 
77c2a8
+    error(2,(char*)entry_format,name,oline,nline);
77c2a8
+    if(part_message!=NULL && conf->syslog_format){
77c2a8
+      snprintf(part_message, MESSAGE_SIZE, entry_syslog, name, oline, name, nline);
77c2a8
+    } 
77c2a8
   }
77c2a8
 }
77c2a8
 
77c2a8
@@ -954,168 +1032,226 @@ void print_changed_line(db_line* old,db_
77c2a8
     }
77c2a8
 }
77c2a8
 
77c2a8
+static void p_swap(char** first, char** second)
77c2a8
+{
77c2a8
+  if(first==NULL||second==NULL)return;
77c2a8
+  char* tmp=*first;
77c2a8
+  *first=*second;
77c2a8
+  *second=tmp;
77c2a8
+}
77c2a8
+
77c2a8
+#define DO_APPEND(x,y,z) do{ \
77c2a8
+                           if(conf->syslog_format&&z[0]!=0){ \
77c2a8
+                             snprintf(x, MESSAGE_SIZE,"%s;%s",y,z); \
77c2a8
+                             p_swap((char**)&x,(char**)&y); \
77c2a8
+                             z[0]='\0';  \
77c2a8
+                           } \
77c2a8
+                         }while(0) 
77c2a8
+
77c2a8
 void print_dbline_changes(db_line* old,db_line* new,
77c2a8
                           DB_ATTR_TYPE ignorelist,DB_ATTR_TYPE forced_attrs)
77c2a8
 {
77c2a8
   char* tmp=NULL;
77c2a8
   char* tmp2=NULL;
77c2a8
-  
77c2a8
+
77c2a8
+  char part_message[MESSAGE_SIZE]={0};
77c2a8
+  char message1[MESSAGE_SIZE]={0};
77c2a8
+  char message2[MESSAGE_SIZE]={0};
77c2a8
+  char* message=&message1[0];
77c2a8
+  char* message_old=&message2[0];
77c2a8
   /*
77c2a8
     Force just entries, that exists.
77c2a8
   */
77c2a8
   forced_attrs&=new->attr;
77c2a8
   
77c2a8
   error(2,"\n%s: %s\n",get_file_type_string(new->perm),new->filename);
77c2a8
+  
77c2a8
+  if(conf->syslog_format){
77c2a8
+    if(S_ISDIR(new->perm_o))
77c2a8
+      snprintf(message, MESSAGE_SIZE, "dir=%s", old->filename);
77c2a8
+    else
77c2a8
+      snprintf(message, MESSAGE_SIZE, "file=%s", old->filename);
77c2a8
+    p_swap(&message,&message_old);
77c2a8
+  }
77c2a8
 
77c2a8
   if ((!(DB_FTYPE&ignorelist)) && (((DB_FTYPE&old->attr && DB_FTYPE&new->attr) && get_file_type_char(old->perm)!=get_file_type_char(new->perm)) || DB_FTYPE&forced_attrs)) {
77c2a8
-          print_string_changes("File type", get_file_type_string(old->perm),get_file_type_string(new->perm), get_file_type_char(old->perm)==get_file_type_char(new->perm));
77c2a8
+    if(conf->syslog_format)
77c2a8
+      print_string_changes("file_type", get_file_type_string(old->perm),get_file_type_string(new->perm), get_file_type_char(old->perm)==get_file_type_char(new->perm), ((char*)part_message));
77c2a8
+    else
77c2a8
+      print_string_changes("File type", get_file_type_string(old->perm),get_file_type_string(new->perm), get_file_type_char(old->perm)==get_file_type_char(new->perm), NULL);
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
   if(!(DB_LINKNAME&ignorelist)){
77c2a8
-    print_str_changes(old->linkname,new->linkname, "Lname", DB_LINKNAME&forced_attrs);
77c2a8
+    print_str_changes(old->linkname,new->linkname, "Lname", DB_LINKNAME&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
   if (((!(DB_SIZEG&ignorelist)) && (((DB_SIZEG&old->attr && DB_SIZEG&new->attr)  && old->size>new->size) || DB_SIZEG&forced_attrs))
77c2a8
      || ((!(DB_SIZE&ignorelist)) && (((DB_SIZE&old->attr && DB_SIZE&new->attr) && old->size!=new->size) || DB_SIZE&forced_attrs)) ) {
77c2a8
-          print_long_changes("Size", old->size,new->size,old->size==new->size);
77c2a8
+          print_long_changes("Size", old->size,new->size,old->size==new->size, ((char*)part_message));
77c2a8
+          DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
   if (!(DB_BCOUNT&ignorelist)) {
77c2a8
     if(old->bcount!=new->bcount ||(DB_BCOUNT&forced_attrs) ){
77c2a8
-      print_int_changes("Bcount", old->bcount,new->bcount,old->bcount==new->bcount);
77c2a8
+      print_int_changes("Bcount", old->bcount,new->bcount,old->bcount==new->bcount, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   if (!(DB_PERM&ignorelist)) {
77c2a8
     if((DB_PERM&old->attr && DB_PERM&new->attr && old->perm!=new->perm) || DB_PERM&forced_attrs){
77c2a8
       tmp=perm_to_char(old->perm);
77c2a8
       tmp2=perm_to_char(new->perm);
77c2a8
-      print_string_changes("Perm", tmp,tmp2,old->perm==new->perm);
77c2a8
+      print_string_changes("Perm", tmp,tmp2,old->perm==new->perm, ((char*)part_message));
77c2a8
       free(tmp);
77c2a8
       free(tmp2);
77c2a8
       tmp=NULL;
77c2a8
       tmp2=NULL;
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_UID&ignorelist)) {
77c2a8
     if(old->uid!=new->uid||DB_UID&forced_attrs){
77c2a8
-      print_int_changes("Uid", old->uid,new->uid,old->uid==new->uid);
77c2a8
+      print_int_changes("Uid", old->uid,new->uid,old->uid==new->uid, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_GID&ignorelist)) {
77c2a8
     if(old->gid!=new->gid||DB_GID&forced_attrs){
77c2a8
-      print_int_changes("Gid", old->gid,new->gid,old->gid==new->gid);
77c2a8
+      print_int_changes("Gid", old->gid,new->gid,old->gid==new->gid, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_ATIME&ignorelist)) {
77c2a8
     if(old->atime!=new->atime||DB_ATIME&forced_attrs){
77c2a8
-      print_time_changes("Atime", old->atime, new->atime,old->atime==new->atime);
77c2a8
+      print_time_changes("Atime", old->atime, new->atime,old->atime==new->atime, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_MTIME&ignorelist)) {
77c2a8
     if(old->mtime!=new->mtime||DB_MTIME&forced_attrs){
77c2a8
-      print_time_changes("Mtime", old->mtime, new->mtime,old->mtime==new->mtime);
77c2a8
+      print_time_changes("Mtime", old->mtime, new->mtime,old->mtime==new->mtime, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_CTIME&ignorelist)) {
77c2a8
     if(old->ctime!=new->ctime||DB_CTIME&forced_attrs){
77c2a8
-      print_time_changes("Ctime", old->ctime, new->ctime,old->ctime==new->ctime);
77c2a8
+      print_time_changes("Ctime", old->ctime, new->ctime,old->ctime==new->ctime, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
 
77c2a8
   if (!(DB_INODE&ignorelist)) {
77c2a8
     if(((DB_INODE&old->attr && (DB_INODE&new->attr)) && old->inode!=new->inode) ||DB_INODE&forced_attrs){
77c2a8
-      print_int_changes("Inode", old->inode,new->inode,old->inode==new->inode);
77c2a8
+      print_int_changes("Inode", old->inode,new->inode,old->inode==new->inode, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
   if (!(DB_LNKCOUNT&ignorelist)) {
77c2a8
     if(old->nlink!=new->nlink||DB_LNKCOUNT&forced_attrs){
77c2a8
-      print_int_changes("Linkcount", old->nlink,new->nlink,old->nlink==new->nlink);
77c2a8
+      print_int_changes("Linkcount", old->nlink,new->nlink,old->nlink==new->nlink, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
     }
77c2a8
   }
77c2a8
 
77c2a8
   if (!(DB_MD5&ignorelist)) {  
77c2a8
     print_md_changes(old->md5,new->md5,
77c2a8
 		     HASH_MD5_LEN,
77c2a8
-		     "MD5", DB_MD5&forced_attrs);
77c2a8
+		     "MD5", DB_MD5&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_SHA1&ignorelist)) {
77c2a8
       print_md_changes(old->sha1,new->sha1,
77c2a8
 		       HASH_SHA1_LEN,
77c2a8
-		       "SHA1", DB_SHA1&forced_attrs);
77c2a8
+		       "SHA1", DB_SHA1&forced_attrs, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
   if (!(DB_RMD160&ignorelist)) {
77c2a8
     print_md_changes(old->rmd160,new->rmd160,
77c2a8
 		     HASH_RMD160_LEN,
77c2a8
-		     "RMD160", DB_RMD160&forced_attrs);
77c2a8
+		     "RMD160", DB_RMD160&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_TIGER&ignorelist)) {
77c2a8
     print_md_changes(old->tiger,new->tiger,
77c2a8
 		     HASH_TIGER_LEN,
77c2a8
-		     "TIGER", DB_TIGER&forced_attrs);
77c2a8
+		     "TIGER", DB_TIGER&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_SHA256&ignorelist)) {
77c2a8
       print_md_changes(old->sha256,new->sha256,
77c2a8
 		       HASH_SHA256_LEN,
77c2a8
-		       "SHA256", DB_SHA256&forced_attrs);
77c2a8
+		       "SHA256", DB_SHA256&forced_attrs, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
   if (!(DB_SHA512&ignorelist)) {
77c2a8
       print_md_changes(old->sha512,new->sha512,
77c2a8
 		       HASH_SHA512_LEN,
77c2a8
-		       "SHA512", DB_SHA512&forced_attrs);
77c2a8
+		       "SHA512", DB_SHA512&forced_attrs, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
 #ifdef WITH_MHASH
77c2a8
   if (!(DB_CRC32&ignorelist)) {
77c2a8
     print_md_changes(old->crc32,new->crc32,
77c2a8
 		     HASH_CRC32_LEN,
77c2a8
-		     "CRC32", DB_CRC32&forced_attrs);
77c2a8
+		     "CRC32", DB_CRC32&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_HAVAL&ignorelist)) {
77c2a8
     print_md_changes(old->haval,new->haval,
77c2a8
 		     HASH_HAVAL256_LEN,
77c2a8
-		     "HAVAL", DB_HAVAL&forced_attrs);
77c2a8
+		     "HAVAL", DB_HAVAL&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_GOST&ignorelist)) {
77c2a8
     print_md_changes(old->gost,new->gost,
77c2a8
 		     HASH_GOST_LEN,
77c2a8
-		     "GOST", DB_GOST&forced_attrs);
77c2a8
+		     "GOST", DB_GOST&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
   if (!(DB_CRC32B&ignorelist)) {
77c2a8
     print_md_changes(old->crc32b,new->crc32b,
77c2a8
 		     HASH_CRC32B_LEN,
77c2a8
-		     "CRC32B", DB_CRC32B&forced_attrs);
77c2a8
+		     "CRC32B", DB_CRC32B&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 
77c2a8
   if (!(DB_WHIRLPOOL&ignorelist)) {
77c2a8
       print_md_changes(old->whirlpool,new->whirlpool,
77c2a8
 		       HASH_WHIRLPOOL_LEN,
77c2a8
-		       "WHIRLPOOL", DB_WHIRLPOOL&forced_attrs);
77c2a8
+		       "WHIRLPOOL", DB_WHIRLPOOL&forced_attrs, ((char*)part_message));
77c2a8
+      DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 #endif                   
77c2a8
 
77c2a8
 #ifdef WITH_ACL
77c2a8
   if (!(DB_ACL&ignorelist)) {
77c2a8
-    print_acl_changes(old->acl,new->acl, DB_ACL&forced_attrs);
77c2a8
+    print_acl_changes(old->acl,new->acl, DB_ACL&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
 #endif
77c2a8
   if (!(DB_XATTRS&ignorelist)) {
77c2a8
-    print_xattrs_changes(old->xattrs,new->xattrs, DB_XATTRS&forced_attrs);
77c2a8
+    print_xattrs_changes(old->xattrs,new->xattrs, DB_XATTRS&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   if (!(DB_SELINUX&ignorelist)) {
77c2a8
-    print_str_changes(old->cntx,new->cntx, "SELinux", DB_SELINUX&forced_attrs);
77c2a8
+    print_str_changes(old->cntx,new->cntx, "SELinux", DB_SELINUX&forced_attrs, ((char*)part_message));
77c2a8
+    DO_APPEND(message,message_old,part_message);
77c2a8
   }
77c2a8
   
77c2a8
 #ifdef WITH_E2FSATTRS
77c2a8
@@ -1123,13 +1259,19 @@ void print_dbline_changes(db_line* old,d
77c2a8
       if(old->e2fsattrs!=new->e2fsattrs || DB_E2FSATTRS&forced_attrs ) {
77c2a8
           tmp=e2fsattrs2char(old->e2fsattrs);
77c2a8
           tmp2=e2fsattrs2char(new->e2fsattrs);
77c2a8
-          print_string_changes("E2FSAttrs", tmp, tmp2, old->e2fsattrs==new->e2fsattrs);
77c2a8
+          print_string_changes("E2FSAttrs", tmp, tmp2, old->e2fsattrs==new->e2fsattrs, ((char*)part_message));
77c2a8
           free(tmp); free(tmp2);
77c2a8
           tmp=NULL; tmp2=NULL;
77c2a8
+          DO_APPEND(message,message_old,part_message);
77c2a8
       }
77c2a8
   }
77c2a8
 #endif
77c2a8
 
77c2a8
+  if (conf->syslog_format) {
77c2a8
+    /* Already swapped */
77c2a8
+    error(0, "%s\n", message_old);
77c2a8
+  }
77c2a8
+
77c2a8
   return;
77c2a8
 }
77c2a8
 
77c2a8
@@ -1207,8 +1349,13 @@ void print_report_header(int nfil,int na
77c2a8
   error(2,_("Start timestamp: %.4u-%.2u-%.2u %.2u:%.2u:%.2u\n"),
77c2a8
 	st->tm_year+1900, st->tm_mon+1, st->tm_mday,
77c2a8
 	st->tm_hour, st->tm_min, st->tm_sec);
77c2a8
-  error(0,_("\nSummary:\n  Total number of files:\t%i\n  Added files:\t\t\t%i\n"
77c2a8
+  if(!conf->syslog_format){
77c2a8
+    error(0,_("\nSummary:\n  Total number of files:\t%i\n  Added files:\t\t\t%i\n"
77c2a8
 	    "  Removed files:\t\t%i\n  Changed files:\t\t%i\n\n"),nfil,nadd,nrem,nchg);
77c2a8
+  }else{
77c2a8
+   error(0,_("summary;total_number_of_files=%i;added_files=%i;"
77c2a8
+            "removed_files=%i;changed_files=%i\n"),nfil,nadd,nrem,nchg);
77c2a8
+  }
77c2a8
   
77c2a8
 }
77c2a8
 
77c2a8
@@ -1312,6 +1459,7 @@ long report_tree(seltree* node,int stage
77c2a8
     }
77c2a8
     if(node->checked&NODE_ADDED){
77c2a8
       print_added_line(node->new_data);
77c2a8
+      if(conf->syslog_format) error(0, "file=%s; added\n", node->new_data->filename);
77c2a8
     }
77c2a8
   }
77c2a8
 
77c2a8
@@ -1323,6 +1471,7 @@ long report_tree(seltree* node,int stage
77c2a8
     }
77c2a8
     if(node->checked&NODE_REMOVED){
77c2a8
       print_removed_line(node->old_data);
77c2a8
+      if(conf->syslog_format) error(0, "file=%s; removed\n", node->old_data->filename);
77c2a8
     }
77c2a8
   }
77c2a8
 
77c2a8
@@ -1337,7 +1486,7 @@ long report_tree(seltree* node,int stage
77c2a8
     }
77c2a8
   }
77c2a8
 
77c2a8
-  if((stage==4)&&(conf->verbose_level>=5)&&status[4]){
77c2a8
+  if((stage==4)&&(conf->verbose_level>=5||conf->syslog_format)&&status[4]){
77c2a8
     if(top){
77c2a8
       error(2,_("\n---------------------------------------------------\n"));
77c2a8
       error(2,_("Detailed information about changes:\n"));
77c2a8
diff -up ./src/conf_lex.l.syslog-format ./src/conf_lex.l
77c2a8
--- ./src/conf_lex.l.syslog-format	2010-08-08 13:39:31.000000000 -0400
77c2a8
+++ ./src/conf_lex.l	2017-03-07 11:12:49.965000000 -0500
77c2a8
@@ -12,7 +12,7 @@ EX      [" "\t]*
77c2a8
 
77c2a8
 %{
77c2a8
 
77c2a8
-#define YYDEBUG
77c2a8
+//#define YYDEBUG
77c2a8
 
77c2a8
 /*
77c2a8
  * Copyright (C) 1999-2002,2004-2006,2010 Rami Lehti, Pablo Virolainen, Richard
77c2a8
@@ -349,6 +349,12 @@ int var_in_conflval=0;
77c2a8
   return (TGZIPDBOUT);
77c2a8
 }
77c2a8
 
77c2a8
+^[\t\ ]*"syslog_format"{E} {
77c2a8
+  error(230,"%li:syslog_format =\n",conf_lineno);
77c2a8
+  BEGIN CONFVALHUNT;
77c2a8
+  return (SYSLOG_FORMAT);
77c2a8
+}
77c2a8
+
77c2a8
 ^[\t\ ]*"recstop"{E} {
77c2a8
   error(230,"%li:recstop =\n",conf_lineno);
77c2a8
   BEGIN CONFVALHUNT;
77c2a8
diff -up ./src/conf_yacc.y.syslog-format ./src/conf_yacc.y
77c2a8
--- ./src/conf_yacc.y.syslog-format	2010-08-08 13:39:31.000000000 -0400
77c2a8
+++ ./src/conf_yacc.y	2017-03-07 11:12:49.965000000 -0500
77c2a8
@@ -81,6 +81,7 @@ extern long conf_lineno;
77c2a8
 %token TDATABASE_NEW
77c2a8
 %token TREPORT_URL
77c2a8
 %token TGZIPDBOUT
77c2a8
+%token SYSLOG_FORMAT
77c2a8
 %token TUMASK
77c2a8
 %token TTRUE
77c2a8
 %token TFALSE
77c2a8
@@ -150,7 +151,7 @@ lines : lines line | ;
77c2a8
 line : rule | equrule | negrule | definestmt | undefstmt
77c2a8
        | ifdefstmt | ifndefstmt | ifhoststmt | ifnhoststmt
77c2a8
        | groupdef | db_in | db_out | db_new | verbose | config_version 
77c2a8
-       | report | gzipdbout | recursion_stopper | warn_dead_symlinks | grouped
77c2a8
+       | report | gzipdbout | syslogformat | recursion_stopper | warn_dead_symlinks | grouped
77c2a8
        | summarize_changes | acl_no_symlink_follow | beginconfigstmt | endconfigstmt
77c2a8
        | TEOF {
77c2a8
             newlinelastinconfig=1;
77c2a8
@@ -329,6 +330,13 @@ conf->gzip_dbout=0;
77c2a8
 #endif
77c2a8
 } ;
77c2a8
 
77c2a8
+syslogformat : SYSLOG_FORMAT TTRUE {
77c2a8
+conf->syslog_format=1;
77c2a8
+} |
77c2a8
+               SYSLOG_FORMAT TFALSE {
77c2a8
+conf->syslog_format=0;
77c2a8
+} ;
77c2a8
+
77c2a8
 recursion_stopper : TRECSTOP TSTRING {
77c2a8
   /* FIXME implement me */  
77c2a8
   
77c2a8
diff -up ./src/db_lex.l.syslog-format ./src/db_lex.l
77c2a8
--- ./src/db_lex.l.syslog-format	2010-08-08 13:39:31.000000000 -0400
77c2a8
+++ ./src/db_lex.l	2017-03-07 11:12:49.965000000 -0500
77c2a8
@@ -45,7 +45,7 @@ extern YYSTYPE yylval;
77c2a8
 #define YY_DECL int db_scan(void)
77c2a8
 
77c2a8
 
77c2a8
-#define YYDEBUG
77c2a8
+//#define YYDEBUG
77c2a8
 
77c2a8
 #include "aide.h"
77c2a8
 #include "conf_yacc.h"