nfs/nfslog/nfslog_trans.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1999 by Sun Microsystems, Inc.
 * All rights reserved.
 */

#pragma ident   "%Z%%M% %I% %E% SMI"

#include <stdio.h>
#include <errno.h>
#include <malloc.h>
#include <strings.h>
#include <stddef.h>
#include <search.h>
#include <syslog.h>
#include <libintl.h>
#include <unistd.h>
#include <rpc/rpc.h>
#include <netconfig.h>
#include <netdir.h>
#include <nfs/nfs_sec.h>
#include <nfs/export.h>
#include <rpc/auth.h>
#include <rpc/svc.h>
#include <rpc/xdr.h>
#include <rpc/clnt.h>
#include <nfs/nfs.h>
#include <nfs/nfs_log.h>
#include <assert.h>
#include "fhtab.h"
#include "nfslogd.h"

/*
 * How long should an entry stay in the list before being forced
 * out and a trans log entry printed
 */
#define TRANS_ENTRY_TIMEOUT 60

extern char *addrtoname(void *);

struct transentry {
    struct transentry *next;
    struct transentry *prev;
    timestruc32_t   starttime;  /* when did transaction start? */
    timestruc32_t   lastupdate; /* last operation for this entry */
#define TRANS_OPER_READ     1
#define TRANS_OPER_WRITE    2
#define TRANS_OPER_SETATTR  3
#define TRANS_OPER_REMOVE   4
#define TRANS_OPER_MKDIR    5
#define TRANS_OPER_CREATE   6
#define TRANS_OPER_RMDIR    7
#define TRANS_OPER_RENAME   8
#define TRANS_OPER_MKNOD    9
#define TRANS_OPER_LINK     10
#define TRANS_OPER_SYMLINK  11
    uchar_t     optype;     /* read, write, ...? */
#define TRANS_DATATYPE_NA       /* not applicable data type */
#define TRANS_DATATYPE_ASCII    0   /* transfer done as ascii */
#define TRANS_DATATYPE_BINARY   1   /* transfer done as binary */
    uchar_t     datatype;
/*
 * Action taken by server before transfer was made -- noaction,
 * compressed, tar or uncompressed.
 */
#define TRANS_OPTION_NOACTION   0
    uchar_t     transoption;
    char        *pathname;
    struct netbuf   *pnb;
    uid_t       uid;
    int     nfsvers;
    char        *netid;
    char        *principal_name;
    uint64_t    totalbytes; /* total operated upon in history */
    union {
        fhandle_t fh;
        nfs_fh3 fh3;
    } fh_u;
};

struct nfslog_trans_file {
    struct nfslog_trans_file    *next;  /* next file in list */
    struct nfslog_trans_file    *prev;  /* next file in list */
    int refcnt;     /* number of references to this struct */
    char    *path;      /* pathname of file */
    FILE    *fp;        /* file pointer */
    /* timestamp of the last transaction processed for this file */
    timestruc32_t   lasttrans_timestamp;
    /* 'current' time that last trans was processed */
    time_t      last_trans_read;
    uint32_t trans_to_log;  /* transactions that are to be logged */
    uint32_t trans_output_type;
    struct transentry *te_list_v3_read;
    struct transentry *te_list_v3_write;
    struct transentry *te_list_v2_read;
    struct transentry *te_list_v2_write;
};

static struct nfslog_trans_file *trans_file_head = NULL;

static void nfslog_print_trans_logentry(struct transentry *,
    struct nfslog_trans_file *);


static struct netbuf *
netbufdup(struct netbuf *pnb)
{
    struct netbuf *pnewnb;
    uint32_t    size;

    size = offsetof(struct netbuf, buf);
    size += pnb->len;

    if ((pnewnb = (struct netbuf *)malloc(sizeof (*pnewnb))) == NULL)
        return (NULL);
    if ((pnewnb->buf = malloc(pnb->len)) == NULL) {
        free(pnewnb);
        return (NULL);
    }

    pnewnb->maxlen = pnb->maxlen;
    pnewnb->len = pnb->len;
    bcopy(pnb->buf, pnewnb->buf, pnb->len);
    return (pnewnb);
}

static void
freenetbuf(struct netbuf *pnb)
{
    free(pnb->buf);
    free(pnb);
}

static struct transentry *
create_te()
{
    struct transentry *pte;

    if ((pte = (struct transentry *)calloc(1, sizeof (*pte))) == NULL) {
        /* failure message or action */
        return (NULL);
    }

    pte->next = pte->prev = NULL;

    return (pte);
}

static struct transentry *
insert_te(
    struct transentry *te_list,
    struct transentry *entry)
{
    struct transentry *pte;

    /*
     * First check for any non-filehandle comparisons that may be needed.
     */
    switch (entry->optype) {
    case TRANS_OPER_REMOVE:
    case TRANS_OPER_RENAME:
        for (pte = te_list->next; pte != te_list; pte = pte->next) {
            /* if path names match, then return */
            if (strcmp(pte->pathname, entry->pathname) == 0) {
                return (pte);
            }
        }
        return (NULL);
    default:
        break;
    }

    for (pte = te_list->next; pte != te_list; pte = pte->next) {
        /* If the file handles match, then we have a hit */
        if (entry->nfsvers == NFS_VERSION) {
            if (bcmp(&(pte->fh_u.fh), &(entry->fh_u.fh),
                sizeof (fhandle_t)) == 0) {
                switch (entry->optype) {
                case TRANS_OPER_READ:
                case TRANS_OPER_WRITE:
                    if (pte->uid == entry->uid) {
                        return (pte);
                    }
                    break;
                default:
                    return (pte);
                }
            }
        } else {
            if (pte->fh_u.fh3.fh3_length ==
                entry->fh_u.fh3.fh3_length &&
                bcmp(pte->fh_u.fh3.fh3_u.data,
                    entry->fh_u.fh3.fh3_u.data,
                    pte->fh_u.fh3.fh3_length) == 0)
                switch (entry->optype) {
                case TRANS_OPER_READ:
                case TRANS_OPER_WRITE:
                    if (pte->uid == entry->uid) {
                        return (pte);
                    }
                    break;
                default:
                    return (pte);
                }
        }
    }
    /*
     * XXX - should compare more of the information to make sure
     * it is a match.
     */

    /*
     * other operation types do not generate an entry for
     * further analysis
     */
    switch (entry->optype) {
    case TRANS_OPER_READ:
    case TRANS_OPER_WRITE:
        break;
    default:
        return (NULL);
    }

    insque(entry, te_list);

    return (NULL); /* NULL signifies insertion and no record found */
}

static void
remove_te(struct transentry *pte)
{
    if (pte->next)
        remque(pte);

    if (pte->principal_name) free(pte->principal_name);
    if (pte->pathname) free(pte->pathname);
    if (pte->pnb) freenetbuf(pte->pnb);
    if (pte->netid) free(pte->netid);

    free(pte);
}

/*
 * nfslog_trans_file_free - frees a record
 */
static void
nfslog_trans_file_free(struct nfslog_trans_file *transrec)
{
    if (transrec == NULL)
        return;
    if (transrec->path != NULL) {
        if (debug)
            (void) printf("freeing transpath '%s'\n",
                transrec->path);
        free(transrec->path);
    }
    free(transrec);
}

/*
 * On success returns a pointer to the trans_file that matches
 * 'path', 'output_type' and 'transtolog'.  The reference count for this
 * object is incremented as well.
 * Returns NULL if it is not in the list.
 */
static struct nfslog_trans_file *
nfslog_trans_file_find(
    char *path,
    uint32_t output_type,
    uint32_t transtolog)
{
    struct nfslog_trans_file *tfp;

    for (tfp = trans_file_head; tfp != NULL; tfp = tfp->next) {
        if ((strcmp(path, tfp->path) == 0) &&
            (output_type == tfp->trans_output_type) &&
            (transtolog == tfp->trans_to_log)) {
            if (debug)
                (void) printf("Found transfile '%s'\n", path);
            (tfp->refcnt)++;
            return (tfp);
        }
    }
    return (NULL);
}


/*
 * nfslog_close_trans_file - decrements the reference count on
 * this object. On last reference it closes transfile and
 * frees resources
 */
static void
nfslog_close_trans_file(struct nfslog_trans_file *tf)
{
    assert(tf != NULL);
    assert(tf->refcnt > 0);
    if (tf->refcnt > 1) {
        (tf->refcnt)--;
        return;
    }

    if (tf->fp != NULL) {
        (void) fsync(fileno(tf->fp));
        (void) fclose(tf->fp);
    }

    /*
     * Disconnect from list
     */
    tf->prev->next = tf->next;
    if (tf->next != NULL)
        tf->next->prev = tf->prev;

    /*
     * Adjust the head of the list if appropriate
     */
    if (tf == trans_file_head)
        trans_file_head = tf->next;

    nfslog_trans_file_free(tf);
}

/*
 * nfslog_open_trans_file - open the output trans file and mallocs.
 * The object is then inserted at the beginning of the global
 * transfile list.
 *  Returns 0 for success, error else.
 *
 * *error contains the last error encountered on this object. It can
 * be used to avoid reporting the same error endlessly, by comparing
 * the current error to the last error. It is reset to the current error
 * code on return.
 */
void *
nfslog_open_trans_file(
    char *transpath,
    uint32_t output_type,
    uint32_t transtolog,
    int *error)
{
    int         preverror = *error;
    struct nfslog_trans_file    *transrec;

    transrec = nfslog_trans_file_find(transpath, output_type, transtolog);
    if (transrec != NULL)
        return (transrec);

    if ((transrec = malloc(sizeof (*transrec))) == NULL) {
        *error = errno;
        if (*error != preverror) {
            syslog(LOG_ERR, gettext("nfslog_open_trans_file: %s"),
                strerror(*error));
        }
        return (NULL);
    }
    bzero(transrec, sizeof (*transrec));

    if ((transrec->path = strdup(transpath)) == NULL) {
        *error = errno;
        if (*error != preverror) {
            syslog(LOG_ERR, gettext("nfslog_open_trans_file: %s"),
                strerror(*error));
        }
        nfslog_trans_file_free(transrec);
        return (NULL);
    }

    if ((transrec->fp = fopen(transpath, "a")) == NULL) {
        *error = errno;
        if (*error != preverror) {
            syslog(LOG_ERR, gettext("Cannot open '%s': %s"),
                transpath, strerror(*error));
        }
        nfslog_trans_file_free(transrec);
        return (NULL);
    }

    transrec->te_list_v3_read =
        (struct transentry *)malloc(sizeof (struct transentry));
    transrec->te_list_v3_write =
        (struct transentry *)malloc(sizeof (struct transentry));
    transrec->te_list_v2_read =
        (struct transentry *)malloc(sizeof (struct transentry));
    transrec->te_list_v2_write =
        (struct transentry *)malloc(sizeof (struct transentry));

    if (transrec->te_list_v3_read == NULL ||
        transrec->te_list_v3_write == NULL ||
        transrec->te_list_v2_read == NULL ||
        transrec->te_list_v2_write == NULL) {
        if (transrec->te_list_v3_read)
            free(transrec->te_list_v3_read);
        if (transrec->te_list_v3_write)
            free(transrec->te_list_v3_write);
        if (transrec->te_list_v2_read)
            free(transrec->te_list_v2_read);
        if (transrec->te_list_v2_write)
            free(transrec->te_list_v2_write);
        nfslog_close_trans_file(transrec);
        return (NULL);
    }

    transrec->te_list_v3_read->next =
        transrec->te_list_v3_read->prev = transrec->te_list_v3_read;
    transrec->te_list_v3_write->next =
        transrec->te_list_v3_write->prev = transrec->te_list_v3_write;
    transrec->te_list_v2_read->next =
        transrec->te_list_v2_read->prev = transrec->te_list_v2_read;
    transrec->te_list_v2_write->next =
        transrec->te_list_v2_write->prev = transrec->te_list_v2_write;

    /*
     * Indicate what transaction types to log
     */
    transrec->trans_to_log = transtolog;

    /*
     * Indicate whether to print 'full' or 'basic' version
     * of the transactions
     */
    transrec->trans_output_type = output_type;

    /*
     * Insert at the beginning of the list.
     */
    transrec->next = trans_file_head;
    if (trans_file_head != NULL)
        trans_file_head->prev = transrec;
    trans_file_head = transrec->prev = transrec;

    transrec->refcnt = 1;

    transrec->lasttrans_timestamp.tv_sec = 0;
    transrec->lasttrans_timestamp.tv_nsec = 0;
    transrec->last_trans_read = time(0);

    if (debug)
        (void) printf("New transfile '%s'\n", transrec->path);

    return (transrec);
}

void
nfslog_process_trans_timeout(
    struct nfslog_trans_file *tf,
    uint32_t force_flush)
{
    struct transentry *pte;
    time_t cur_time = time(0);

    /*
     * If we have not seen a transaction on this file for
     * a long time, then we need to flush everything out since
     * we may not be getting anything else in for awhile.
     */
    if (difftime(cur_time, tf->last_trans_read) >
        (2 * MAX(TRANS_ENTRY_TIMEOUT, idle_time)))
        force_flush = TRUE;

restart1:
    for (pte = tf->te_list_v3_read->next;
        pte != tf->te_list_v3_read;
        pte = pte->next) {
        if (force_flush == TRUE ||
            (difftime(tf->lasttrans_timestamp.tv_sec,
                pte->lastupdate.tv_sec) >
            MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
            goto restart1;
        }
    }
restart2:
    for (pte = tf->te_list_v3_write->next;
        pte != tf->te_list_v3_write;
        pte = pte->next) {
        if (force_flush == TRUE ||
            (difftime(tf->lasttrans_timestamp.tv_sec,
                pte->lastupdate.tv_sec) >
            MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
            goto restart2;
        }
    }
restart3:
    for (pte = tf->te_list_v2_read->next;
        pte != tf->te_list_v2_read;
        pte = pte->next) {
        if (force_flush == TRUE ||
            (difftime(tf->lasttrans_timestamp.tv_sec,
                pte->lastupdate.tv_sec) >
            MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
            goto restart3;
        }
    }
restart4:
    for (pte = tf->te_list_v2_write->next;
        pte != tf->te_list_v2_write;
        pte = pte->next) {
        if (force_flush == TRUE ||
            (difftime(tf->lasttrans_timestamp.tv_sec,
                pte->lastupdate.tv_sec) >
            MAX(TRANS_ENTRY_TIMEOUT, idle_time))) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
            goto restart4;
        }
    }

    (void) fflush(tf->fp);
}

/*
 * Flushes outstanding transactions to disk, and closes
 * the transaction log.
 */
void
nfslog_close_transactions(void **transcookie)
{
    assert(*transcookie != NULL);
    nfslog_process_trans_timeout(
        (struct nfslog_trans_file *)(*transcookie), TRUE);
    nfslog_close_trans_file((struct nfslog_trans_file *)(*transcookie));
    *transcookie = NULL;
}

static struct transentry *
trans_read(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_nfsreadargs *args = (nfslog_nfsreadargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_rdresult *res = (nfslog_rdresult *)logrec->re_rpc_res;

    if (res->r_status != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname = nfslog_get_path(&args->ra_fhandle,
            NULL, fhpath, "trans_read");
    } else {
        newte->pathname = strdup(path1);
    }

    /* prep the struct for insertion */
    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_READ;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = res->nfslog_rdresult_u.r_ok.rrok_count;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->ra_fhandle));

    if (res->nfslog_rdresult_u.r_ok.rrok_count <
        res->nfslog_rdresult_u.r_ok.filesize) {
        if (pte = insert_te(tf->te_list_v2_read, newte)) {
            /* free this since entry was found (not inserted) */
            remove_te(newte);

            pte->totalbytes +=
                res->nfslog_rdresult_u.r_ok.rrok_count;

            if (pte->lastupdate.tv_sec <=
                logrec->re_header.rh_timestamp.tv_sec)
                pte->lastupdate =
                    logrec->re_header.rh_timestamp;

            if (pte->totalbytes <
                res->nfslog_rdresult_u.r_ok.filesize) {
                pte = NULL; /* prevent printing of log entry */
            }
        }
    } else {
        pte = newte; /* print a log record - complete file read */
    }

    return (pte);
}

static struct transentry *
trans_write(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_writeargs *args = (nfslog_writeargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_writeresult *res = (nfslog_writeresult *)logrec->re_rpc_res;

    if (res->wr_status != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname = nfslog_get_path(&args->waargs_fhandle,
            NULL, fhpath, "trans_write");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_WRITE;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = args->waargs_totcount;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->waargs_fhandle));

    if (pte = insert_te(tf->te_list_v2_write, newte)) {
        /*
         * if the write would have increased the total byte count
         * over the filesize, then generate a log entry and remove
         * the write record and insert the new one.
         */
        if (pte->totalbytes + args->waargs_totcount >
            res->nfslog_writeresult_u.wr_size) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
            (void) insert_te(tf->te_list_v2_write, newte);
            pte = NULL;
        } else {
            /* free this since entry was found (not inserted) */
            remove_te(newte);

            pte->totalbytes += args->waargs_totcount;

            if (pte->lastupdate.tv_sec <=
                logrec->re_header.rh_timestamp.tv_sec) {
                pte->lastupdate =
                    logrec->re_header.rh_timestamp;
            }
            pte = NULL; /* prevent printing of log entry */
        }
    }
    return (pte);
}

static struct transentry *
trans_setattr(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_setattrargs *args = (nfslog_setattrargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat *res = (nfsstat *)logrec->re_rpc_res;

    if (*res != NFS_OK)
        return (NULL);

    if (args->saa_sa.sa_size == (uint32_t)-1)
        return (NULL);
    /*
     * should check the size of the file to see if it
     * is being truncated below current eof.  if so
     * a record should be generated.... XXX
     */
    if (args->saa_sa.sa_size != 0)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname  = nfslog_get_path(&args->saa_fh, NULL,
            fhpath, "trans_setattr2");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_SETATTR;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->saa_fh));

    if (pte = insert_te(tf->te_list_v2_write, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v2_read, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }

    return (newte);
}

static struct transentry *
trans_create(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_createargs *args = (nfslog_createargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_diropres *res = (nfslog_diropres *)logrec->re_rpc_res;

    if (res->dr_status != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname =
            nfslog_get_path(&args->ca_da.da_fhandle,
                args->ca_da.da_name,
                fhpath, "trans_create2");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_CREATE;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;

    if (args->ca_sa.sa_size == (uint32_t)-1)
        newte->totalbytes = 0;
    else
        newte->totalbytes = args->ca_sa.sa_size;

    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(
        &res->nfslog_diropres_u.dr_ok.drok_fhandle));

    /*
     * if the file is being truncated on create, we need to flush
     * any outstanding read/write transactions
     */
    if (args->ca_sa.sa_size != (uint32_t)-1) {
        if (pte = insert_te(tf->te_list_v2_write, newte)) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
        }
        if (pte = insert_te(tf->te_list_v2_read, newte)) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
        }
    }

    return (newte);
}

static struct transentry *
trans_remove(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_diropargs *args = (nfslog_diropargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat *res = (nfsstat *)logrec->re_rpc_res;

    if (*res != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        char *name = args->da_name;
        fhandle_t *dfh = &args->da_fhandle;
        newte->pathname = nfslog_get_path(dfh, name,
            fhpath, "trans_remove2");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_REMOVE;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->da_fhandle));

    if (pte = insert_te(tf->te_list_v2_write, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v2_read, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v3_write, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v3_read, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }

    return (newte);
}

static struct transentry *
trans_mkdir(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_createargs *args = (nfslog_createargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_diropres *res = (nfslog_diropres *)logrec->re_rpc_res;

    if (res->dr_status != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        nfslog_diropargs *dargs = &args->ca_da;
        char *name = dargs->da_name;
        fhandle_t *dfh = &dargs->da_fhandle;
        newte->pathname = nfslog_get_path(dfh, name,
            fhpath, "trans_mkdir2");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_MKDIR;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->ca_da.da_fhandle));

    return (newte);
}

static struct transentry *
trans_rmdir(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_diropargs *args = (nfslog_diropargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat *res = (nfsstat *)logrec->re_rpc_res;

    if (*res != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        char *name = args->da_name;
        fhandle_t *dfh = &args->da_fhandle;
        newte->pathname = nfslog_get_path(dfh, name,
            fhpath, "trans_rmdir2");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_RMDIR;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->da_fhandle));

    return (newte);
}

static struct transentry *
trans_rename(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1,
    char *path2)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_rnmargs *args = (nfslog_rnmargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat *res = (nfsstat *)logrec->re_rpc_res;
    char *tpath1 = NULL;
    char *tpath2 = NULL;

    if (*res != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        char *from_name, *to_name;
        fhandle_t *from_dfh, *to_dfh;

        from_name = args->rna_from.da_name;
        from_dfh = &args->rna_from.da_fhandle;
        to_name = args->rna_to.da_name;
        to_dfh = &args->rna_to.da_fhandle;

        path1 = tpath1 = nfslog_get_path(from_dfh, from_name,
            fhpath, "trans_rename from");
        path2 = tpath2 = nfslog_get_path(to_dfh, to_name,
            fhpath, "trans_rename to");
    }

    newte->pathname = path1; /* no need to strdup here */
    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_RENAME;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->rna_from.da_fhandle));

    /* switch path names for the file for renames */
    if (pte = insert_te(tf->te_list_v2_write, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }
    if (pte = insert_te(tf->te_list_v2_read, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }
    if (pte = insert_te(tf->te_list_v3_write, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }
    if (pte = insert_te(tf->te_list_v3_read, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }

    newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
    /* check for NULL malloc */
    (void) sprintf(newte->pathname, "%s->%s", path1, path2);

    if (tpath1) {
        free(tpath1);
        free(tpath2);
    }

    return (newte);
}

static struct transentry *
trans_link(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1,
    char *path2)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_linkargs *args = (nfslog_linkargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat *res = (nfsstat *)logrec->re_rpc_res;
    char *tpath1 = NULL;
    char *tpath2 = NULL;

    if (*res != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        fhandle_t *fh = &args->la_from;
        char *name = args->la_to.da_name;
        fhandle_t *dfh = &args->la_to.da_fhandle;

        path1 = tpath1 = nfslog_get_path(fh, NULL,
            fhpath, "trans_link from");
        path2 = tpath2 = nfslog_get_path(dfh, name,
            fhpath, "trans_link to");
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_LINK;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->la_from));

    newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
    /* check for NULL malloc */
    (void) sprintf(newte->pathname, "%s->%s", path1, path2);

    if (tpath1) {
        free(tpath1);
        free(tpath2);
    }

    return (newte);
}

static struct transentry *
trans_symlink(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_symlinkargs *args = (nfslog_symlinkargs *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat *res = (nfsstat *)logrec->re_rpc_res;
    char *tpath1 = NULL;

    if (*res != NFS_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        char *name = args->sla_from.da_name;
        fhandle_t *dfh = &args->sla_from.da_fhandle;

        path1 = tpath1 = nfslog_get_path(dfh, name,
            fhpath, "trans_symlink");
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_SYMLINK;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_VERSION;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh = *(NFSLOG_GET_FHANDLE2(&args->sla_from.da_fhandle));

    newte->pathname = (char *)malloc(strlen(path1) +
        strlen(args->sla_tnm) + 3);
    (void) sprintf(newte->pathname, "%s->%s", path1, args->sla_tnm);

    if (tpath1)
        free(tpath1);

    return (newte);
}

static struct transentry *
trans_read3(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_READ3args *args = (nfslog_READ3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_READ3res *res = (nfslog_READ3res *)logrec->re_rpc_res;

    if (res->status != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        fhandle_t *fh = NFSLOG_GET_FHANDLE3(&args->file);
        newte->pathname = nfslog_get_path(fh, NULL,
            fhpath, "trans_read3");
    } else {
        newte->pathname = strdup(path1);
    }

    /* prep the struct for insertion */
    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_READ;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = res->nfslog_READ3res_u.ok.count;
    newte->fh_u.fh3 = args->file;

    if (res->nfslog_READ3res_u.ok.count <
        res->nfslog_READ3res_u.ok.filesize) {
        if (pte = insert_te(tf->te_list_v3_read, newte)) {
            /* free this since entry was found (not inserted) */
            remove_te(newte);

            pte->totalbytes += res->nfslog_READ3res_u.ok.count;

            if (pte->lastupdate.tv_sec <=
                logrec->re_header.rh_timestamp.tv_sec)
                pte->lastupdate =
                    logrec->re_header.rh_timestamp;

            if (pte->totalbytes <
                res->nfslog_READ3res_u.ok.filesize) {
                pte = NULL; /* prevent printing of log entry */
            }
        }
    } else {
        pte = newte; /* print a log record - complete file read */
    }

    return (pte);
}

static struct transentry *
trans_write3(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_WRITE3args *args = (nfslog_WRITE3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_WRITE3res *res = (nfslog_WRITE3res *)logrec->re_rpc_res;

    if (res->status != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        fhandle_t *fh = NFSLOG_GET_FHANDLE3(&args->file);
        newte->pathname = nfslog_get_path(fh, NULL,
            fhpath, "trans_write3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_WRITE;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = res->nfslog_WRITE3res_u.ok.count;
    newte->fh_u.fh3 = args->file;

    if (pte = insert_te(tf->te_list_v3_write, newte)) {
        /*
         * if the write would have increased the total byte count
         * over the filesize, then generate a log entry and remove
         * the write record and insert the new one.
         */
        if (pte->totalbytes + res->nfslog_WRITE3res_u.ok.count >
            res->nfslog_WRITE3res_u.ok.filesize) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
            (void) insert_te(tf->te_list_v3_write, newte);
            pte = NULL;
        } else {
            /* free this since entry was found (not inserted) */
            remove_te(newte);

            pte->totalbytes += res->nfslog_WRITE3res_u.ok.count;

            if (pte->lastupdate.tv_sec <=
                logrec->re_header.rh_timestamp.tv_sec) {
                pte->lastupdate =
                    logrec->re_header.rh_timestamp;
            }
            pte = NULL; /* prevent printing of log entry */
        }
    }
    return (pte);
}

static struct transentry *
trans_setattr3(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_SETATTR3args *args = (nfslog_SETATTR3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

    if (*res != NFS3_OK)
        return (NULL);

    if (!args->size.set_it)
        return (NULL);
    /*
     * should check the size of the file to see if it
     * is being truncated below current eof.  if so
     * a record should be generated.... XXX
     */
    if (args->size.size != 0)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        fhandle_t *fh = NFSLOG_GET_FHANDLE3(&args->object);
        newte->pathname = nfslog_get_path(fh, NULL,
            fhpath, "trans_setattr3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_SETATTR;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->object;

    if (pte = insert_te(tf->te_list_v3_write, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v3_read, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }

    return (newte);
}

static struct transentry *
trans_create3(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_CREATE3args *args = (nfslog_CREATE3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_CREATE3res *res = (nfslog_CREATE3res *)logrec->re_rpc_res;

    if (res->status != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
                args->where.name,
                fhpath, "trans_create3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_CREATE;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;

    if (!args->how.nfslog_createhow3_u.size.set_it)
        newte->totalbytes = 0;
    else
        newte->totalbytes =
            args->how.nfslog_createhow3_u.size.size;

    newte->fh_u.fh3 = args->where.dir;

    if (args->how.nfslog_createhow3_u.size.set_it) {
        if (pte = insert_te(tf->te_list_v3_write, newte)) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
        }
        if (pte = insert_te(tf->te_list_v3_read, newte)) {
            nfslog_print_trans_logentry(pte, tf);
            remove_te(pte);
        }
    }

    return (newte);
}

static struct transentry *
trans_remove3(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_REMOVE3args *args = (nfslog_REMOVE3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

    if (*res != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->object.dir),
                args->object.name,
                fhpath, "trans_remove3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_REMOVE;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->object.dir;

    if (pte = insert_te(tf->te_list_v3_write, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v3_read, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v2_write, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }
    if (pte = insert_te(tf->te_list_v2_read, newte)) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }

    return (newte);
}

static struct transentry *
trans_mkdir3(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_MKDIR3args *args = (nfslog_MKDIR3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_MKDIR3res *res = (nfslog_MKDIR3res *)logrec->re_rpc_res;

    if (res->status != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
                args->where.name,
                fhpath, "trans_mkdir3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_MKDIR;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->where.dir;

    return (newte);
}

static struct transentry *
trans_rmdir3(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_RMDIR3args *args = (nfslog_RMDIR3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

    if (*res != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->object.dir),
                args->object.name,
                fhpath, "trans_rmdir3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_RMDIR;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->object.dir;

    return (newte);
}

static struct transentry *
trans_rename3(
    nfslog_request_record *logrec,
    struct nfslog_trans_file *tf,
    char *fhpath,
    char *path1,
    char *path2)
{
    struct transentry *newte;
    struct transentry *pte = NULL;
    /* LINTED */
    nfslog_RENAME3args *args = (nfslog_RENAME3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;
    char *tpath1 = NULL;
    char *tpath2 = NULL;

    if (*res != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        path1 = tpath1 =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->from.dir),
                args->from.name, fhpath, "trans_rename3 from");
        path2 = tpath2 =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->to.dir),
                args->to.name, fhpath, "trans_rename3 to");
    }

    newte->pathname = path1; /* no need to strdup here */
    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_RENAME;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->from.dir;

    /* switch path names for the file for renames */
    if (pte = insert_te(tf->te_list_v3_write, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }
    if (pte = insert_te(tf->te_list_v3_read, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }
    if (pte = insert_te(tf->te_list_v2_write, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }
    if (pte = insert_te(tf->te_list_v2_read, newte)) {
        free(pte->pathname);
        pte->pathname = strdup(path2);
    }

    newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
    /* check for NULL malloc */
    (void) sprintf(newte->pathname, "%s->%s", path1, path2);

    if (tpath1) {
        free(tpath1);
        free(tpath2);
    }

    return (newte);
}

static struct transentry *
trans_mknod3(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_MKNOD3args *args = (nfslog_MKNOD3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_MKNOD3res *res = (nfslog_MKNOD3res *)logrec->re_rpc_res;

    if (res->status != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        newte->pathname =
            nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
                args->where.name,
                fhpath, "trans_mknod3");
    } else {
        newte->pathname = strdup(path1);
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_MKNOD;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;

    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->where.dir;

    return (newte);
}

static struct transentry *
trans_link3(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1,
    char *path2)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_LINK3args *args = (nfslog_LINK3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfsstat3 *res = (nfsstat3 *)logrec->re_rpc_res;

    char *tpath1 = NULL;
    char *tpath2 = NULL;

    if (*res != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (!path1) {
        tpath1 = nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->file),
            NULL, fhpath, "trans_link3 from");
        tpath2 = nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->link.dir),
            args->link.name, fhpath, "trans_link3 to");
        path1 = tpath1;
        path2 = tpath2;
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_LINK;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->file;

    newte->pathname = (char *)malloc(strlen(path1) + strlen(path2) + 3);
    /* check for NULL malloc */
    (void) sprintf(newte->pathname, "%s->%s", path1, path2);

    if (tpath1) {
        free(tpath1);
        free(tpath2);
    }

    return (newte);
}

static struct transentry *
trans_symlink3(
    nfslog_request_record *logrec,
    char *fhpath,
    char *path1)
{
    struct transentry *newte;
    /* LINTED */
    nfslog_SYMLINK3args *args = (nfslog_SYMLINK3args *)logrec->re_rpc_arg;
    /* LINTED */
    nfslog_SYMLINK3res *res = (nfslog_SYMLINK3res *)logrec->re_rpc_res;
    char *name;

    if (res->status != NFS3_OK)
        return (NULL);

    if ((newte = create_te()) == NULL)
        return (NULL);

    if (path1) {
        name = strdup(path1);
    } else {
        name = nfslog_get_path(NFSLOG_GET_FHANDLE3(&args->where.dir),
            args->where.name, fhpath, "trans_symlink3");
    }

    newte->starttime = logrec->re_header.rh_timestamp;
    newte->lastupdate = logrec->re_header.rh_timestamp;
    newte->optype = TRANS_OPER_SYMLINK;
    newte->datatype = TRANS_DATATYPE_BINARY;
    newte->transoption = TRANS_OPTION_NOACTION;
    newte->pnb = netbufdup(&(logrec->re_ipaddr));
    newte->uid = logrec->re_header.rh_uid;
    newte->nfsvers = NFS_V3;
    newte->netid = strdup(logrec->re_netid);
    if (logrec->re_principal_name)
        newte->principal_name = strdup(logrec->re_principal_name);
    else
        newte->principal_name = NULL;
    newte->totalbytes = 0;
    newte->fh_u.fh3 = args->where.dir;

    newte->pathname = (char *)malloc(strlen(name) +
        strlen(args->symlink_data) + 3);
    /* check for NULL malloc */
    (void) sprintf(newte->pathname, "%s->%s", name, args->symlink_data);

    free(name);

    return (newte);
}

/*
 * nfslog_process_trans_rec - processes the record in the buffer and outputs
 *  to the trans log.
 * Return 0 for success, errno else.
 */
int
nfslog_process_trans_rec(void *transcookie, nfslog_request_record *logrec,
    char *fhpath, char *path1, char *path2)
{
    struct transentry   *pte = NULL;
    struct nfslog_trans_file *tf = (struct nfslog_trans_file *)transcookie;

    /* ignore programs other than nfs */
    if (logrec->re_header.rh_prognum != NFS_PROGRAM)
        return (0);

    /* update the timestamp for use later in the timeout sequences */
    if (tf->lasttrans_timestamp.tv_sec <
        logrec->re_header.rh_timestamp.tv_sec)
        tf->lasttrans_timestamp =
            logrec->re_header.rh_timestamp;

    /* current time of this processing */
    tf->last_trans_read = time(0);

    /* ignore anything that is not a read or write */
    switch (logrec->re_header.rh_version) {
    case NFS_VERSION:
        switch (logrec->re_header.rh_procnum) {
        case RFS_READ:
            if (tf->trans_to_log & TRANSTOLOG_OPER_READ)
                pte = trans_read(logrec, tf, fhpath, path1);
            break;
        case RFS_WRITE:
            if (tf->trans_to_log & TRANSTOLOG_OPER_WRITE)
                pte = trans_write(logrec, tf, fhpath, path1);
            break;
        case RFS_SETATTR:
            if (tf->trans_to_log & TRANSTOLOG_OPER_SETATTR)
                pte = trans_setattr(logrec, tf,
                    fhpath, path1);
            break;
        case RFS_REMOVE:
            if (tf->trans_to_log & TRANSTOLOG_OPER_REMOVE)
                pte = trans_remove(logrec, tf,  fhpath, path1);
            break;
        case RFS_MKDIR:
            if (tf->trans_to_log & TRANSTOLOG_OPER_MKDIR)
                pte = trans_mkdir(logrec, fhpath, path1);
            break;
        case RFS_RMDIR:
            if (tf->trans_to_log & TRANSTOLOG_OPER_RMDIR)
                pte = trans_rmdir(logrec, fhpath, path1);
            break;
        case RFS_CREATE:
            if (tf->trans_to_log & TRANSTOLOG_OPER_CREATE)
                pte = trans_create(logrec, tf, fhpath, path1);
            break;
        case RFS_RENAME:
            if (tf->trans_to_log & TRANSTOLOG_OPER_RENAME)
                pte = trans_rename(logrec, tf,
                    fhpath, path1, path2);
            break;
        case RFS_LINK:
            if (tf->trans_to_log & TRANSTOLOG_OPER_LINK)
                pte = trans_link(logrec, fhpath, path1, path2);
            break;
        case RFS_SYMLINK:
            if (tf->trans_to_log & TRANSTOLOG_OPER_SYMLINK)
                pte = trans_symlink(logrec, fhpath, path1);
            break;
        default:
            break;
        }
        break;
    case NFS_V3:
        switch (logrec->re_header.rh_procnum) {
        case NFSPROC3_READ:
            if (tf->trans_to_log & TRANSTOLOG_OPER_READ)
                pte = trans_read3(logrec, tf, fhpath, path1);
            break;
        case NFSPROC3_WRITE:
            if (tf->trans_to_log & TRANSTOLOG_OPER_WRITE)
                pte = trans_write3(logrec, tf, fhpath, path1);
            break;
        case NFSPROC3_SETATTR:
            if (tf->trans_to_log & TRANSTOLOG_OPER_SETATTR)
                pte = trans_setattr3(logrec, tf,
                    fhpath, path1);
            break;
        case NFSPROC3_REMOVE:
            if (tf->trans_to_log & TRANSTOLOG_OPER_REMOVE)
                pte = trans_remove3(logrec, tf,
                    fhpath, path1);
            break;
        case NFSPROC3_MKDIR:
            if (tf->trans_to_log & TRANSTOLOG_OPER_MKDIR)
                pte = trans_mkdir3(logrec, fhpath, path1);
            break;
        case NFSPROC3_RMDIR:
            if (tf->trans_to_log & TRANSTOLOG_OPER_RMDIR)
                pte = trans_rmdir3(logrec, fhpath, path1);
            break;
        case NFSPROC3_CREATE:
            if (tf->trans_to_log & TRANSTOLOG_OPER_CREATE)
                pte = trans_create3(logrec, tf,
                    fhpath, path1);
            break;
        case NFSPROC3_RENAME:
            if (tf->trans_to_log & TRANSTOLOG_OPER_RENAME)
                pte = trans_rename3(logrec, tf,
                    fhpath, path1, path2);
            break;
        case NFSPROC3_MKNOD:
            if (tf->trans_to_log & TRANSTOLOG_OPER_MKNOD)
                pte = trans_mknod3(logrec, fhpath, path1);
            break;
        case NFSPROC3_LINK:
            if (tf->trans_to_log & TRANSTOLOG_OPER_LINK)
                pte = trans_link3(logrec,
                    fhpath, path1, path2);
            break;
        case NFSPROC3_SYMLINK:
            if (tf->trans_to_log & TRANSTOLOG_OPER_SYMLINK)
                pte = trans_symlink3(logrec, fhpath, path1);
            break;
        default:
            break;
        }
        break;
    default:
        break;
    }

    if (pte != NULL) {
        nfslog_print_trans_logentry(pte, tf);
        remove_te(pte);
    }

    return (0);
}

static void
nfslog_print_trans_logentry(struct transentry *pte,
    struct nfslog_trans_file *tf)
{
    char *remotehost;
    char datatype;
    char transoption;
    char *optype;
    char *prin;
    int prinid;
    char nfs_ident[32];

    remotehost = addrtoname(pte->pnb->buf);

    datatype = (pte->datatype == TRANS_DATATYPE_BINARY ? 'b' : 'a');
    transoption = (pte->transoption == TRANS_OPTION_NOACTION ? '_' : '?');

    if (tf->trans_output_type == TRANSLOG_BASIC) {
        (void) strcpy(nfs_ident, "nfs");
    } else {
        (void) strcpy(nfs_ident,
            (pte->nfsvers == NFS_V3 ? "nfs3-" : "nfs-"));
        (void) strcat(nfs_ident, pte->netid);
    }

    switch (pte->optype) {
    case TRANS_OPER_READ:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "read" : "o");
        break;
    case TRANS_OPER_WRITE:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "write" : "i");
        break;
    case TRANS_OPER_REMOVE:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "remove" : "?");
        break;
    case TRANS_OPER_MKDIR:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "mkdir" : "?");
        break;
    case TRANS_OPER_CREATE:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "create" : "?");
        break;
    case TRANS_OPER_RMDIR:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "rmdir" : "?");
        break;
    case TRANS_OPER_SETATTR:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "setattr" : "?");
        break;
    case TRANS_OPER_RENAME:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "rename" : "?");
        break;
    case TRANS_OPER_MKNOD:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "mknod" : "?");
        break;
    case TRANS_OPER_LINK:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "link" : "?");
        break;
    case TRANS_OPER_SYMLINK:
        optype = (tf->trans_output_type == TRANSLOG_EXTENDED ?
            "symlink" : "?");
        break;
    default:
        optype = "?";
        break;
    }
    if (strcmp(pte->principal_name, "") == 0) {
        prinid = 0;
        prin = "*";
    } else {
        prinid = 1;
        prin = pte->principal_name;
    }
    (void) fprintf(tf->fp,
        "%.24s %d %s %d %s %c %c %s %c %ld %s %d %s\n",
        ctime((time_t *)&pte->starttime.tv_sec),
        pte->lastupdate.tv_sec - pte->starttime.tv_sec,
        remotehost,
        (uint32_t)pte->totalbytes,
        pte->pathname,
        datatype,
        transoption,
        optype,
        'r', /* anonymous == 'a', guest == 'g', real == 'r'), */
        pte->uid,
        nfs_ident,
        /* authenticated - fill in kerb/security? */
        prinid,
        /* authenticated ? authuser : "*" */
        prin);
}