# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
mdaemon7_all = {

  plugin_version = "1.0.1"

  # Initial creation - 1.0
  # 2011-06-22 - 1.0.1 - MSG - Edited info lines.

  info.1.manufacturer = "Alt-N Technologies"
  info.1.device = "MDaemon 7 (All)"
  info.1.version.1 = ""

  # The name of the log format
  log.format.format_label = "MDaemon 7 (All) Log Format"
  log.miscellaneous.log_data_type = "mail_server"
  log.miscellaneous.log_format_type = "mail_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^(START Event Log / MDaemon|[A-Z][a-z][a-z] [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]: Checking for available updates...)"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # The format of dates and times in this log
  log.format.date_format = "yyyy-mm-dd"
  log.format.time_format = "hh:mm:ss"

  # A log entry is a "connection"
  statistics.miscellaneous.entry_name = "events"

  # Log fields
  log.fields = {

    date = {
      label = "$lang_stats.field_labels.date"
      type = "date"
      index = 0
      subindex = 0
      hierarchy_dividers = ""
      left_to_right = false
      leading_divider = "false"
    } # date

    time = {
      label = "$lang_stats.field_labels.time"
      type = "time"
      index = 0
      subindex = 0
      hierarchy_dividers = ""
      left_to_right = false
      leading_divider = "false"
    } # time

    source_ip = {
      label = "$lang_stats.field_labels.source_ip"
      type = "flat"
      index = 0
      subindex = 0
    } # source_ip

    source_port = {
      label = "$lang_stats.field_labels.source_port"
      type = "flat"
      index = 0
      subindex = 0
    } # source_port

    source_hostname = {
      label = "$lang_stats.field_labels.source_hostname"
      type = "flat"
      index = 0
      subindex = 0
    } # source_hostname

    protocol = {
      label = "$lang_stats.field_labels.protocol"
      type = "flat"
      index = 0
      subindex = 0
    } # protocol

    username = {
      label = "$lang_stats.field_labels.username"
      type = "flat"
      index = 0
      subindex = 0
    } # username

    bytes = {
      label = "$lang_stats.field_labels.bytes"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes

    bytes_sent = {
      label = "$lang_stats.field_labels.bytes_sent"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes_sent
    
    bytes_received = {
      label = "$lang_stats.field_labels.bytes_received"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes_received

    sender = {
      label = "$lang_stats.field_labels.sender"
      type = "flat"
      index = 0
      subindex = 0
    } # sender

    recipient = {
      label = "$lang_stats.field_labels.recipient"
      type = "flat"
      index = 0
      subindex = 0
    } # recipient
    
    event_type = {
      label = "$lang_stats.field_labels.event_type"
      type = "flat"
      index = 0
      subindex = 0
    } # event_type

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters = {

    # Parse date/time from line
    parse_date_time = {
      label = "parse_date_time"
      comment = "parse_date_time"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] ([0-9-]*) ([0-9:]*):', '*KEY*,date,time')"
    } # parse_date_time


    # Parse accepting connection from line
    parse_connections = {
      label = "parse_connections"
      comment = "parse_connections"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [-0-9]+ [:0-9]+: \\\\[[0-9]*:[0-9]*\\\\] Accepting (IMAP|POP|SMTP) (connection) from \\\\[([^ ]+) : ([0-9]+)\\\\]', '*KEY*,protocol,event_type,source_ip,source_port')"
    } # parse_connections
    
    
    
    
    # IMAP lines



    # Parse IMAP auth user line
    2 = {
      label = "2"
      comment = "2"
      value = "collect_fields_using_regexp('^()[A-Z][a-z][a-z] [-0-9]+ [:0-9]+: \\\\[[0-9]*:[0-9]*\\\\] Authenticated as ([^$]+)$', '*KEY*,username')"
    } # 2
    
    # Parse IMAP LOGIN line
    4 = {
      label = "4"
      comment = "4"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [0-9-]* [0-9:]*: \\\\[[0-9]*:[0-9]*\\\\] <-- l LOGIN ([^ ]+) [^$]+$', '*KEY*,username')"
    } # 4

    # Parse IMAP bytes line    
    6 = {
      label = "6"
      comment = "6"
      value = "collect_fields_using_regexp('^()[A-Z][a-z][a-z] [-0-9]+ [:0-9]+: \\\\[[0-9]*:[0-9]*\\\\] IMAP session complete, \\\\(([0-9]+) bytes\\\\)$', '*KEY*,bytes')"
    } # 6
   
   
   
    
    
    
    
    # SMTP lines
    
    # Parse SMTP sender line
    8 = {
      label = "8"
      comment = "8"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [-0-9]+ [:0-9]+: \\\\[[0-9]*:[0-9]*\\\\] --> 250 <([^>]+)>, Sender ok$', '*KEY*,sender')"
    } # 8
    
    # Parse SMTP sender line
    10 = {
      label = "10"
      comment = "10"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [-0-9]+ [:0-9]+: \\\\[[0-9]*:[0-9]*\\\\] --> 250 <([^>]+)>, Recipient ok$', '*KEY*,recipient')"
    } # 10

    # set event type for SMTP messages
    12 = {
      label = "12"
      comment = "12"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [-0-9]+ [:0-9]+: \\\\[[0-9]*:[0-9]*\\\\] (Message) creation successful: [^$]+$', '*KEY*,event_type')"
    } # 12






    # POP lines
    
    # Parse POP connection line
    14 = {
      label = "14"
      comment = "14"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [0-9-]* [0-9:]*: \\\\[[0-9]*:[0-9]*\\\\] (Socket) (connection) established \(([0-9.]+) : ([0-9]+) -> [0-9.]+ : [0-9]+\)$', '*KEY*,protocol,event_type,source_ip,source_port')"
    } # 14 
    
    # Parse POP USER line
    16 = {
      label = "16"
      comment = "16"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [0-9-]* [0-9:]*: \\\\[[0-9]*:[0-9]*\\\\] <-- USER ([^$]+)$', '*KEY*,username')"
    } # 16    
       


     


    # Parse session complete bytes line
        
    collect_bytes = {
      label = "collect_bytes"
      comment = "collect_bytes"
      value = "collect_fields_using_regexp('()^[A-Z][a-z][a-z] [0-9-]* [0-9:]*: \\\\[[0-9]*:[0-9]*\\\\] (SMTP|POP) session (complete|successful) \\\\(Bytes in/out: ([0-9]+)/([0-9]+)\\\\)$', '*KEY*,dummy1,dummy2,bytes_received,bytes_sent')"
    } # collect_bytes  



# Accept lines

    # Accept this log entry on "----------" lines
    
    accept_entry = {
      label = "accept_entry"
      comment = "accept_entry"
      value = "accept_collected_entry_using_regexp('()^[A-Z][a-z][a-z] [0-9-]* [0-9:]*: ----------$', false)"
    } # accept_entry


  } # log.parsing_filters


  # Database fields
  database.fields = {

    date_time = {
      label = "$lang_stats.field_labels.date_time"
      log_field = "date_time"
      type = "string"
      suppress_top = 0
      suppress_bottom = 3
      display_format_type = "date_time"
    } # date_time

    day_of_week = {
      label = "$lang_stats.field_labels.day_of_week"
      log_field = "day_of_week"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
      display_format_type = "day_of_week"
    } # day_of_week

    hour_of_day = {
      label = "$lang_stats.field_labels.hour_of_day"
      log_field = "hour_of_day"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
      display_format_type = "hour_of_day"
    } # hour_of_day

    source_ip = {
      label = "$lang_stats.field_labels.source_ip"
      log_field = "source_ip"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # source_ip
    
    source_port = {
      label = "$lang_stats.field_labels.source_port"
      log_field = "source_port"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # source_port

    source_hostname = {
      label = "$lang_stats.field_labels.source_hostname"
      log_field = "source_hostname"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # source_hostname

    protocol = {
      label = "$lang_stats.field_labels.protocol"
      log_field = "protocol"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # protocol

    username = {
      label = "$lang_stats.field_labels.username"
      log_field = "username"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # username

    recipient = {
      label = "$lang_stats.field_labels.recipient"
      log_field = "recipient"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # recipient

    sender = {
      label = "$lang_stats.field_labels.sender"
      log_field = "sender"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # sender

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    connections = {
      label = "$lang_stats.field_labels.connections"
      default = false
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = false
    } # connections
    
    messages = {
      label = "$lang_stats.field_labels.messages"
      default = false
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = false
    } # messages

    bytes = {
      label = "$lang_stats.field_labels.bytes"
      default = false
      requires_log_field = true
      log_field = "bytes"
      type = "float"
      display_format_type = "bandwidth"
      entries_field = false
    } # bytes

  } # database.numerical_fields


  log.filters = {
  
    1 = {
      label = '1'
      comment = '1'
      value = "if (protocol eq 'Socket') then protocol = 'MultiPOP';"
    } # 1    


    2 = {
      label = '2'
      comment = '2'
      value = "if (bytes eq '(empty)') then bytes = bytes_received + bytes_sent;"
    } # 2    

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = "if (event_type eq 'connection') then connections = 1 else if (event_type eq 'Message') then messages = 1; events = 1;"
    } # mark_entry
    
  } # log.filters

  create_profile_wizard_options = {
    date_time_tracking = true

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      source_ip = true
      source_port = true
      source_hostname = true
      protocol = true
      username = true
      recipient = true
      sender = true
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
    visitors = true
    sessions = true
    pageviews = true
    individualhosts = true
  } # not_supported

} # mdaemon7_all