# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
crond = {

  plugin_version = "1.1"

  info.1.manfacturer = "RedHat"
  info.1.device = "Linux crond"
  info.1.version.1 = "7"
  info.1.version.2 = "9"

  info.2.manfacturer = "The Fedora Project"
  info.2.device = "Linux crond"
  info.2.version.1 = "Fedora Core 2"
  info.2.version.2 = "Fedora Core 3"

  info.3.manfacturer = "Cellopoint"
  info.3.device = "CelloOS crond"
  info.3.version.1 = "2"

  # 2008-04-08 - 1.0 - GMF - Initial creation
  # 2010-10-06 - 1.1 - MSG - Edited info lines.

  # The name of the log format
  log.format.format_label = "Cron Log Format"
  log.miscellaneous.log_data_type = "syslog_required"  
  log.miscellaneous.log_format_type = "syslog_server"

  # The log is in this format if any of the first ten lines match this regular expression

  log.format.autodetect_expression = `
# RH7
#e.g. 2007-09-10	23:59:59	Cron.Info	12.34.56.78	ROND[24556]: (root) CMD (   /sbin/rmmod -as) 
matches_regular_expression(volatile.log_data_line, '[Cc]?[Rr][Oo][Nn][Dd][[][0-9]+[]]: [(][^)]+[)] CMD [(]')

`

  log.format.autodetect_lines = "100"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    daemon = ""
    pid = ""
    operation = ""
    user = ""
    command = ""
    system_message = ""

  } # log.fields

  # Log Parsing Filters
  log.parsing_filters.parse = `
  
# Strip date from 2nd syslog entry - date may be corrupted like this 'ct 24 00:03:46'
# 2008-04-08 - GMF - It's worse than that--RedHat 7 can have three apparently random characters for the month name.
if (matches_regular_expression(v.syslog_message, '^... [0-9 ]?[0-9] [0-9]{2}:[0-9]{2}:[0-9]{2}[ 	]+(.*$)')) then (
  v.syslog_message = $1;
);

# Look for standard patterns
if (matches_regular_expression(v.syslog_message, '([Cc]?[Rr][Oo][Nn][Dd])[[]([0-9]+)[]]: [(]([^)]+)[)] (CMD) [(] *([^ ][^)]+)[)]')) then (
  set_collected_field('', 'daemon', $1);
  set_collected_field('', 'pid', $2);
  set_collected_field('', 'user', $3);
  set_collected_field('', 'operation', $4);
  set_collected_field('', 'command', $5);

); # If sessionopened/closed

set_collected_field('', 'system_message', v.syslog_message);

accept_collected_entry('', false);
`

  # Database fields
  database.fields = {

    daemon = ""
    pid = ""
    operation = ""
    user = ""
    command = ""
    system_message = ""

  } # database.fields

  database.numerical_fields = {

    messages = {
      default = true
      requires_log_field = false
      entries_field = true
    } # messages

  } # database.numerical_fields

  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'messages = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # crond