# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
isa_odbc = {
  plugin_version = "2.3"

  info.1.manfacturer = "Microsoft"
  info.1.device = "ISA WebProxy (ODBC log source)"
  info.1.version.1 = ""

  # 2006-11-29 - 2.0 - GMF - Simplified layout; added names of all fields; grouped reports.
  # 2006-12-05 - 2.1 - GMF - Merge of Graham's changes (similar to mine of the 29th).
  #                          ref: http://www.microsoft.com/technet/isa/2000/proddocs/isadocs/m_s_c_loggingfields.mspx?mfr=true
  # 2009-07-15 - 2.2 - MSG - Added  page_views to the log fields.
  # 2009-10-02 - 1.0 - gas - created isa_odbc from isacsv plug-in
  # 2011-03-22 - 2.3 - MSG - Edited info lines 

  # The name of the log format
  log.format.format_label = "Microsoft ISA WebProxy (ODBC log source) Log Format"
  log.miscellaneous.log_data_type = "firewall"  
  log.miscellaneous.log_format_type = "firewall"

  # The log is in this format if any of the first ten lines match this regular expression
  #log.format.autodetect_regular_expression = "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+, [^,]+, [^,]+, [^,]+, [0-9]+/[0-9]+/[0-9][0-9][0-9][0-9], [0-9]+:[0-9][0-9]:[0-9][0-9], [^,]+, [^,]+, [^,]+, [^,]+, [0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, [a-z]+, [^,]+, [A-Z]+, [^,]+, [^,]+, [^,]+, [0-9]+, [^,]+, [^,]+, [^,]+|#Software: Microsoft\\(R\\) Internet Security and Acceleration Serve"
  log.format.autodetect_regular_expression = "^#Software: Sawmill ODBC Query Exporter"

  # The format of dates and times in this log
  log.format.date_format = "auto"
  log.format.time_format = "auto"

  # Logs fields are separated by a comma
#  log.format.field_separator = ", "

  # Log fields
  log.fields = {

   date.type = "date"
   time.type = "time"
   clientip.type = "host"
   clientusername = ""
   clientagent.type = "agent"
   clientauthenticate = ""
#   logtime = ""
   service = ""
   servername = ""
   referredserver = ""
   desthost = ""
   desthostip = ""
   desthostport = ""
   processingtime = ""
   bytesrecvd.type = "size"
   bytessent.type = "size"
   protocol = ""
   transport = ""
   operation = ""
   uri.type = "page"
   mimetype = ""
   objectsource = ""
   resultcode = ""
   cacheinfo = ""
   rule = ""
   filterinfo = ""
   srcnetwork = ""
   dstnetwork = ""
   errorinfo = ""
   action = ""
   gmtlogtime = ""
   authenticationserver = ""
   web_browser = ""
   operating_system = ""
   spider = ""
#   worm = ""
#   location = ""
   
  } # log.fields


  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    clientip = ""
    clientusername = ""
    clientagent = ""
    clientauthenticate = ""
#    logtime = ""
    service = ""
    servername = ""
    referredserver = ""
    desthost = ""
    desthostip = ""
    desthostport = ""
    protocol = ""
    transport = ""
    operation = ""
    uri = ""
    mimetype = ""
    objectsource = ""
    resultcode = ""
    cacheinfo = ""
    rule = ""
    filterinfo = ""
    srcnetwork = ""
    dstnetwork = ""
    errorinfo = ""
    action = ""
#    gmtlogtime = ""
    authenticationserver = ""
    web_browser = ""
    operating_system = ""
    #worm = ""
    spider = ""
 #   location = ""
   
  } # database.fields


#  # Get web browser, operating system, web browser, and spider information from the user-agent field.
  log.parsing_filters.derive_from_user_agent = `
get_user_agent_info(clientagent);
web_browser = volatile.web_browser;
operating_system = volatile.operating_system;
spider = volatile.spider;
`
  log.parsing_filters.parse = `
#    date_time = logtime;
    date = normalize_date(logtime, 'seconds_since_jan1_1970');
    time = normalize_time(logtime, 'seconds_since_jan1_1970');
`


  # Log Filters
  log.filters = {

#    set_page_for_worm = {
 #     label = "$lang_admin.log_filters.set_page_for_worm_label"
  #    comment = "$lang_admin.log_filters.set_page_for_worm_comment"
   #   value = "if (starts_with(worm, '(')) then '' else uri = '(worm)';"
    #} # set_page_for_worm

    remove_query = {
      label = "$lang_admin.log_filters.remove_query_label"
      comment = "$lang_admin.log_filters.remove_query_comment"
      value = "if (contains(uri, '?')) then uri = substr(uri, 0, index(uri, '?') + 1) . '(parameters)';"
    } # remove_query

    detect_page_views = {
      label = '$lang_admin.log_filters.detect_page_views_label'
      comment = '$lang_admin.log_filters.detect_page_views_comment'
      value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;"
    } # detect_page_views

    simplify_url = {
      label = "$lang_admin.log_filters.simplify_url_label"
      comment = "$lang_admin.log_filters.simplify_url_comment"
      value = "if (matches_regular_expression(uri, '^([^:]+://[^/]+/)')) then uri = $1 . '(omitted)'"
    } # simplify_url

    strip_non_page_views = {
      label = '$lang_admin.log_filters.strip_non_page_views_label'
      comment = '$lang_admin.log_filters.strip_non_page_views_comment'
      value = "if (page_views == 0) then uri = substr(uri, 0, last_index(uri, '/') + 1) . '(nonpage)';"
    } # strip_non_page_views

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'hits = 1;'
    } # mark_entry

  } # log.filters

  log.field_options = {

    sessions_page_field = "uri"
    sessions_visitor_id_field = "clientip"
    sessions_event_field = "page_views"

  } # log.field_options


  database.numerical_fields = {

    hits = {
      requires_log_field = false
      entries_field = true
    } # hits

    page_views = {
      default = true
    } # page_views

    unique_client_ips = {
      log_field = "c_ip"
      type = "unique"
    } # unique_client_ips

    bytesrecvd = {
      type = "float"
      display_format_type = "bandwidth"
    } # bytesrecvd

    bytessent = {
      type = "float"
      display_format_type = "bandwidth"
    } # bytessent

    processingtime = {
      type = "float"
      display_format_type = duration_milliseconds
    } # processingtime

    processingtime_avg = {
      label = "$lang_stats.field_labels.time_taken $lang_stats.field_labels.average_tag"
      log_field = "processingtime"
      type = "float"
      aggregation_method = "average"
      average_denominator_field = "hits"
      display_format_type = duration_milliseconds
    } # processingtime_avg

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      content_group = {
        uri = ""
        mimetype = ""
      }
      client_group = {
        clientip = ""
        location = ""
        clientusername = ""
        cs_network = ""
        clientauthenticate = ""
        clientagent = ""
      }
      server_group = {
        sc_authenticated = ""
        service = ""
        servername = ""
        desthost = ""
        desthostip = ""
        desthostport = ""
        srcnetwork = ""
        dstnetwork = ""
        authenticationserver = ""
      }
      visitor_systems_group = {
        web_browser = ""
        operating_system = ""
        spider = ""
      }
      other_group = {
        referredserver = ""
        protocol = ""
        transport = ""
        operation = ""
        worm = ""
        objectsource = ""
        resultcode = ""
        cacheinfo = ""
        rule = ""
        filterinfo = ""
        errorinfo = ""
        action = ""
      }

    } # report_groups

######### START OF FINAL_STEP CODE
    final_step = `
include "templates.admin.profiles.setup_reports_util";
string profile = "profiles." . volatile.new_profile_name;
# Remove gmtlogtime and logtime fields from the db
delete_database_field(profile, 'gmtlogtime');
delete_database_field(profile, 'logtime');
# Create the standard reports
add_standard_reports(profile);
`
######## END OF FINAL_STEP CODE


  } # create_profile_wizard_options

} # isa_odbc