# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
mdaemon8_all = {

  plugin_version = "2.0"

  info.1.manufacturer = "Alt-N Technologies"
  info.1.device = "MDaemon"
  info.1.version.1 = "8"
  info.1.version.1 = "9"
  info.1.version.1 = "10"
  info.1.version.1 = "11"

  # ????-??-?? - 1.0 - ??? - Initial version
  # 2011-02-16 - 2.0 - GMF - Added support for content filter (including subject); reworked to modern standards.

  # The name of the log format
  log.format.format_label = "MDaemon 8+ Log Format"
  log.miscellaneous.log_data_type = "mail_server"
  log.miscellaneous.log_format_type = "mail_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^(START Event Log / MDaemon|[A-Z][a-z][a-z] [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]: Checking for available updates...)"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # The format of dates and times in this log
  log.format.date_format = "yyyy-mm-dd"
  log.format.time_format = "hh:mm:ss"

  # A log entry is a "connection"
  statistics.miscellaneous.entry_name = "events"

  # Log fields
  log.fields = {

    date = {
      label = "$lang_stats.field_labels.date"
      type = "date"
      index = 0
      subindex = 0
      hierarchy_dividers = ""
      left_to_right = false
      leading_divider = "false"
    } # date

    time = {
      label = "$lang_stats.field_labels.time"
      type = "time"
      index = 0
      subindex = 0
      hierarchy_dividers = ""
      left_to_right = false
      leading_divider = "false"
    } # time

    source_ip = {
      label = "$lang_stats.field_labels.source_ip"
      type = "flat"
      index = 0
      subindex = 0
    } # source_ip

    source_port = {
      label = "$lang_stats.field_labels.source_port"
      type = "flat"
      index = 0
      subindex = 0
    } # source_port

    source_hostname = {
      label = "$lang_stats.field_labels.source_hostname"
      type = "flat"
      index = 0
      subindex = 0
    } # source_hostname

    protocol = {
      label = "$lang_stats.field_labels.protocol"
      type = "flat"
      index = 0
      subindex = 0
    } # protocol

    username = {
      label = "$lang_stats.field_labels.username"
      type = "flat"
      index = 0
      subindex = 0
    } # username

    bytes = {
      label = "$lang_stats.field_labels.bytes"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes

    bytes_sent = {
      label = "$lang_stats.field_labels.bytes_sent"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes_sent
    
    bytes_received = {
      label = "$lang_stats.field_labels.bytes_received"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes_received

    sender = {
      label = "$lang_stats.field_labels.sender"
      type = "flat"
      index = 0
      subindex = 0
    } # sender

    recipient = {
      label = "$lang_stats.field_labels.recipient"
      type = "flat"
      index = 0
      subindex = 0
    } # recipient
    
    event_type = {
      label = "$lang_stats.field_labels.event_type"
      type = "flat"
      index = 0
      subindex = 0
    } # event_type

    subject = ""

    connections = ""
    messages_filtered = ""
    messages = ""

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters.parse = `

if (matches_regular_expression(current_log_line(), '^[A-Z][a-z][a-z] ([0-9-]*) ([0-9:]*): *\\\\[*[0-9]*:*[0-9]*\\\\]* (.*)$')) then (
  set_collected_field('', 'date', $1);
  set_collected_field('', 'time', $2);
  v.remainder = $3;

  # Parse accepting connection from line
  if (matches_regular_expression(v.remainder, 'Accepting (IMAP|POP|SMTP) (connection) from \\\\[([^ ]+) : ([0-9]+)\\\\]')) then (
    set_collected_field('', 'protocol', $1);
    set_collected_field('', 'event_type', $2);
    set_collected_field('', 'source_ip', $3);
    set_collected_field('', 'source_port', $4);
  );  

  # Parse IMAP auth user line
  else if (matches_regular_expression(v.remainder, '^Authenticated as ([^$]+)$')) then
    set_collected_field('', 'username', $1);

  # Parse IMAP LOGIN line
  else if (matches_regular_expression(v.remainder, '^<-- l LOGIN ([^ ]+) [^$]+$')) then
    set_collected_field('', 'username', $1);

  # Parse IMAP bytes line
  else if (matches_regular_expression(v.remainder, '^IMAP session complete, \\\\(([0-9]+) bytes\\\\)$')) then
    set_collected_field('', 'bytes', $1);

  # Parse SMTP sender line
  else if (matches_regular_expression(v.remainder, '^--> 250 <([^>]+)>, Sender ok$')) then
    set_collected_field('', 'sender', $1);

  # Parse SMTP sender line
  else if (matches_regular_expression(v.remainder, '^<-- (EHLO|HELO) (.*)$')) then
    set_collected_field('', 'source_hostname', $1);
    
  # Parse SMTP sender line
  else if (matches_regular_expression(v.remainder, '^--> 250 <([^>]+)>, Recipient ok$')) then
    set_collected_field('', 'recipient', $1);

  # set event type for SMTP messages
  else if (matches_regular_expression(v.remainder, '^(Message) creation successful: [^$]+$')) then
    set_collected_field('', 'event_type', $1);
    
  # Parse POP connection line
  else if (matches_regular_expression(v.remainder, '^(Socket) (connection) established \(([0-9.]+) : ([0-9]+) -> [0-9.]+ : [0-9]+\)$')) then (
    set_collected_field('', 'protocol', $1);
    set_collected_field('', 'event_type', $2);
    set_collected_field('', 'source_ip', $3);
    set_collected_field('', 'source_port', $4);
  );

  # Parse POP USER line
  else if (matches_regular_expression(v.remainder, '^<-- USER ([^$]+)$')) then
    set_collected_field('', 'username', $1);

  # Parse session complete bytes line
  else if (matches_regular_expression(v.remainder, '^(SMTP|POP) session (complete|successful) \\\\(Bytes in/out: ([0-9]+)/([0-9]+)\\\\)$')) then (
    set_collected_field('', 'bytes_received', $1);
    set_collected_field('', 'bytes_sent', $2);
  );

  # Accept lines
  else if (matches_regular_expression(v.remainder, '^(SMTP|POP|IMAP) session (complete|successful)')) then
    accept_collected_entry('', false);

  ##
  ## CONTENT FILTERING
  ##

  else if (matches_regular_expression(v.remainder, '^[*] Message from: (.*)$')) then
    set_collected_field('', 'sender', $1);

  else if (matches_regular_expression(v.remainder, '^[*] Message to: (.*)$')) then
    set_collected_field('', 'recipient', $1);

  else if (matches_regular_expression(v.remainder, '^[*] Message subject: (.*)$')) then
    set_collected_field('', 'subject', $1);

  else if (matches_regular_expression(v.remainder, '^End of (Content Filter) results$')) then (
    set_collected_field('', 'event_type', $1);
    set_collected_field('', 'messages_filtered', 1);
    accept_collected_entry('', false);
  );

);
`


  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    source_ip = {
      suppress_top = 0
      suppress_bottom = 2
    } # source_ip
    
    source_port = ""
    source_hostname = ""
    protocol = ""
    username = ""
    recipient = ""
    sender = ""
    subject = ""

  } # database.fields

  database.numerical_fields = {

    events = {
      default = true
      requires_log_field = false
      entries_field = true
    } # events

    connections = ""
    messages = ""
    bytes = {
      type = "float"
      display_format_type = "bandwidth"
    } # bytes

    messages_filtered = ""    

  } # database.numerical_fields


  log.filters = {
  
    1 = {
      label = '1'
      comment = '1'
      value = "if (protocol eq 'Socket') then protocol = 'MultiPOP';"
    } # 1    


    2 = {
      label = '2'
      comment = '2'
      value = "if (bytes eq '(empty)') then bytes = bytes_received + bytes_sent;"
    } # 2    

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = "if (event_type eq 'connection') then connections = 1 else if (event_type eq 'Message') then messages = 1; events = 1;"
    } # mark_entry
    
  } # log.filters

  create_profile_wizard_options = {
    date_time_tracking = true

    # This shows which numerical fields are related to which non-numerical fields.
    database_field_associations = {

      username = {
        events = true
        connections = true
        bytes = true
      }

    }

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      source_ip = true
      source_port = true
      source_hostname = true
      protocol = true
      username = true
      recipient = true
      sender = true
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
    visitors = true
    sessions = true
    pageviews = true
    individualhosts = true
  } # not_supported

} # mdaemon8_all