# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
microsoft_exchange_2000_csv = {

  info.0.manfacturer = "Microsoft"
  info.0.device = "Exchange 2000"
  info.0.version = "2000"

  # 01/Sep/2006 - MSG - parsing filters were edited to support extra spaces in the "To" and "From" lines, which occur in front of the words "To" and "From". These spaces are 
  # inconsistent from line to line. 

  # The name of the log format
  log.format.format_label = "Microsoft Exchange Server 2000 Log Format (comma separated)"
  log.miscellaneous.log_data_type = "mail_server"
  log.miscellaneous.log_format_type = "mail_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+, [^,]+, [0-9]+/[0-9]+/[0-9][0-9][0-9][0-9], [0-9]+:[0-9][0-9]:[0-9][0-9], [^,]+, [^,]+, [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, (EHLO|HELO|MAIL|RCPT|DATA), "

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # The format of dates and times in this log
  log.format.date_format = "auto"
  log.format.time_format = "auto"

  # Log fields
  log.fields = {

    client_ip = {
      label = "$lang_stats.field_labels.client_ip"
      type = "host"
      index = 0
      subindex = 0
      hierarchy_dividers = "."
      left_to_right = false
      leading_divider = "false"
    } # client_ip

    server_domain = {
      label = "$lang_stats.field_labels.server_domain"
      type = "flat"
      index = 0
      subindex = 0
    } # server_domain

    date = {
      label = "$lang_stats.field_labels.date"
      type = "date"
      index = 0
      subindex = 0
      hierarchy_dividers = ""
      left_to_right = false
      leading_divider = "false"
    } # date

    time = {
      label = "$lang_stats.field_labels.time"
      type = "time"
      index = 0
      subindex = 0
      hierarchy_dividers = ""
      left_to_right = false
      leading_divider = "false"
    } # time

    service = {
      label = "$lang_stats.field_labels.service"
      type = "flat"
      index = 0
      subindex = 0
    } # service

    server_hostname = {
      label = "$lang_stats.field_labels.server_hostname"
      type = "flat"
      index = 0
      subindex = 0
    } # server_hostname

    server_ip = {
      label = "$lang_stats.field_labels.server_ip"
      type = "flat"
      index = 0
      subindex = 0
    } # server_ip

    sc_bytes = {
      label = "$lang_stats.field_labels.sc_bytes"
      type = "size"
      index = 0
      subindex = 0
    } # sc_bytes

    cs_bytes = {
      label = "$lang_stats.field_labels.cs_bytes"
      type = "flat"
      index = 0
      subindex = 0
    } # cs_bytes

    from = {
      label = "$lang_stats.field_labels.from"
      type = "hierarchical"
      index = 0
      subindex = 0
      hierarchy_dividers = "@"
      left_to_right = false
      leading_divider = false
    } # from

    to = {
      label = "$lang_stats.field_labels.to"
      type = "hierarchical"
      index = 0
      subindex = 0
      hierarchy_dividers = "@"
      left_to_right = false
      leading_divider = false
    } # to

    message = {
      label = "$lang_stats.field_labels.message"
      type = "flat"
    } # message

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters = {

    parse = {
      label = "parse"
      comment = ""
      value = "
if (matches_regular_expression(current_log_line(), '^([^,]+), ([^,]+), ([0-9/]+), ([0-9:]+), ([^,]+), ([^,]+), ([^,]+), [0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, MAIL, [^,]+, +[Ff][Rr][Oo][Mm]:[^<]*<([^<]*)>')) then (
  set_collected_field($1, 'client_ip', $1);
  set_collected_field($1, 'server_domain', $2);
  set_collected_field($1, 'date', $3);
  set_collected_field($1, 'time', $4);
  set_collected_field($1, 'service', $5);
  set_collected_field($1, 'server_hostname', $6);
  set_collected_field($1, 'server_ip', $7);
  set_collected_field($1, 'from', $8);
)
else if (matches_regular_expression(current_log_line(), '^([^,]+), [^,]+, [0-9/]+, [0-9:]+, [^,]+, [^,]+, [^,]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, RCPT, [^,]+, +[Tt][Oo]:[^<]*<([^<]*)>')) then
  set_collected_field($1, 'to', $2);
else if (matches_regular_expression(current_log_line(), '^([^,]+), [^,]+, [0-9/]+, [0-9:]+, [^,]+, [^,]+, [^,]+, [0-9]+, ([0-9]+), ([0-9]+), [0-9]+, [0-9]+, DATA,')) then (
  set_collected_field($1, 'sc_bytes', $2);
  set_collected_field($1, 'cs_bytes', $3);
  accept_collected_entry($1, true);
)

# Handle 4xx and 5xx messages (errors)
else if (matches_regular_expression(current_log_line(), '^([^,]+), ([^,]+), ([0-9/]+), ([0-9:]+), ([^,]+), ([^,]+), ([^,]+), [0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, -, -, ([45].*)$')) then (
  set_collected_field('', 'client_ip', $1);
  set_collected_field('', 'server_domain', $2);
  set_collected_field('', 'date', $3);
  set_collected_field('', 'time', $4);
  set_collected_field('', 'service', $5);
  set_collected_field('', 'server_hostname', $6);
  set_collected_field('', 'server_ip', $7);
  set_collected_field('', 'message', $8);
  accept_collected_entry('', true);
)
"
    } # parse

  } # log.parsing_filters


  # Database fields
  database.fields = {

    date_time = {
      label = "$lang_stats.field_labels.date_time"
      log_field = "date_time"
      type = "string"
      suppress_top = 0
      suppress_bottom = 3
      display_format_type = "date_time"
    } # date_time

    day_of_week = {
      label = "$lang_stats.field_labels.day_of_week"
      log_field = "day_of_week"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
      display_format_type = "day_of_week"
    } # day_of_week

    hour_of_day = {
      label = "$lang_stats.field_labels.hour_of_day"
      log_field = "hour_of_day"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
      display_format_type = "hour_of_day"
    } # hour_of_day

    client_ip = {
      label = "$lang_stats.field_labels.client_ip"
      log_field = "client_ip"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
      display_format_type = "hostname"
    } # client_ip

    domain_description = {
      label = "$lang_stats.field_labels.domain_description"
      log_field = "domain_description"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # domain_description

    location = {
      label = "$lang_stats.field_labels.location"
      log_field = "location"
      type = "string"
      suppress_top = 0
      suppress_bottom = 3
    } # location

    service = {
      label = "$lang_stats.field_labels.service"
      log_field = "service"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # service

    server_domain = {
      label = "$lang_stats.field_labels.server_domain"
      log_field = "server_domain"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # server_domain

    server_hostname = {
      label = "$lang_stats.field_labels.server_hostname"
      log_field = "server_hostname"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # server_hostname

    server_ip = {
      label = "$lang_stats.field_labels.server_ip"
      log_field = "server_ip"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # server_ip

    from = {
      label = "$lang_stats.field_labels.from"
      log_field = "from"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # from

    to = {
      label = "$lang_stats.field_labels.to"
      log_field = "to"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # to

    message = {
      label = "$lang_stats.field_labels.message"
      log_field = "message"
      type = "string"
    } # message

  } # database.fields


  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry
  } # log.filters


  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    sc_bytes = {
      label = "$lang_stats.field_labels.sc_bytes"
      default = false
      requires_log_field = true
      log_field = "sc_bytes"
      type = "float"
      display_format_type = "bandwidth"
    } # sc_bytes

    cs_bytes = {
      label = "$lang_stats.field_labels.cs_bytes"
      default = false
      requires_log_field = true
      log_field = "cs_bytes"
      type = "float"
      display_format_type = "bandwidth"
    } # cs_bytes

  } # database.numerical_fields


  create_profile_wizard_options = {
    date_time_tracking = true
    host_tracking = true

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      from = true
      to = true
      client_information_group = {
        client_ip = true
        domain_description = true
        location = true
      }
      server_group = {
        service = true
        server_domain = true
        server_hostname = true
        server_ip = true
      }
      message = true
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
    visitors = true
    sessions = true
    pageviews = true
    individualhosts = true
  } # not_supported

} # microsoft_exchange_2000_csv