# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
unix_daemon_messages = {

  plugin_version = "1.0"

  info.1.manfacturer = "Sun"
  info.1.device = "Solaris Daemon Syslog Messages"
  info.1.version.1 = "Solaris 7"
  info.1.version.2 = "Solaris 8"
  info.1.version.3 = "Solaris 9"

  info.2.manfacturer = "RedHat"
  info.2.device = "RedHat Linux Daemon Syslog Messages"
  info.2.version.1 = "RedHat 7"
  info.2.version.2 = "RedHat 8"

  info.3.manfacturer = "The Fedora Project"
  info.3.device = "Fedora Linux Daemon Syslog Messages"
  info.3.version.1 = "Fedora Core 2"
  info.3.version.2 = "Fedora Core 3"

  info.4.manfacturer = "Cellopoint"
  info.4.device = "CelloOS Daemon Syslog Messages"
  info.4.version = "CelloOS 2"

  # 2007-11-20 - 1.0 - KBB - Initial creation
  # 2009-03-09 - 1.1 - gas - added support for variant (with syslog-ng messages):
  #                        - " Mar 5 10:55:56 syslog syslog-ng[16548]: syslog-ng starting up; version='3.0.1'"

  # The name of the log format
  log.format.format_label = "Unix Daemon Syslog Messages Log Format"
  log.miscellaneous.log_data_type = "syslog_required"  
  log.miscellaneous.log_format_type = "syslog_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "[ 	]([A-Za-z()_-]+\\[[0-9]*\\]:|[a-z]+: \\[ID [0-9]+ [a-z]+\\.[a-z]+\\]) "
  log.format.autodetect_lines = "100"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    daemon = ""
    pid = ""
    daemon_message = ""
    system_message = ""

  } # log.fields

  # Log Parsing Filters
  log.parsing_filters.parse = `
  
# Strip date from 2nd syslog entry - date may be corrupted like this 'ct 24 00:03:46'
if (matches_regular_expression(v.syslog_message, '[a-zA-Z]{1,3} [0-9 ]?[0-9] [0-9]{2}:[0-9]{2}:[0-9]{2}[ 	]+(.*$)')) then (
  v.syslog_message = $1;
);

# Look for standard patterns
if (matches_regular_expression(v.syslog_message, '[ 	]*([A-Za-z()_-]+)\\\\[([0-9]*)\\\\]: (.*)$')) then (
  set_collected_field('', 'daemon', $1);
  set_collected_field('', 'pid', $2);
  v.message = $3;

  #CROND[3784]: (root) CMD (/usr/bin/doit /etc/doit/doit.cfg)
  # A line like this will behave like a parenthesized item
  if (starts_with(v.message, '(')) then (
    v.message = ' ' . v.message;
  );

  set_collected_field('', 'daemon_message', v.message);
);

else (
  set_collected_field('', 'system_message', v.syslog_message);
);

accept_collected_entry('', false);
`

  # Database fields
  database.fields = {

    daemon = ""
    pid = ""
    daemon_message = ""
    system_message = ""

  } # database.fields

  database.numerical_fields = {

    messages = {
      default = true
      requires_log_field = false
      entries_field = true
    } # messages

  } # database.numerical_fields

  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'messages = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # unix_daemon_messages