# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
whg = {

  plugin_version = "1.0"

  # 2009-05-01 - 1.0 - GMF - initial creation

  # The name of the log format
  log.format.format_label = "4ipnet WHG Log Format"
  log.miscellaneous.log_data_type = "syslog_required"  
  log.miscellaneous.log_format_type = "network_device"

  info.1.manfacturer = "4ipnet"
  info.1.device = "WHG"
  info.1.version.1 = "501"

  # The log is in this format if any of the first ten lines match this regular expression
  # Apr 14 12:28:01 12.34.56.78 Log:  [New]abc123@pop3 UDP MAC=00:11:22:33:44:55 SIP=98.76.54.32 SPort=1913 DIP=23.45.67.89 DPort=7001
  log.format.autodetect_regular_expression = "Log:  [[]New[]][^ ]+ [^ ]+ "

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    user = ""
    protocol = ""
    mac = ""
    sip.type = "host"
    sport = ""
    dip = ""
    dport = ""

    events = ""

  } # log.fields


  # Log Parsing Filters
  log.parsing_filters.parse = `
if (matches_regular_expression(v.syslog_message, "^Log:  [[][^]]+[]]([^ ]+) ([^ ]+) MAC=([^ ]+) SIP=([^ ]+) SPort=([^ ]+) DIP=([^ ]+) DPort=([^ ]+)")) then (
  set_collected_field('', 'user', $1);
  set_collected_field('', 'protocol', $2);
  set_collected_field('', 'mac', $3);
  set_collected_field('', 'sip', $4);
  set_collected_field('', 'sport', $5);
  set_collected_field('', 'dip', $6);
  set_collected_field('', 'dport', $7);
  accept_collected_entry('', false);
);
`


  # Database fields
  database.fields = {

    user = ""
    protocol = ""
    mac = ""
    sip = ""
    location = ""
    sport = ""
    dip = ""
    dport = ""

  } # database.fields


  # Log Filters
  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters


  database.numerical_fields = {

    events = {
      requires_log_field = false
      default = true
      entries_field = true
    } # events

    unique_source_ips = {
      log_field = "sip"
      type = "unique"
    } # unique_source_ips

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # whg