# Copyright (c) 2012 Flowerfire, Inc.  All Rights Reserved.
rumpus_ftp = {

  plugin_version = "1.0"

  # 2012-08-11 - 1.0 - GMF - Initial profile creation

  info.1.manufacturer = "Maxum Development"
  info.1.device = "Rumpus FTP"
  info.1.version.1 = ""

  # The name of the log format
  log.format.format_label = "Rumpus FTP Log Format"
  log.miscellaneous.log_data_type = "ftp"  
  log.miscellaneous.log_format_type = "ftp_server"

  # The log is in this format if any of the first ten lines match this regular expression
  # [02/Sep/2012:00:24:30 CDT]	128.135.83.93		USER flowuser
  log.format.autodetect_regular_expression = "^[[][0-9][0-9]/[A-Z][a-z][a-z]/[0-9][0-9][0-9][0-9]:[0-9][0-9]:[0-9][0-9]:[0-9][0-9] [^]]+[]]	"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    date = ""
    time = ""
    client_ip = ""
    username = ""
    operation = ""
    directory = ""
    filename = ""

    events = ""
    logins = ""
    uploads = ""
    downloads = ""

  } # log.fields


  log.parsing_filters.parse = `
if (matches_regular_expression(current_log_line(), '^[[]([0-9][0-9]/[A-Z][a-z][a-z]/[0-9][0-9][0-9][0-9]):([0-9][0-9]:[0-9][0-9]:[0-9][0-9]) [^]]+[]]	([^	]+)	([^	]*)	(.*)$')) then (

  set_collected_field('', 'date', $1);
  set_collected_field('', 'time', $2);
  set_collected_field('', 'client_ip', $3);
  set_collected_field('', 'username', $4);

  v.message = $5;

  set_collected_field('', 'events', 1);

  if (matches_regular_expression(v.message, "^([A-Z]+) ")) then
    set_collected_field('', 'operation', $1);

  # [02/Sep/2012:00:24:30 CDT]      128.135.83.93           USER flowuser
  if (matches_regular_expression(v.message, "^USER (.*)$")) then (
    set_collected_field('', 'username', $1);
    set_collected_field('', 'logins', 1);
    accept_collected_entry('', false);
  );

  # [02/Sep/2012:00:24:30 CDT]      128.135.83.93   flowuser        CWD /Abc-R123
  else if (matches_regular_expression(v.message, "^CWD (.*)$")) then (
    set_collected_field('', 'directory', $1);
    accept_collected_entry('', false);
  );

  # [02/Sep/2012:00:24:30 CDT]      128.135.83.93   flowuser        STOR File.fcs
  else if (matches_regular_expression(v.message, "^STOR (.*)$")) then (
    set_collected_field('', 'filename', $1);
    set_collected_field('', 'uploads', 1);
    accept_collected_entry('', false);
  );

  # No example; assuming GET is same as STOR
  else if (matches_regular_expression(v.message, "^GET (.*)$")) then (
    set_collected_field('', 'filename', $1);
    set_collected_field('', 'downloads', 1);
    accept_collected_entry('', false);
  );

);

`

  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    client_ip = ""
    username = ""
    operation = ""
    directory = ""
    filename = ""

  } # database.fields


  # Log Filters
  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  log.field_options = {

    sessions_page_field = "filename"
    sessions_visitor_id_field = "username"
    sessions_event_field = "events"

  } # log.field_options


  database.numerical_fields = {

    events = {
      default = true
      entries_field = true
    } # events

    uploads = {
      default = true
    }

    downloads = {
      default = true
    }

    unique_users = {
      type = "unique"
      log_field = "username"
    }

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # rumpus_ftp