beta_eims_smtp_24 = { # version 0.0 # v6 - This format was created from Eudora Internet Mail Server 3 logs. http://www.eudora.com/eims/ # version 1.0Beta # v7 conversion to single parsing expression and adding new format line support (date string has changed and auth user dropped (kept to support both formats), example: # from bob@mydomain.com Mo, 6. Jun 2005 17:03:13 Uhr +0200 119793 internal ELEAKPLJLJNPOBPHGDMPGEOJCBAA.bob@mydomain.com # The name of the log format log.format.format_label = "EIMS SMTP (24 hour) Log Format" log.miscellaneous.log_data_type = "mail_smtp" log.miscellaneous.log_format_type = "mail_server" plugin_version = "1.0beta" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^from [^ ]+ ([A-Z][a-z][a-z], [A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9]|[A-Z][a-z], [0-9]*\\. [A-Z][a-z][a-z] [0-9]*) [0-9]+:[0-9][0-9]:[0-9][0-9] [UuHhRr ]*[+0-9-]* [0-9]*" statistics.miscellaneous.entry_name = "messages" # The format of dates and times in this log log.format.date_format = "dd/mmm/yyyy" log.format.time_format = "hh:mm:ss" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { authenticated_user = "" date = "" time = "" size = "" source_ip = "" destination_ip = "" from = { type = "hierarchical" hierarchy_dividers = "@" left_to_right = false leading_divider = false } # from to = { type = "hierarchical" hierarchy_dividers = "@" left_to_right = false leading_divider = false } # to sent = "" } # log.fields # Log Parsing Filters log.parsing_filters.parse = ` # Line type 1.0Beta "from" if (matches_regular_expression(current_log_line(), '^from ([^ ]+) [A-Z][a-z], ([0-9]+)\\. ([A-Z][a-z][a-z]) ([0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [UuHhRr ]*[+0-9-]* ([0-9]*) (internal|external) (.*)$')) then ( set_collected_field('', 'from', $1); v.day = $2; if (length(v.day) == 1) then (v.day = '0' . v.day); set_collected_field('', 'date', v.day . '/' . $3 . '/' . $4); set_collected_field('', 'time', $5); set_collected_field('', 'size', $6); set_collected_field('', 'source_ip', $7); ); # Line type 1.0Beta "sent" else if (matches_regular_expression(current_log_line(), '^sent ([^ ]+) [A-Z][a-z], ([0-9]+)\\. ([A-Z][a-z][a-z]) ([0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [UuHhRr ]*[+-][0-9]+ ([0-9]+) ([0-9.]+) (.*)$')) then ( set_collected_field('', 'sent', $1); v.day = $2; if (length(v.day) == 1) then (v.day = '0' . v.day); set_collected_field('', 'date', v.day . '/' . $3 . '/' . $4); set_collected_field('', 'time', $5); set_collected_field('', 'size', $6); set_collected_field('', 'destination_ip', $7); ); # Line type 0.0 "from" else if (matches_regular_expression(current_log_line(), '^from ([^ ]+) *\\\\(*([^)]*)\\\\)* [A-Z][a-z][a-z], ([A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [+-][0-9]+ ([0-9]+) ([0-9.]+) .*$')) then ( set_collected_field('', 'from', $1); set_collected_field('', 'authenticated_user', $2); set_collected_field('', 'date', $3); set_collected_field('', 'time', $4); set_collected_field('', 'size', $5); set_collected_field('', 'source_ip', $6); ); # Line type 0.0 "sent" else if (matches_regular_expression(current_log_line(), '^sent ([^ ]+) *\\\\(*([^)]*)\\\\)* [A-Z][a-z][a-z], ([A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [+-][0-9]+ ([0-9]+) ([0-9.]+) [^$]+$')) then ( set_collected_field('', 'sent', $1); set_collected_field('', 'authenticated_user', $2); set_collected_field('', 'date', $3); set_collected_field('', 'time', $4); set_collected_field('', 'size', $5); set_collected_field('', 'destination_ip', $6); ); # Line "to" else if (matches_regular_expression(current_log_line(), 'to ([^ ]+) *$')) then ( set_collected_field('', 'to', $1); accept_collected_entry('', false); ); ` # Database fields database.fields = { date_time = "" day_of_week = "" hour_of_day = "" from = "" to.suppress_bottom = "1" sent = "" authenticated_user = "" source_ip = "" destination_ip = "" } # database.fields database.numerical_fields = { messages = { default = true requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # messages size = { default = false requires_log_field = true log_field = "size" type = "int" integer_bits = 64 display_format_type = "bandwidth" } # size } # database.numerical_fields log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'messages = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" } # report_groups } # create_profile_wizard_options } # beta_eims_smtp_24