# Copyright (c) 2010 Flowerfire, Inc. All Rights Reserved. kerio_network_monitor_http = { plugin_version = "1.0.1" # Initial creation - 1.0 # 2011-03-30 - 1.0.1 - MSG - Edited info lines. info.1.manufacturer = "Kerio" info.1.device = "Network Monitor HTTP" info.1.version.1 = "" # Kerio Network Monitor log # The name of the log format log.format.format_label = "Kerio Network Monitor HTTP Log Format" log.miscellaneous.log_data_type = "network" log.miscellaneous.log_format_type = "network_device" # The log is in this format if any of the first ten lines match this regular expression # log.format.autodetect_regular_expression = "^[0-9]* [^:]*:[^EI]*[EI][0-9.]*:[0-9]* ->[^EI]*[EI][0-9.]*/[0-9.]*:[0-9]*[^0-9]*[0-9]* \\+ [0-9]*By,[^0-9]*[0-9]*s[^-]*- [^:]*: [0-9.]*" log.format.autodetect_regular_expression = "^ [^\d]*[0-9.]* [^ ]* T[0-9]*-[0-9]* [A-Z]* [^ ]* [A-Z/]*[0-9.]* [0-9]* [0-9]*$" # The format of dates and times in this log log.format.date_format = "seconds_since_jan1_1970" log.format.time_format = "seconds_since_jan1_1970" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { source_ip = { label = "$lang_stats.field_labels.source_ip" type = "host" index = 0 subindex = 0 hierarchy_dividers = "." left_to_right = false leading_divider = "false" } # source_ip date_time = { label = "$lang_stats.field_labels.date_time" type = "date_time" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # date_time page = { label = "$lang_stats.field_labels.page" type = "page" index = 0 subindex = 0 hierarchy_dividers = "/?" left_to_right = true leading_divider = "true" } # page operation = { label = "$lang_stats.field_labels.operation" type = "flat" index = 0 subindex = 0 } # operation protocol = { label = "$lang_stats.field_labels.protocol" type = "flat" index = 0 subindex = 0 } # protocol server_response = { label = "$lang_stats.field_labels.server_response" type = "response" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # server_response size = { label = "$lang_stats.field_labels.size" type = "size" index = 0 subindex = 0 } # size message = { label = "$lang_stats.field_labels.message" type = "flat" index = 0 subindex = 0 } # message result = { label = "$lang_stats.field_labels.result" type = "flat" index = 0 subindex = 0 } # result } # log.fields log.parsing_filters = { # Parse each line without msg field 1 = { label = "1" comment = "" value = "collect_fields_using_regexp('^() [^\d]*([0-9.]*) [^ ]* T([0-9]*)-[0-9]* ([A-Z]*) ([^ ]*) ([A-Z/]*[0-9.]*) ([0-9]*) ([0-9]*) ([^$]+)$', '*KEY*,source_ip,date_time,operation,page,protocol,server_response,size,result')" } # 1 # Parse each line with msg field 2 = { label = "2" comment = "" value = "collect_fields_using_regexp('^() [^\d]*([0-9.]*) [^ ]* T([0-9]*)-[0-9]* ([A-Z]*) ([^ ]*) ([A-Z/]*[0-9.]*) ([0-9]*) ([0-9]*) \\(([^)]+)\\) ([^$]+)$', '*KEY*,source_ip,date_time,operation,page,protocol,server_response,size,message,result')" } # 2 # Parse each line without msg and result field 3 = { label = "3" comment = "" value = "collect_fields_using_regexp('^() [^\d]*([0-9.]*) [^ ]* T([0-9]*)-[0-9]* ([A-Z]*) ([^ ]*) ([A-Z/]*[0-9.]*) ([0-9]*) ([0-9]*)$', '*KEY*,source_ip,date_time,operation,page,protocol,server_response,size')" } # 3 # Accept a collected line 4 = { label = "4" comment = "" value = 'accept_collected_entry_using_regexp("()", false)' } # 4 } # log.parsing_filters # Database fields database.fields = { date_time = { label = "$lang_stats.field_labels.date_time" log_field = "date_time" type = "string" suppress_top = 0 suppress_bottom = 3 display_format_type = "date_time" } # date_time day_of_week = { label = "$lang_stats.field_labels.day_of_week" log_field = "day_of_week" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "day_of_week" } # day_of_week hour_of_day = { label = "$lang_stats.field_labels.hour_of_day" log_field = "hour_of_day" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "hour_of_day" } # hour_of_day page = { label = "$lang_stats.field_labels.page" log_field = "page" type = "string" suppress_top = 1 suppress_bottom = 3 } # page source_ip = { label = "$lang_stats.field_labels.source_ip" log_field = "source_ip" type = "string" suppress_top = 0 suppress_bottom = 3 } # source_ip protocol = { label = "$lang_stats.field_labels.protocol" log_field = "protocol" type = "string" suppress_top = 0 suppress_bottom = 2 } # protocol operation = { label = "$lang_stats.field_labels.operation" log_field = "operation" type = "string" suppress_top = 0 suppress_bottom = 2 } # operation file_type = { label = "$lang_stats.field_labels.file_type" log_field = "file_type" type = "string" suppress_top = 0 suppress_bottom = 2 } # file_type worm = { label = "$lang_stats.field_labels.worm" log_field = "worm" type = "string" suppress_top = 0 suppress_bottom = 2 } # worm protocol = { label = "$lang_stats.field_labels.protocol" log_field = "protocol" type = "string" suppress_top = 0 suppress_bottom = 2 } # protocol server_response = { label = "$lang_stats.field_labels.server_response" log_field = "server_response" type = "string" suppress_top = 0 suppress_bottom = 2 } # server_response message = { label = "$lang_stats.field_labels.message" log_field = "message" type = "string" suppress_top = 0 suppress_bottom = 2 } # message result = { label = "$lang_stats.field_labels.result" log_field = "result" type = "string" suppress_top = 0 suppress_bottom = 2 } # result } # database.fields database.numerical_fields = { hits = { label = "$lang_stats.field_labels.hits" default = false requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # hits page_views = { label = "$lang_stats.field_labels.page_views" default = true requires_log_field = false type = "int" display_format_type = "integer" } # page_views visitors = { label = "$lang_stats.field_labels.visitors" default = false requires_log_field = true log_field = "browsing_host" type = "unique" display_format_type = "integer" } # visitors size = { label = "$lang_stats.field_labels.size" default = false requires_log_field = true log_field = "size" type = "int" integer_bits = 64 display_format_type = "bandwidth" } # size } # database.numerical_fields log.filters = { set_page_for_worm = { label = "$lang_admin.log_filters.set_page_for_worm_label" comment = "$lang_admin.log_filters.set_page_for_worm_comment" value = "if (starts_with(worm, '(')) then '' else page = '(worm)';" } # set_page_for_worm remove_query = { label = "$lang_admin.log_filters.remove_query_label" comment = "$lang_admin.log_filters.remove_query_comment" value = "if (contains(page, '?')) then page = substr(page, 0, index(page, '?') + 1) . '(parameters)';" } # remove_query detect_page_views = { label = '$lang_admin.log_filters.detect_page_views_label' comment = '$lang_admin.log_filters.detect_page_views_comment' value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;" } # detect_page_views strip_non_page_views = { label = '$lang_admin.log_filters.strip_non_page_views_label' comment = '$lang_admin.log_filters.strip_non_page_views_comment' value = "if (page_views == 0) then page = substr(page, 0, last_index(page, '/') + 1) . '(nonpage)';" } # strip_non_page_views mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'hits = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { date_time_tracking = true host_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" page = true source_ip = true file_type = true worm = true operation = true protocol = true server_response = true message = true result = true } # report_groups } # create_profile_wizard_options not_supported = { } # not_supported } # kerio_network_monitor_http