# Copyright (c) 2010 Flowerfire, Inc. All Rights Reserved. mail_max_sesmtp = { plugin_version = "1.1.1" # 2007-11-02 - 1.1 - KBB - changed field error to error_messages - fixes bug caused by # recent UI change where fields cannot have the same names as Salang functions # 2011-06-22 - 1.0.1 - MSG - Edited info lines. info.1.manufacturer = "SmartMax" info.1.device = "MailMax SE SMTP" info.1.version.1 = "" # The name of the log format log.format.format_label = "MailMax SE SMTP Log Format" log.miscellaneous.log_data_type = "mail_smtp" log.miscellaneous.log_format_type = "mail_server" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^[0-9][0-9]/[0-9][0-9]/[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9] +[0-9]* *SMTP *[A-Z]* *[0-9.]* *[0-9.]* .* *$" statistics.miscellaneous.entry_name = "events" # The format of dates and times in this log log.format.date_format = "mm/dd/yy" log.format.time_format = "hh:mm:ss" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { date = { label = "$lang_stats.field_labels.date" type = "date" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # date time = { label = "$lang_stats.field_labels.time" type = "time" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # time server_ip = { label = "$lang_stats.field_labels.server_ip" type = "flat" index = 0 subindex = 0 } # server_ip source_address = { label = "$lang_stats.field_labels.source_address" type = "flat" index = 0 subindex = 0 } # source_address destination_address = { label = "$lang_stats.field_labels.destination_address" type = "flat" index = 0 subindex = 0 } # destination_address size = { label = "$lang_stats.field_labels.size" type = "size" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # size source_ip = { label = "$lang_stats.field_labels.source_ip" type = "flat" index = 0 subindex = 0 } # source_ip error_message = { label = "$lang_stats.field_labels.error_message" type = "flat" index = 0 subindex = 0 } # error_message } # log.fields # Log Parsing Filters log.parsing_filters = { # Parse out the *KEY*, source address , on the DATA line 1 = { label = "1" comment = "" value = "collect_fields_using_regexp('^[0-9/]* [0-9:]* *([0-9]*) *SMTP *DATA *[0-9.]* *[0-9.]* mail from: *<*(.*)>*$', '*KEY*,source_address')" } # 1 # Parse out the *KEY*, source address, size on the DATA line 2 = { label = "2" comment = "" value = "collect_fields_using_regexp('^[0-9/]* [0-9:]* *([0-9]*) *SMTP *DATA *[0-9.]* *[0-9.]* mail from: *<*(.*)>* size=([0-9]*)$', '*KEY*,source_address,size')" } # 2 # Parse out the *KEY*, destination address on the DATA line 3 = { label = "3" comment = "" value = "collect_fields_using_regexp('^[0-9/]* [0-9:]* *([0-9]*) *SMTP *DATA *[0-9.]* *[0-9.]* rcpt to: *<*(.*)>*$', '*KEY*,destination_address')" } # 3 # Parse out the *KEY*, date,time,server IP,sourceIP,size on the DATA line 4 = { label = "4" comment = "" value = "collect_fields_using_regexp('^([0-9/]*) ([0-9:]*) *([0-9]*) *SMTP *DATA *([0-9.]*) *([0-9.]*) ([0-9]*) bytes received$', 'date,time,*KEY*,server_ip,source_ip,size')" } # 4 # Parse out the *KEY*, message on the ERRO line 5 = { label = "5" comment = "" value = "collect_fields_using_regexp('^([0-9/]*) ([0-9:]*) *([0-9]*) *SMTP *ERRO *([0-9.]*) *([0-9.]*) (.*)$', 'date,time,*KEY*,server_ip,source_ip,error_message')" } # 5 # Accept a collected field when there is a bytes received line 6 = { label = "6" comment = "" value = "accept_collected_entry_using_regexp('^[0-9/]* [0-9:]* *([0-9]*) *SMTP *DATA *[0-9.]* *[0-9.]* [0-9]* bytes received.*$', false)" } # 6 # Accept a collected field when there is a bytes received line 7 = { label = "7" comment = "" value = "accept_collected_entry_using_regexp('^[0-9/]* [0-9:]* *([0-9]*) *SMTP *ERRO *[0-9.]* *[0-9.]* .*$', false)" } # 7 } # log.parsing_filters # Database fields database.fields = { date_time = { label = "$lang_stats.field_labels.date_time" log_field = "date_time" type = "string" suppress_top = 0 suppress_bottom = 3 display_format_type = "date_time" } # date_time day_of_week = { label = "$lang_stats.field_labels.day_of_week" log_field = "day_of_week" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "day_of_week" } # day_of_week hour_of_day = { label = "$lang_stats.field_labels.hour_of_day" log_field = "hour_of_day" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "hour_of_day" } # hour_of_day server_ip = { label = "$lang_stats.field_labels.server_ip" log_field = "server_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # server_ip source_ip = { label = "$lang_stats.field_labels.source_ip" log_field = "source_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # source_ip source_address = { label = "$lang_stats.field_labels.source_address" log_field = "source_address" type = "string" suppress_top = 0 suppress_bottom = 2 } # source_address destination_address = { label = "$lang_stats.field_labels.destination_address" log_field = "destination_address" type = "string" suppress_top = 0 suppress_bottom = 2 } # destination_address error_message = { label = "$lang_stats.field_labels.error_message" log_field = "error" type = "string" suppress_top = 0 suppress_bottom = 2 } # error_message } # database.fields database.numerical_fields = { events = { label = "$lang_stats.field_labels.events" default = true requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # events size = { label = "$lang_stats.field_labels.size" default = false requires_log_field = true log_field = "size" type = "int" integer_bits = 64 display_format_type = "bandwidth" } # size } # database.numerical_fields log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'events = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { date_time_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" server_ip = true source_ip = true source_address = true destination_address = true error_message = true } # report_groups } # create_profile_wizard_options not_supported = { individualhosts = true sessions = true visitors = true pageviews = true } # not_supported } # mail_max_sesmtp