# Copyright (c) 2010 Flowerfire, Inc. All Rights Reserved. eims_smtp_24 = { plugin_version = "1.2" # Initial creation - 1.0 - plug-in created - This format was created from Eudora Internet Mail Server 3 logs. http://www.eudora.com/eims/ # 2007-04-18 - 1.1 - gas - added support for new log format variant (v3.2?) # 2010-10-06 - 1.2 - MSG - Edited info lines. info.1.manufacturer = "Eudora" info.1.device = "Internet Mail Server 3.2" info.1.version.1 = "3.2" info.1.manufacturer = "Qualcomm" info.1.device = "Internet Mail Server 3.2" info.1.version.1 = "3.2" # The name of the log format log.format.format_label = "EIMS SMTP (24 hour) Log Format" log.miscellaneous.log_data_type = "mail_smtp" log.miscellaneous.log_format_type = "mail_server" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^from [^ ]+ [A-Z][a-z][a-z], [A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9] [0-9]+:[0-9][0-9]:[0-9][0-9] [+0-9-]* [0-9]* [0-9.]*" statistics.miscellaneous.entry_name = "messages" # The format of dates and times in this log log.format.date_format = "mmmmm/dd/yyyy" log.format.time_format = "hh:mm:ss" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { authenticated_user = { label = "$lang_stats.field_labels.authenticated_user" type = "flat" index = 0 subindex = 0 } # authenticated_user date = { label = "$lang_stats.field_labels.date" type = "date" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # date time = { label = "$lang_stats.field_labels.time" type = "time" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # time size = { label = "$lang_stats.field_labels.size" type = "size" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # size source_ip = { label = "$lang_stats.field_labels.source_ip" type = "flat" index = 0 subindex = 0 } # source_ip destination_ip = { label = "$lang_stats.field_labels.destination_ip" type = "flat" index = 0 subindex = 0 } # destination_ip from = { label = "$lang_stats.field_labels.from" type = "hierarchical" index = 0 subindex = 0 hierarchy_dividers = "@" left_to_right = false leading_divider = "false" } # from to = { label = "$lang_stats.field_labels.to" type = "hierarchical" index = 0 subindex = 0 hierarchy_dividers = "@" left_to_right = false leading_divider = "false" } # to sent = { label = "$lang_stats.field_labels.sent" type = "flat" index = 0 subindex = 0 } # sent } # log.fields # Log Parsing Filters log.parsing_filters = { # Parse from line from = { label = "from" comment = "Parse from line" value = "collect_fields_using_regexp('^()from ([^ ]+) *\\\\(*([^)]*)\\\\)* [A-Z][a-z][a-z], ([A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [+-][0-9]+ ([0-9]+) ([0-9.]+) [^$]+$', '*KEY*,from,authenticated_user,date,time,size,source_ip')" } # 1 # v1.1 # Parse from (alternate format) line: # from bob@mail-server.com Mon, Apr 16, 2007 16:59:32 +0100 5470 internal 11112313515111.JavaMail.Administrator@webmail alt_from = { label = "alt from" comment = "Parse alt from line" value = "collect_fields_using_regexp('^()from ([^ ]+) [A-Z][a-z][a-z], ([A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [+-][0-9]+ ([0-9]+) ([0-9.]+|internal) [^$]+$', '*KEY*,from,date,time,size,source_ip')" } # alt_from # Parse to line to = { label = "to" comment = "Parse to line" value = "collect_fields_using_regexp('^()to ([^ ]*) *$', '*KEY*,to')" } # to # Parse sent line sent = { label = "sent" comment = "Parse sent line" value = "collect_fields_using_regexp('^()sent ([^ ]+) *\\\\(*([^)]*)\\\\)* [A-Z][a-z][a-z], ([A-Z][a-z][a-z] [0-9]+, [0-9][0-9][0-9][0-9]) ([0-9]+:[0-9][0-9]:[0-9][0-9]) [+-][0-9]+ ([0-9]+) ([0-9.]+) [^$]+$', '*KEY*,sent,authenticated_user,date,time,size,destination_ip')" } # sent # Accept this line accept = { label = "accept" comment = "Accept this line" # v1.1 # value = "accept_collected_entry_using_regexp('^()to', true)" value = "accept_collected_entry_using_regexp('^()to', false)" } # accept } # log.parsing_filters # Database fields database.fields = { date_time = { label = "$lang_stats.field_labels.date_time" log_field = "date_time" type = "string" suppress_top = 0 suppress_bottom = 3 display_format_type = "date_time" } # date_time day_of_week = { label = "$lang_stats.field_labels.day_of_week" log_field = "day_of_week" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "day_of_week" } # day_of_week hour_of_day = { label = "$lang_stats.field_labels.hour_of_day" log_field = "hour_of_day" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "hour_of_day" } # hour_of_day from = { label = "$lang_stats.field_labels.from" log_field = "from" type = "string" suppress_top = 0 suppress_bottom = 3 } # from to = { label = "$lang_stats.field_labels.to" log_field = "to" type = "string" suppress_top = 0 suppress_bottom = 3 } # to sent = { label = "$lang_stats.field_labels.sent" log_field = "sent" type = "string" suppress_top = 0 suppress_bottom = 3 } # sent authenticated_user = { label = "$lang_stats.field_labels.authenticated_user" log_field = "authenticated_user" type = "string" suppress_top = 0 suppress_bottom = 3 } # authenticated_user source_ip = { label = "$lang_stats.field_labels.source_ip" log_field = "source_ip" type = "string" suppress_top = 0 suppress_bottom = 3 } # source_ip destination_ip = { label = "$lang_stats.field_labels.destination_ip" log_field = "destination_ip" type = "string" suppress_top = 0 suppress_bottom = 3 } # destination_ip } # database.fields database.numerical_fields = { messages = { label = "$lang_stats.field_labels.messages" default = true requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # messages size = { label = "$lang_stats.field_labels.size" default = false requires_log_field = true log_field = "size" type = "int" integer_bits = 64 display_format_type = "bandwidth" } # size } # database.numerical_fields log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'messages = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" from = true to = true sent = true authenticated_user = true source_ip = true destination_ip = true } # report_groups } # create_profile_wizard_options } # eims_smtp_24