# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
mirapoint_smtp_via_syslog = {

  version = "1.0"

  info.1.manufacturer = "Mirapoint"
  info.1.device = "Message Server"
  info.1.version.1 = ""

  # 2009-02-04 - GMF - 1.0 - Initial implementation

  # The name of the log format
  log.format.format_label = "Mirapoint SMTP Log Format (Logged To Syslog)"
  log.miscellaneous.log_data_type = "syslog_required"
  log.miscellaneous.log_format_type = "mail_server"

  # The log is in this format if any of the first ten lines match this regular expression
  # e.g. Jan 28 11:21:25 111.22.33.44 1227988835  MTA.MESSAGE.RECEIVED    ASW00220   xxxxx@aaa.co.jp     <497FC124.7020706@aaa.co.jp>        serv2.aaa.co.jp [123.456.78.9]       ()      2039    1
  log.format.autodetect_regular_expression = "[0-9]+  MTA[.]MESSAGE[.][A-Z]"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    sender = {
      type = "hierarchical"
      hierarchy_dividers = "@"
      left_to_right = false
      leading_divider = false
    } # sender

    recipient = {
      type = "hierarchical"
      hierarchy_dividers = "@"
      left_to_right = false
      leading_divider = false
    } # recipient

    messages_queued = ""
    messages_delivered = ""
    bytes_queued = ""
    bytes_delivered = ""

  } # log.fields


  # Log Parsing Filters
  log.parsing_filters.parse = `
if (matches_regular_expression(v.syslog_message, '^([0-9]+)  ([^ ]+) +([^ ]+) +([^ ].*)$')) then (
  v.action = $2;
  v.key = $3;
  set_collected_field(v.key, 'date', normalize_date($1, 'seconds_since_jan1_1970'));
  set_collected_field(v.key, 'time', normalize_time($1, 'seconds_since_jan1_1970'));
  v.remainder = $4;

  # e.g. Jan 28 11:21:25 111.22.33.44 1227988835  MTA.MESSAGE.RECEIVED    ASW00220   xxxxx@aaa.co.jp     <497FC124.7020706@aaa.co.jp>        serv2.aaa.co.jp [123.456.78.9]       ()      2039    1
  if ((v.action eq "MTA.MESSAGE.RECEIVED") and (matches_regular_expression(v.remainder, "^([^ ]+@[^ ]+) +[^ ]+   +[^(]+[(][^)]*[)] +([0-9]+) "))) then (

    rekey_collected_entry('', v.key);
    set_collected_field(v.key, 'sender', $1);
    set_collected_field(v.key, 'bytes', $2);

  ); # MTA.MESSAGE.RECEIVED

  # Handle MTA.MESSAGE.QUEUED lines
  # Jan 28 11:21:25 111.22.33.44 1227988837  MTA.MESSAGE.QUEUED      ASW00220   yyyyy@bbb.co.jp
  if (v.action eq "MTA.MESSAGE.QUEUED") then (

    set_collected_field(v.key, 'messages_queued', 1);
    set_collected_field(v.key, 'messages_delivered', 0);
    set_collected_field(v.key, 'bytes_queued', get_collected_field(v.key, 'bytes'));
    set_collected_field(v.key, 'bytes_delivered', 0);
    set_collected_field(v.key, 'recipient', '');
    accept_collected_entry(v.key, true);

  ); # MTA.MESSAGE.QUEUED

  # Handle MTA.MESSAGE.REMOTE lines (remote delivery?)
  # Jan 28 11:21:25 111.22.33.44 1227988841  MTA.MESSAGE.REMOTE      ASW00220   xxxxx@aaa.co.jp     yyyyy@bbb.co.jp    ([222.44.66.88]: 2.0.0 Ok: queued as 58706570E9)   2346    0       CLR
  else if ((v.action eq "MTA.MESSAGE.REMOTE") and (matches_regular_expression(v.remainder, "^([^ ]+@[^ ]+) +([^ ]+@[^ ]+)"))) then (
    set_collected_field(v.key, 'sender', $1);
    set_collected_field(v.key, 'recipient', $2);

    set_collected_field(v.key, 'messages_queued', 0);
    set_collected_field(v.key, 'messages_delivered', 1);
    set_collected_field(v.key, 'bytes_queued', 0);
    set_collected_field(v.key, 'bytes_delivered', get_collected_field(v.key, 'bytes'));

    accept_collected_entry(v.key, true);

  ); # MTA.MESSAGE.REMOTE

)
`

  # Database fields
  database.fields = {

    sender = ""
    recipient = ""

  } # database.fields

  database.numerical_fields = {

    messages_queued = {
      default = true
    } # messages_queued

    messages_delivered = {
      default = true
    } # messages_delivered

    bytes_queued = {
      default = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # bytes_queued

    bytes_delivered = {
      default = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # bytes_delivered

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      source = true
      destination = true
    } # report_groups

  } # create_profile_wizard_options

} # mirapoint_smtp_via_syslog