# Copyright (c) 2010 Flowerfire, Inc. All Rights Reserved. youngzsoft_ccproxy = { plugin_version = "1.1" info.1.manufacturer = "Youngzsoft" info.1.device = "CCProxy" info.1.version.1 = "" # version for original plug-in different and unknown info.1.version.2 = "6.61" # ????-??-?? - 1.0 - ??? - Initial creation. # 2008-10-24 - 1.1 - KBB - Increased flexibility of autodetection and added support for format # variation. Switched to parsing from index/subindex due to field variations. # The name of the log format log.format.format_label = "Youngzsoft CCProxy Log Format" log.miscellaneous.log_data_type = "firewall" log.miscellaneous.log_format_type = "proxy_server" # The log is in this format if any of the first ten lines match this regular expression #[2008-08-01 11:42:05] 192.168.22.22 SONYA HTTP GETCache http://blogs.hello.net/hello/files/2008/04/hello.jpg #[2008-03-11 00:00:23] 192.168.66.66 nanette Web GET http://www.goodbye.org/goodbye.html #log.format.autodetect_regular_expression = "^\\[[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]\\] [0-9.]+ [a-zA-Z0-9]* [A-Z][a-z][a-z] [A-Z]*" log.format.autodetect_regular_expression = "^\\[[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9 ][0-9]:[0-9][0-9]:[0-9][0-9]\\] [0-9.]+ [a-zA-Z0-9-]+ [A-Za-z]+ [A-Za-z]+" # The format of dates and times in this log log.format.date_format = "yyyy/mm/dd" log.format.time_format = "h:mm:ss" log.format.parse_only_with_filters = "true" # Log fields log.fields = { date = "" time = "" host.type = "host" machine_name = "" protocol = "" operation = "" url.type = "page" message = "" } # log.fields # Database fields database.fields = { date_time = "" day_of_week = "" hour_of_day = "" host.suppress_bottom = 9 location = "" machine_name = "" protocol = "" operation = "" url = "" file_type = "" worm = "" message = "" } # database.fields # Log Filters log.filters = { set_page_for_worm = { label = "$lang_admin.log_filters.set_page_for_worm_label" comment = "$lang_admin.log_filters.set_page_for_worm_comment" value = "if (starts_with(worm, '(')) then '' else url = '(worm)';" } # set_page_for_worm remove_query = { label = "$lang_admin.log_filters.remove_query_label" comment = "$lang_admin.log_filters.remove_query_comment" value = "if (contains(url, '?')) then url = substr(url, 0, index(url, '?') + 1) . '(parameters)';" } # remove_query detect_page_views = { label = '$lang_admin.log_filters.detect_page_views_label' comment = '$lang_admin.log_filters.detect_page_views_comment' value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;" } # detect_page_views simplify_url = { label = "$lang_admin.log_filters.simplify_url_label" comment = "$lang_admin.log_filters.simplify_url_comment" value = "if (matches_regular_expression(url, '^([^:]+://[^/]+/)')) then url = $1 . '(omitted)'" } # simplify_url strip_non_page_views = { label = '$lang_admin.log_filters.strip_non_page_views_label' comment = '$lang_admin.log_filters.strip_non_page_views_comment' value = "if (page_views == 0) then url = substr(url, 0, last_index(url, '/') + 1) . '(nonpage)';" } # strip_non_page_views mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'hits = 1;' } # mark_entry } # log.filters log.field_options = { sessions_page_field = "url" sessions_visitor_id_field = "hostname" sessions_event_field = "page_views" } # log.field_options log.parsing_filters.parse = ` # This is the older format and the index/subindex final field was the protocol, but the example we have # doesn't include a final field or a final space indicating a missing field. For now, I am ignoring the # possibility of a final field with a protocol and going with one arrangement of fields. #[2008-03-11 00:00:08] 192.168.17.16 chloe Web CONNECT mail.google.com:443 #[2008-03-11 00:00:23] 192.168.17.17 chloe Web GET http://www.cisonoleoniqui.it/too/leoni.htm # This is the newer format. #[2008-08-01 11:43:09] 192.168.22.1 SYLVIA-MAC HTTP POST http://203.33.133.133/northpole/northpole.dll?Action=poll&SessionID=1243070916.889179626 #[2008-08-01 11:43:23] 192.168.22.33 OPS HTTP GETCache http://www.there.com/There/Images/grey_banner.png The page cannot be found if (matches_regular_expression(current_log_line(), "^\\\\[([0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) ([0-9 ][0-9]:[0-9][0-9]:[0-9][0-9])\\\\] ([0-9.]+) ([a-zA-Z0-9-]+) ([A-Za-z]+) ([A-Za-z]+) ([^ ]+) ?([^ ].*)?")) then ( set_collected_field('', 'date', $1); set_collected_field('', 'time', $2); set_collected_field('', 'host', $3); set_collected_field('', 'machine_name', $4); set_collected_field('', 'protocol', $5); set_collected_field('', 'operation', $6); set_collected_field('', 'url', $7); set_collected_field('', 'message', $8); accept_collected_entry('', false); ); ` database.numerical_fields = { hits = { default = false requires_log_field = false entries_field = true } # hits page_views = { default = true requires_log_field = false } # page_views visitors = { default = false log_field = "hostname" type = "unique" } # visitors } # database.numerical_fields create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" } # report_groups } # create_profile_wizard_options } # youngzsoft_ccproxy