# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
mailscanner = {

  plugin_version = "1.0.1"

  # Initial creation - 1.0
  # 2011-06-22 - 1.0.1 - MSG - Edited info lines.

  info.1.manufacturer = "MailScanner"
  info.1.device = "Syslog Required"
  info.1.version.1 = ""

  # The name of the log format
  log.format.format_label = "mailscanner Log Format"
  log.miscellaneous.log_data_type = "syslog_required"  
  log.miscellaneous.log_format_type = "mail_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "New Batch: Scanning [0-9]+ messages, [0-9]+ bytes"
  log.format.autodetect_lines = "20"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    status = {
      label = "$lang_stats.field_labels.status"
      type = "flat"
      index = 0
      subindex = 0
    } # status

    user = {
      label = "$lang_stats.field_labels.user"
      type = "flat"
      index = 0
      subindex = 0
    } # user

    inbound_messages = {
      label = "$lang_stats.field_labels.inbound_messages"
      type = "flat"
      index = 0
      subindex = 0
    } # inbound_messages

    inbound_bytes = {
      label = "$lang_stats.field_labels.inbound_bytes"
      type = "flat"
      index = 0
      subindex = 0
    } # inbound_bytes

    delivered_messages = {
      label = "$lang_stats.field_labels.delivered_messages"
      type = "flat"
      index = 0
      subindex = 0
    } # delivered_messages

    viruses = {
      label = "$lang_stats.field_labels.viruses"
      type = "flat"
      index = 0
      subindex = 0
    } # viruses

    spam_bytes = {
      label = "$lang_stats.field_labels.spam_bytes"
      type = "flat"
      index = 0
      subindex = 0
    } # spam_bytes

    processing_time = {
      label = "$lang_stats.field_labels.processing_time"
      type = "flat"
      index = 0
      subindex = 0
    } # processing_time

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters = {


    # Parse New Batch: line
    new = {
      label = "new"
      comment = ""
      value = "collect_fields_using_regexp('()New Batch: Scanning ([0-9]+) messages, ([0-9]+) bytes', '*KEY*,inbound_messages,inbound_bytes')"
    }

    # Parse Uninfected: Delivered N messages line
    delivered = {
      label = "delivered"
      comment = ""
      value = "collect_fields_using_regexp('()(Uninfected): Delivered ([0-9]+) messages', '*KEY*,status,delivered_messages')"
    }

    # Parse "processing message" line
    processing = {
      label = "processing"
      comment = ""
      value = "collect_fields_using_regexp('()processing message .* for ([^ ]+)\.$', '*KEY*,user')"
    }

    # Parse "identified spam" line
    spam = {
      label = "spam"
      comment = ""
      value = "collect_fields_using_regexp('()(identified spam) .* in ([0-9.]+) seconds, ([0-9]+) bytes', '*KEY*,status,processing_time,spam_bytes')"
    }

    # Parse "Virus Scanning: Found N viruses" line
    virus = {
      label = "virus"
      comment = ""
      value = "collect_fields_using_regexp('()Virus Scanning: Found ([0-9]+) (virus)es', '*KEY*,viruses,status')"
    }

    # Accept on Deliver lines or identified spam lines
    2 = {
      label = "2"
      comment = ""
      value = "accept_collected_entry_using_regexp('()(Delivered |identified spam)', false)"
    } # 2


  } # log.parsing_filters


  # Database fields
  database.fields = {

    status = {
      label = "$lang_stats.field_labels.status"
      log_field = "status"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # status

    user = {
      label = "$lang_stats.field_labels.user"
      log_field = "user"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # user

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    viruses = {
      label = "$lang_stats.field_labels.viruses"
      default = true
      requires_log_field = true
      type = "int"
      display_format_type = "integer"
    } # viruses

    inbound_bytes = {
      label = "$lang_stats.field_labels.inbound_bytes"
      default = false
      requires_log_field = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # inbound_bytes

    spam_bytes = {
      label = "$lang_stats.field_labels.spam_bytes"
      default = false
      requires_log_field = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # spam_bytes

    inbound_messages = {
      label = "$lang_stats.field_labels.inbound_messages"
      default = true
      requires_log_field = true
      type = "int"
      display_format_type = "integer"
    } # inbound_messages

    delivered_messages = {
      label = "$lang_stats.field_labels.delivered_messages"
      default = true
      requires_log_field = true
      type = "int"
      display_format_type = "integer"
    } # delivered_messages

    processing_time = {
      label = "$lang_stats.field_labels.processing_time"
      default = false
      requires_log_field = true
      type = "int"
      integer_bits = 64
      display_format_type = "duration_compact"
    } # processing_time

  } # database.numerical_fields


  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      status = true
      user = true
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
    visitors = true
    sessions = true
    pageviews = true
    individualhosts = true
  } # not_supported

} # mailscanner