# Copyright (c) 2016 Flowerfire, Inc.  All Rights Reserved.
mdaemon8_all = {

  plugin_version = "2.2"

  info.1.manufacturer = "Alt-N Technologies"
  info.1.device = "MDaemon 8+"
  info.1.version.1 = "8"
  info.1.version.2 = "9"
  info.1.version.3 = "10"
  info.1.version.4 = "11"
  info.1.version.5 = "13"
  info.1.version.6 = "15"
  

  # ????-??-?? - 1.0 - ??? - Initial version
  # 2011-02-16 - 2.0 - GMF - Added support for content filter (including subject); reworked to modern standards.
  # 2014-02-28 - 2.1 - GMF - Added support for outbound SMTP; fixed a bug with session not being marked as complete
  # 2016-01-11 - 2.2 - gas - added support for v15 logs
  #                          added support for mail_server_reports snapon

  # The name of the log format
  log.format.format_label = "MDaemon 8+ Log Format"
  log.miscellaneous.log_data_type = "mail_server"
  log.miscellaneous.log_format_type = "mail_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^(START Event Log / MDaemon|[A-Z][a-z][a-z] [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]: Checking for available updates...)"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # The format of dates and times in this log
  log.format.date_format = "yyyy-mm-dd"
  log.format.time_format = "hh:mm:ss"

  # A log entry is a "connection"
  statistics.miscellaneous.entry_name = "events"

  # Log fields
  log.fields = {
    date = ""
    time = ""
    source_ip = ""
    source_port = ""
    source_hostname = ""
    destination_ip = ""
    destination_port = ""
    protocol = ""
    username = ""
    bytes = ""
    bytes_sent = ""
    bytes_received = ""
    sender = ""
    recipient = ""
    event_type = ""
    subject = ""
    spam_score = ""
    messages_processed = ""
    messages_delivered = ""
    messages_filtered = ""
  } # log.fields
      
  # Log Parsing Filters
  log.parsing_filters.parse = `

if (matches_regular_expression(current_log_line(), '^[A-Z][a-z][a-z] ([0-9-]*) ([0-9:]*)\\.*[0-9]*: *\\\\[*[0-9]*:*[0-9]*\\\\]* (.*)$')) then (
  set_collected_field('', 'date', $1);
  set_collected_field('', 'time', $2);
  v.remainder = $3;

  # Parse accepting connection from line
  if (matches_regular_expression(v.remainder, 'Accepting (IMAP|POP|SMTP) (connection) from \\\\[*([^ ]+) (:|to) ([0-9.:]+)\\\\]*')) then (
    set_collected_field('', 'protocol', $1);
    set_collected_field('', 'event_type', $2);
    set_collected_field('', 'connections', 1);
		v.source = $3;
		v.destination = $5;
		## new style ip:port to ip:port
		if (matches_regular_expression(v.source, '^([0-9]+.[0-9]+.[0-9]+.[0-9]+):([0-9]+)$')) then (
			set_collected_field('', 'source_ip', $1);
			set_collected_field('', 'source_port', $2);
				if (matches_regular_expression(v.destination, '^([0-9]+.[0-9]+.[0-9]+.[0-9]+):([0-9]+)$')) then (
					set_collected_field('', 'destination_ip', $1);
					set_collected_field('', 'destination_port', $2);
				);
		);
		## old style ip : port
		else if (matches_regular_expression(v.source, '^([0-9]+.[0-9]+.[0-9]+.[0-9]+)$')) then (
			set_collected_field('', 'source_ip', $1);
			set_collected_field('', 'source_port', v.destination);
		);
  );  

  # Parse IMAP auth user line
  else if (matches_regular_expression(v.remainder, '^Authenticated as ([^$]+)$')) then
    set_collected_field('', 'username', $1);

  # Parse IMAP LOGIN line
  else if (matches_regular_expression(v.remainder, '^[<>-]+ l LOGIN ([^ ]+) [^$]+$')) then
    set_collected_field('', 'username', $1);

  # Parse IMAP bytes line
  else if (matches_regular_expression(v.remainder, '^IMAP session complete, \\\\(([0-9]+) bytes\\\\)$')) then
    set_collected_field('', 'bytes', $1);

  # Parse SMTP sender line
  # 2014-02-18 - GMF - Switched to parsing MAIL FROM lines, since "Sender ok" lines are variable ThreadID:1302380.
#  else if (matches_regular_expression(v.remainder, '^[<>-]+ 250 [^<]*<([^>]+)>, Sender ok$')) then
  else if (matches_regular_expression(v.remainder, '^[<>-]+ [Mm][Aa][Ii][Ll] [Ff][Rr][Oo][Mm]:<([^>]+)>')) then
    set_collected_field('', 'sender', $1);

  # Parse SMTP sender line
  else if (matches_regular_expression(v.remainder, '^[<>-]+ (EHLO|HELO) (.*)$')) then
    set_collected_field('', 'source_hostname', $2);
    
  # Parse SMTP sender line
  # 2014-02-18 - GMF - Switched to parsing RCPT TO lines, since "Sender ok" lines are variable ThreadID:1302380.
#  else if (matches_regular_expression(v.remainder, '^[<>-]+ 250 <([^>]+)>, Recipient ok$')) then
  else if (matches_regular_expression(v.remainder, '^[<>-]+ [Rr][Cc][Pp][Tt] [Tt][Oo]:<([^>]+)>')) then
    set_collected_field('', 'recipient', $1);

  # get spam score
  else if (matches_regular_expression(v.remainder, '^Creating temp file')) then
    set_collected_field('', 'messages_processed', 1);

  # get spam score
  else if (matches_regular_expression(v.remainder, '^Spam Filter score/req: ([0-9./]+)$')) then
    set_collected_field('', 'spam_score', $1);

  # set event type for SMTP messages
  else if (matches_regular_expression(v.remainder, '^(Message) creation successful: [^$]+$')) then (
    set_collected_field('', 'event_type', $1);
    set_collected_field('', 'messages_delivered', 1);
  );
    
  # Parse POP connection line
  else if (matches_regular_expression(v.remainder, '^(Socket) (connection) established \\\\(([0-9.]+) : ([0-9]+) -> [0-9.]+ : [0-9]+\\\\)$')) then (
    set_collected_field('', 'protocol', $1);
    set_collected_field('', 'event_type', $2);
    set_collected_field('', 'connections', 1);
    set_collected_field('', 'source_ip', $3);
    set_collected_field('', 'source_port', $4);
  );

  # Parse POP USER line
  else if (matches_regular_expression(v.remainder, '^<-- USER ([^$]+)$')) then
    set_collected_field('', 'username', $1);

  # Parse session complete bytes line
  else if (matches_regular_expression(v.remainder, '^(SMTP|POP) session (complete|successful|terminated) \\\\(Bytes in/out: ([0-9]+)/([0-9]+)\\\\)$')) then (
    set_collected_field('', 'bytes_received', $1);
    set_collected_field('', 'bytes_sent', $3);
    accept_collected_entry('', false);
  );

  # Accept lines
  else if (matches_regular_expression(v.remainder, '^(SMTP|POP|IMAP) session (complete|successful|terminated)')) then
    accept_collected_entry('', false);

  ##
  ## CONTENT FILTERING
  ##

  else if (matches_regular_expression(v.remainder, '^[*] Message from: (.*)$')) then
    set_collected_field('', 'sender', $1);

  else if (matches_regular_expression(v.remainder, '^[*] Message to: (.*)$')) then
    set_collected_field('', 'recipient', $1);

  else if (matches_regular_expression(v.remainder, '^[*] Message subject: (.*)$')) then
    set_collected_field('', 'subject', $1);

  else if (matches_regular_expression(v.remainder, '^End of (Content Filter) results$')) then (
    set_collected_field('', 'event_type', $1);
    set_collected_field('', 'messages_filtered', 1);
    accept_collected_entry('', false);
  );

);
`
  # Database fields
  database.fields = {
    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    source_ip = {
      suppress_top = 0
      suppress_bottom = 2
    } # source_ip
    source_port = ""
    source_hostname = ""
    protocol = ""
    username = ""
    recipient = ""
    sender = ""
    subject = ""
    spam_score = ""
  } # database.fields

  database.numerical_fields = {
    connections = {
      default = true
      requires_log_field = false
      entries_field = true
    }
    messages_processed.default = true
    messages_delivered.default = true
    messages_filtered.default = true
    bytes = {
      label = "$lang_stats.field_labels.bytes"
      default = true
      requires_log_field = true
      log_field = "bytes"
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # bytes
  } # database.numerical_fields


  log.filters = {
    1 = {
      label = '1'
      comment = '1'
      value = "if (protocol eq 'Socket') then protocol = 'MultiPOP';"
    } # 1    
    2 = {
      label = '2'
      comment = '2'
      value = "if (bytes eq '(empty)') then bytes = bytes_received + bytes_sent;"
    } # 2    
  } # log.filters

  create_profile_wizard_options = {
    # This shows which numerical fields are related to which non-numerical fields.
    database_field_associations = {
      username = {
      	messages_delivered = true
        connections = true
        bytes = true
      }
    }
    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups
    snapons = {
      # Attach a mail_server_reports snapon
      mail_server_reports = {
				snapon = "mail_server_reports"
				name = "mail_server_reports"
				label = "$lang_admin.snapons.mail_server_reports.label"
        parameters = {
          sender_field.parameter_value = "sender"
          recipient_field.parameter_value = "recipient"
          messages_processed_field.parameter_value = "messages_processed"
          have_messages_delivered_field.parameter_value = true
          messages_delivered_field.parameter_value = "messages_delivered"
        } # parameters
      } # mail_server_reports
      # Add the standard reports
      add_standard_reports = {
        name = "add_standard_reports"
				label = "add_standard_reports"
				snapon = "add_standard_reports"
      } # add_standard_reports
    } # snapons
  } # create_profile_wizard_options
} # mdaemon8_all